Using KQL in a Playbook for Sentinel

Andrea Fisher

Nov 22, 2023

Fun with parsing JSON

Read →

4 Comments

Ma

Thanks Andrea!

I did the same thing but instead I called a runbook hybrid worker to get the data from local AD. The reason I did that is because I find the identity table is not updated fast enough if an account is disabled.

Help

What kind of help are you looking for? Something related to the article?

Reply

Share

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts