User Profile
fishermc
Copper Contributor
Joined Feb 18, 2019
User Widgets
Recent Discussions
Azure Log search - Login search question
With having the ability to search sing-in logs I am trying to figure out the correct query for the following. I want to search for when a single account signs in from multiple IPs. My end goal here is to create a search query that will run say every 15 mins and alert when a user account has been logged in from multiple IP addresses over a specified time frame. My goal is to use this to help pick up on compromised accounts quicker. I know how to setup the alerting part with a query, im just stuck at how to write the part that only picks up when multiple IPs are used....or if its even possible. I don't care if there are multiple sign-ins from the same IP in this scenario, just when different IPs are used for the same user account. User "bob" signs in from IP x.x.x.1 and two mins later x.x.x.2 and then 5 mins later x.x.x.3. I want to know about this and trying to figure out a way how using a query of the sign-in logs. ThanksSolved3.1KViews0likes4CommentsServer core event logs
I have been using the Log Analytics agent to get on-premise server event logs into Sentinel and all has gone well with the exception for Server core boxes. Server Core isn't listed as supported ( https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#log-analytics-agent) so was wondering what is the best way to get server core logs over into Sentinel.Solved2.3KViews0likes3CommentsRe: Azure Log search - Login search question
Thanks for the help, that got me the count and will work. One last question. Using the method you gave me I get the total count of different IPs the sign-ins are coming from for a user, is there a way to also display the actual IPAddresses and not just the user and count? Here is what I got that gives me the count, can something be added that shows the IPs related to the aggregatedvalue? SigninLogs | where ResultType == "0" | summarize AggregatedValue = dcount(IPAddress) by UserPrincipalName | where AggregatedValue > 52.9KViews0likes2Comments
Recent Blog Articles
No content to show