User Profile
BCSecA
Copper Contributor
Joined Mar 03, 2021
User Widgets
Recent Discussions
Windows Firewall Rules for Inbound connections from specific IPs with Microsoft Direct Access in use
As the subject says, I am looking to create an inbound firewall rule that allows connections via Microsoft Direct Access but I am a complete novice when it comes to IPv6 which Direct Access operates on. Say my internal IP range of my Management Network is 10.0.1.0/24 How would I create a firewall rule allowing that IP range when IP goes through the 6to4 and Teredo IPv6 transition protocols?How to use AD Log On To restriction but allow Azure AD Pass-Through Authentication
As the title says I am attempting to utilize the "Log On To..." setting in on-premises AD but still allow users to log onto Azure AD authenticated resources such as Office 365. The test accounts can log into only the specified workstation when the setting is enabled. Which is the expected outcome but when this is enabled and the user attempts to log into anything that authenticates via Azure AD, the authentication fails with "Pass-through Authentication" Succeeded: "False". This totally makes sense but I am required to lock down user account(s) to specific computers and still allow Azure AD Authentication for these same users. Is this even possible without going through group policy which gets messy when you only want certain user accounts on certain machines.Find the file creation time/date in Microsoft 365 Defender Alerts for blocked software
In the portal it tells you the SHA1 hash and the path of the file(s) in question but does not indicate when the file was created. This file in particular was found during a routine scan and I would like to know when the file was created for creating a timeline for hunting. Any assistance on this would be appreciated.Azure Sentinel Log Analytics Workspace and Service Map
Hello everyone, This may be the wrong circle to ask this question but here it is. I currently have all of my on-premise servers reporting to Azure Sentinel via the MMA. I recently had a need arise to build a service map and lo and behold Microsoft has a product called Service Map that uses Log Analytics Workspace and the MMA. My question would be if I am ingesting logs for Sentinel already would enabling Service Map add any additional data ingestion/cost to run? https://docs.microsoft.com/en-us/azure/azure-monitor/vm/service-map#enable-service-map Any feedback on this would be greatly appreciated.
