New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use of watchlist to create an analytic rule in Sentinel #218

Open

cybergeekwise opened this issue Apr 3, 2024 · 0 comments

cybergeekwise commented Apr 3, 2024 •

edited

This rule triggers when there is a DNS query for non-local domain.

//This is my log query and watchlist

Not able to figure it out why i am not seeing the domain listed in the watchlist to my table

log_query

watchlist

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment