Added missing TargetUserName and TargetDomainName
Added missing TargetUserName and TargetDomainName as the rule was failing after the last update
This commit is contained in:
Родитель
c3f6243c39
Коммит
ac62bd58bb
|
@ -94,7 +94,7 @@ query: |
|
|||
| where DisableTime - EnableTime < spanoftime
|
||||
| extend TimeDelta = DisableTime - EnableTime
|
||||
| where tolong(TimeDelta) >= threshold
|
||||
| project TimeDelta, EnableTime, EnableEventID, EnableActivity, Computer, TargetAccount, TargetSid, UserPrincipalName,
|
||||
| project TimeDelta, EnableTime, EnableEventID, EnableActivity, Computer, TargetAccount, TargetSid, TargetUserName, TargetDomainName, UserPrincipalName,
|
||||
AccountUsedToEnable, SIDofAccountUsedToEnable, DisableTime, DisableEventID, DisableActivity, AccountUsedToDisable, SIDofAccountUsedToDisable,
|
||||
EnabledBySubjectUserName, EnabledBySubjectDomainName, DisabledBySubjectUserName, DisabledBySubjectDomainName
|
||||
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
|
||||
|
@ -137,7 +137,7 @@ entityMappings:
|
|||
columnName: HostName
|
||||
- identifier: NTDomain
|
||||
columnName: HostNameDomain
|
||||
version: 1.2.1
|
||||
version: 1.2.2
|
||||
kind: Scheduled
|
||||
metadata:
|
||||
source:
|
||||
|
@ -147,4 +147,4 @@ metadata:
|
|||
support:
|
||||
tier: Community
|
||||
categories:
|
||||
domains: [ "Security - Others", "Identity" ]
|
||||
domains: [ "Security - Others", "Identity" ]
|
||||
|
|
Загрузка…
Ссылка в новой задаче