Non-interactive login preceding privileged activity (device-code coverage gap)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•0•3

This rule is a placeholder intended to detect abuse of the OAuth device code authentication flow. The current logic attempts to identify successful logins associated with authentication failure reasons; however, the rule author notes that the necessary data source (Azure AD/Entra ID logs) is missing from the SentinelOne SDL event lake, making this detection non-functional for its stated purpose.