Sentinel-Queries
Sentinel-Queries copied to clipboard
Update Identity-DetectingFirstTimeAccesstoAzureManagement.kql
Added extra context to the query by providing the Department and AccountCreationTime which can help to investigate incidents/hunts easily. Those two columns are needed to see if it is expected for such a department and/or if the user is recently added, and thus has never accessed a management portal before.