User Profile
NinjaKitty
Brass Contributor
Joined Aug 21, 2020
User Widgets
Recent Discussions
Suspected Golden Ticket usage (time anomaly) false positive
We are currently evaluating Windows Hello. Since then we have regularly received the following defender identity warning for our testgroup only: Suspected Golden Ticket usage (time anomaly). The alert also says that "Due to insufficient source data, the default maximum user ticket lifetime (2 hours) has been applied." Our ticket lifetime is set to 10 hours. Can someone help me with this. NinjaKittyRe: Diffrent results in Defender Activity Log and Advanced Hunting
LiorShapira Screenshots were taken last friday. I added 3 days since its monday now. Interestingly, the advanced hunting results have changed. Now there are entries from november 25. which were not visible last friday. But the numbers still don't compare. 136 to 147 Could that be a delay in transfer to the advanced hunting database? Some entries are still missingDiffrent results in Defender Activity Log and Advanced Hunting
Hello there, we have Defender Identity Sensors running on our Domain Controllers. When I query login results by using Activity Log and Advanced Hunting, i get diffrent result. The device ist our ADFS server. What am i missing here? thank you martinMDI loggs only few DNS queries
hi, we depoyed MDI on our four DCs. Everything seems to work. Events are comming in, alerts are beeing generated. Yesterday I digged into DNS queries and it seems, as if only a few querys are logged by MDI. My expectation is, that every DNS query should be visible in MDI. cheers kitty
