Forge

New repository Import repository New issue

Your repositories Your dashboard Sign in

cloudflare/Azure-Sentinel

Public

mirrored fromhttps://github.com/cloudflare/Azure-Sentinel

Watch0 Fork0 Star0

Code Commits Issues Pull requests Actions Insights Security

b20f28c8d72a33e1e46419ae37dc798b8f25c217

Find a branch or tag

Branches

b20f28c8d72a33e1e46419ae37dc798b8f25c217

Tags

No tags available.

0Branches 0Tags

Add file

Code

Clone

HTTPS

Commit history

Commits on b20f28c8d72a33e1e46419ae37dc798b8f25c217

Review the repository timeline and open individual commits from the canonical branch history.

b20f28c8d72a33e1e46419ae37dc798b8f25c21710 commits on this page

Page1 · filtered view

Path:Detections/SecurityEvent

May 29, 20191 commits

Added missing fields for detections
Details
Unverified
Ashwin Patil7 years ago98127d522547

May 8, 20191 commits

changing to query time to 30d
Details
Unverified
Ashwin Patil7 years ago99dec7ebcb0c

May 7, 20191 commits

changes per feedback from Shain
Details
Unverified
Ashwin Patil7 years agofa26b41a7a93

May 6, 20191 commits

timeseriesanalysis and network beaconing queries
Details
Unverified
Ashwin Patil7 years agobea43e930136

Apr 30, 20191 commits

Further filtered down to just SID, which is enough to detect the same user created and then added to the admin group.
Details
Unverified
Jason Nickola7 years agod20075d0f729

Apr 27, 20191 commits

Replaced 'Domain' with 'Computer' in the join because domain will be 'Builtin' for the group and host/domain for the user, preventing a match. Also replaced 'CreatedUser' with 'CreatedUserSid' because the group add entry may not reliably include the name of the user added to the group (SID is also a more reliable identifier in general). Lasltly, removed 'where CreatedUserTime < GroupAddTime' because I'm not sure any other case is possible without manually rigging the logs.
Details
Unverified
Jason Nickola7 years ago84542793ff79

Apr 3, 20192 commits

Updateing list of WellKnownGroupSID to include DNSAdmins and DnsUpdat… (#139)
Details
Unverified
shainw7 years ago3fee97a885e9
Committing initial query for addition and removal of an account to pr… (#137)
Details
Unverified
aprakash137 years ago09b64c1f132a

Apr 2, 20191 commits

Typo fixup
Details
Unverified
timb7 years ago42c0e873b7a8

Apr 1, 20191 commits

Adding in Ajeet's for March
Details
Unverified
Shain Wray (MSTIC)7 years agof6ad54acf6e3