calling AD group in analytical rule in place of watchlist

[akshay250692]

Hi Team,

can it be possible to use AD group in analytical rule in place of watchlist?

if possible then how it can be done ?

[#2]

AD or AAD?

UEBA helps here...the "IdentityInfo" table, holds the GroupMemberShip:

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-identityinfo-table-is-now-...

[#3]

IdentityInfo
| where GroupMembership in ""
| distinct AccountName, GroupMembership


please check this