Using KQL in a Playbook for Sentinel

[Ma]

Thanks Andrea!

[Sylvain Hamel]

I did the same thing but instead I called a runbook hybrid worker to get the data from local AD. The reason I did that is because I find the identity table is not updated fast enough if an account is disabled.

[Mustafe Maxamed]

Help