Jan 05 2020
- last edited on
Dec 23 2021
Unable to maintain static/dynamic data sets for below sample use cases.
Ex: Interactive login (Success or Failed) from Service Account:
Ideally service accounts are used for application level integration. We need to trigger an alert if interactive/remote interactive login observed from service accounts.
Current work around: I have hard coded the all our service accounts in the KQL query. Which is not feasible in long run.
Challenge: If new service accounts are provisioned. We are missing monitoring on those service accounts until I add them in KQL Query.
Ask: Is there any workaround, KQL to get the data from storage account like blob / can I create table /AD using scripts on scheduled basis /store in log analytics.
Jan 06 2020 12:42 AM
Jan 06 2020 03:54 AM
@Pavan_Gelli1910 You can create your own custom log table and add the entries there. This page has a PowerShell script that shows you the steps. It should be easy enough to modify for your needs or to use it as a basis for a different language.
Jan 06 2020 04:13 AMSolution
@Pavan_Gelli1910 Just saw this timely post on the Azure Sentinel blog page. Could help.