Create ExternalUserAddedRemovedInTeams.yaml#1067
Conversation
This detection flags the occurances of external user accounts that are added to a Team and then removed within one hour.This data is a part of Office 365 Connector in Azure Sentinel. More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365
samikroy
requested review from
Amitbergman,
KobyKoren,
Yaniv-Shasha,
YaronFruchtmann,
dicolanl,
ianhelle,
juliango2100,
liemilyg,
mgladi,
morshabi,
orco365,
preetikr,
sagamzu,
sarah-yo,
shainw and
timbMSFT
as code owners
shainw
left a comment
shainw
left a comment
There was a problem hiding this comment.
Please make the suggested changes to the query. Additionally, when you did your PR it included the deletion of 2 files. Please re-submit your PR without the deletion of these files - Workbooks/AzureActivity.json and Workbooks/WorkbooksMetadata.json
There is a long pending separate PR on this which came in during this submission. |
|
There is a long pending separate PR on this which came in during this submission. |
Query made to detect for an hour.
okay, will have a look |
@samikroy - I completed #796 and so you can remove the file deletion in this PR. |
Added accidentally removed files.
|
Thank you @shainw , have added back the files from master. |
2 participants
This detection flags the occurrences of external user accounts that are added to a Team and then removed within
one hour.This data is a part of Office 365 Connector in Azure Sentinel.
More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365