MultipleLdaps
Detect multiple Active Directory LDAP queries made in bin time Replace 10 on line 1 with your desired thershold Replace 1m on line 2 with your desired bin time
Microsoft Sentinel (KQL)

Detect multiple Active Directory LDAP queries made in bin time Replace 10 on line 1 with your desired thershold Replace 1m on line 2 with your desired bin time

Already have an account?