Using KQL in a Playbook for Sentinel

Andrea Fisher

Nov 22, 2023

12

4

1

Fun with parsing JSON

Read →

4 Comments

Ma

Nov 22, 2023

Thanks Andrea!

Expand full comment

I did the same thing but instead I called a runbook hybrid worker to get the data from local AD. The reason I did that is because I find the identity table is not updated fast enough if an account is disabled.

Expand full comment

Help

Expand full comment

What kind of help are you looking for? Something related to the article?

Expand full comment

Reply

Share

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts