Josh Brower
Josh Brower
`category` sounds good to me!
I agree with @fignew, this becomes a more pressing issue with the lack of Docker packages with Fedora and RHEL/CentOS 8.
https://github.com/jertel/elastalert2
Initial support here - https://github.com/endoflife-date/endoflife.date/pull/799
@EchoGangster SO2 has a Sigma editor within Playbook - https://docs.securityonion.net/en/2.3/playbook.html
Yes, I think something like this would work: `select key,data from registry where path like 'HKEY_LOCAL_MACHINE\Software\Microsoft\Enrollments\%\ProviderID';` 
I should mention that when I disconnected the test system from MiradoreMDM and reran that query, there were no results.
I think the `DiscoveryServiceFullURL` is what you would be looking for: `select key,data from registry where path like 'HKEY_LOCAL_MACHINE\Software\Microsoft\Enrollments\%\DiscoveryServiceFullURL';`  Here is what else is available to query: 
@noahtalerman Let me check a couple things
No, Windows Autopilot is not used very time a device enrolls to MDM. There are multiple ways that a device can be enrolled - In the above miradore example, I...