Threat Hunt: Successful login with uncommon user agent
Threat hunting query looking for successful logon events with user agent strings that are uncommon within your environment.
Microsoft Sentinel (KQL)
Threat hunting query looking for successful logon events with user agent strings that are uncommon within your environment.
Already have an account?