cloudflare/Azure-Sentinel

Public

9371ae5cddcd4c1df9a7103121378e80d95aea48

Find a branch or tag

HTTPS

Name	Last committed	Last updated
Add two office hunting queries: the first shows new users created; the second user ids or user agents associated with multiple IPs within a short space of time. Also remove user_office_logons - this is an investigation-only query that requires some account name as a filter to avoid high number of hits.9371ae5 7 years ago