Bert-Jan

icon indicating a website link https://kqlquery.com/

icon location Cyber Security Specialist | Blue Team | KQL | Sentinel | XDR

Results 7 comments of Bert-Jan

Create ASR--Rule-Ransomware-triggered.yaml

How do I fix the last validation error about the DocumentsLinkValidation?

Add monitoring for cloud break glass accounts

Hi, thank you for the request. Can you change the Sentinel query to match the tables available in Sentinel?

Add monitoring for cloud break glass accounts

No problem at all! I will add the Sentinel table in their with the same logic once I return from the EU Cloud Summit. Thanks for this addition!

Scheduled Tasks Section

Hey, This took way too long to investigate. I added your suggestion now as a default value, the scheduled task should have been executed in the last 7 days, or...

Issue with Sentinel Query

Hi, Can you share some context on what automation solution you are using and at which step the error is returned? Based on the schedule, I suspect one of the...

Issue with Sentinel Query

Thanks for sharing, this is related to the Report-NewTableActionFound Logic App. Can you execute the KQL below in your Sentinel tenant and share the results? ```KQL let TimeFrame = 180d;...

Issue with Sentinel Query

Thanks for sharing. It seems that the tenant you have contains more data than the query can handle. Just to confirm if you change the TimeFrame 90 or 30 days,...