Recent DiscussionsMost RecentNewest TopicsMost LikesSolutionsTagged:TagRe: Failed Sign-in queries not working Hi mvanhorenbeeck, I couldn't find which query in which dashboard this query was associated with. I clicked through all of the queries on the AD dashboard and didn't see this query in any of them. Do you mind giving me more information so I can find it? Also, the query you showed is looking for error codes that do not appear in the list. (!in) I couldn't find any problems with the query but let me know if I am missing something. In the query you showed, the "ErrorCode" column is an extended column displaying a dynamic data type derived from an integer data type ("errorCode"). Both columns are referring to the same data, just displayed differently. I put a query below to demonstrate the difference. I am not sure if this sheds light on this situation, so let me know if this doesn't address your concern. SigninLogs | where TimeGenerated >= ago(365d) | extend ErrorCode = Status.errorCode | extend FailureReason = Status.failureReason | evaluate bag_unpack(Status) | project ErrorCode, errorCode, errorString = tostring(errorCode), errorInt = toint(errorCode) | summarize by tostring(ErrorCode), errorCode, errorString, errorInt
Recent Blog ArticlesNewest TopicsMost LikesTagged:TagMicrosoft Sentinel data lake pricing (preview) This article describes the pricing for the new Microsoft Sentinel data lake billed components in preview. See What is Microsoft Sentinel data lake (preview) to learn more about the data lake, or the ...NCS Case Study - End-to-End Integration of Custom BYOML model with Sentinel Explore how NCS integrates their graph-based machine learning algorithm with Azure Sentinel via BYO-ML platform, tackling alert fatigue in Security Operation Centers (SOCs). Learn how this solution s...What's New in Sentinel Threat Hunting Learn more about recent Sentinel threat hunting updates! Watchlist is now Generally Available Today we are announcing the General Availability (GA) of Azure Sentinel Watchlist to all regions. What's new: Watchlist is now in public preview! We are happy to announce the public preview for the Watchlist feature for Azure Sentinel! What's New: PowerShell+Azure Sentinel notebooks to supercharge your hunting and investigations! Using the latest version of the Azure Sentinel notebooks, you can now enable PowerShell notebooks via .Net Interactive Public Preview! What's new: The new Azure Sentinel Notebooks experience is now in public preview! Introducing a revamped user experience for Azure Sentinel notebooks New Azure Sentinel notebook experience and the retirement of the Azure Notebooks service preview More information regarding the new Azure Sentinel notebook experience and the retirement of the Azure Notebooks preview service and website (see link for the announcement) What's New: Livestream for Azure Sentinel is now released for General Availability We are happy to announce that Livestream for Azure Sentinel is now released for General Availability (GA)!
MicrosoftMicrosoftMicrosoftMicrosoft
