Hi,
I have connected Azure Sentinel with Azure ATP (preview).
For test purposes, I did a golden ticket attack on my test environment, to see if this attack can be seen on Azure Sentinel. The event "Suspected Golden Ticket usage" ID 2027, was successfully displayed in Azure ATP Portal, but there isn't this event in my Azure Sentinel. However, when I used PsExec tool, the event "Remote code execution attempt' ID 2019, was successfully displayed in Azure ATP Portal AND Azure Sentinel. So I don't think that my problem is the configuration of the data connector between Azure Sentinel and Azure ATP.
Is there a reason for this event not to be displayed in Sentinel ?
I have provided some screenshots just in case.
