MS Sentinel: Just Looking

Walkthrough summary

MS Sentinel: Just Looking TryHackMe walkthrough with 29 answered prompts and lab methodology notes.

Sample prompts covered

• What's the row count for SigninLogs_CL table?
  Open the walkthrough page to inspect the full answer and command flow.
• What's the row count for AuditLogs_CL table?
  Open the walkthrough page to inspect the full answer and command flow.
• Key combination for running KQL queries in Query Editor?
  Open the walkthrough page to inspect the full answer and command flow.
• MITRE ATT&CK sub-technique for rule: Account Created and Deleted in Short Timeframe
  Open the walkthrough page to inspect the full answer and command flow.
• Rule frequency (in hrs) for rule: Attempts to sign in to disabled accounts
  Open the walkthrough page to inspect the full answer and command flow.