Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. In Sentinel, a KQL count, a threshold and a join are enough to catch it.
security · azure · data · the practical side
Push-bombing leaves a loud shape in SigninLogs. In Sentinel, a KQL count, a threshold and a join are enough to catch it.