How to add back a deleted Microsoft Sentinel built in query?

Open
#255 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Stale
Tech stack
azure
Domain
cloud, security

Research direction

Start in Microsoft Sentinel’s Hunting area and review the built-in query list for “Adding credentials to legitimate OAuth Applications”; the issue names no repository file or test. Done means documenting a supported way to restore or rerun the deleted query, or clearly recording that recovery is unavailable.

Written by the indexing model from the issue text.

Description

Image
Hello! I am learning Microsoft Azure. I downloaded the Microsoft Sentinel Training Lab Solution. Then in MIcrosoft Sentinel, /Hunting ran the built in query 'Adding credentials to legitimate OAuth Applications' with the T1098-Account Manipulation technique. I got 5 results but on clicking the query, couldn't get the results page to pop up. So I clicked on the delete thinking I will reselect and rerun the query but looks like I deleted it from the built-in list :( Now I only see the 5 built-in queries Image

Dominant language
PowerShell
Stars
1.2k
Forks
493
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/AzureMonitorCommunity

All issues in microsoft/AzureMonitorCommunity

Similar issues

More Cloud issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.