Recent DiscussionsMost RecentNewest TopicsMost LikesSolutionsTagged:TagRe: Failed Sign-in queries not working Hi mvanhorenbeeck, I couldn't find which query in which dashboard this query was associated with. I clicked through all of the queries on the AD dashboard and didn't see this query in any of them. Do you mind giving me more information so I can find it? Also, the query you showed is looking for error codes that do not appear in the list. (!in) I couldn't find any problems with the query but let me know if I am missing something. In the query you showed, the "ErrorCode" column is an extended column displaying a dynamic data type derived from an integer data type ("errorCode"). Both columns are referring to the same data, just displayed differently. I put a query below to demonstrate the difference. I am not sure if this sheds light on this situation, so let me know if this doesn't address your concern. SigninLogs | where TimeGenerated >= ago(365d) | extend ErrorCode = Status.errorCode | extend FailureReason = Status.failureReason | evaluate bag_unpack(Status) | project ErrorCode, errorCode, errorString = tostring(errorCode), errorInt = toint(errorCode) | summarize by tostring(ErrorCode), errorCode, errorString, errorInt
Recent Blog ArticlesMost RecentMost LikesNCS Case Study - End-to-End Integration of Custom BYOML model with Sentinel Explore how NCS integrates their graph-based machine learning algorithm with Azure Sentinel via BYO-ML platform, tackling alert fatigue in Security Operation Centers(SOCs). Learn how this solution s...What's New in Sentinel Threat Hunting Learn more about recent Sentinel threat hunting updates! What's New: PowerShell+Azure Sentinel notebooks to supercharge your hunting and investigations! Using the latest version of the Azure Sentinel notebooks, you can now enable PowerShell notebooks via .Net Interactive Public Preview! What's new: The new Azure Sentinel Notebooks experience is now in public preview! Introducing a revamped user experience for Azure Sentinel notebooks Re: Watchlist is now Generally Available The API for ingesting data into the watchlists was changed for the GA release. So I would normally recommend recreating the watchlist so that you are using the latest version that includes the Searc...Watchlist is now Generally Available Today we are announcing the General Availability (GA) of Azure Sentinel Watchlist to all regions. Re: What's New: 80 out of the box hunting queries! See "Create a parser for your data" section the docs for instructions. I believe creating the parser should solve this. What's new: Watchlist is now in public preview! We are happy to announce the public preview for the Watchlist feature for Azure Sentinel! Re: What's new: Watchlist is now in public preview! Sasuke_Ziy - We treat each item in the watchlist as a name/value pair so no schema necessary.In the future we may have templates if you intend to use a watchlist for specific scenarios. New Azure Sentinel notebook experience and the retirement of the Azure Notebooks service preview More information regarding the new Azure Sentinel notebook experience and the retirement of the Azure Notebooks preview service and website (see link for the announcement)
MicrosoftMicrosoftMicrosoftMicrosoft
