Skip to content

Restore deleted built-in query in Microsoft Sentinel #264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Restore deleted built-in query in Microsoft Sentinel #264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"tasks": {
"build": "echo \"No build process is defined for this repository.\"",
"test": "echo \"No tests available for this repository.\""
}
}
5 changes: 5 additions & 0 deletions ...e Directory Logs/Queries/Security/Adding credentials to legitimate OAuth Applications.kql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
SecurityEvent
| where EventID == 4720 or EventID == 4732 or EventID == 4740
| where TargetUserName has "OAuth"
| summarize count() by TargetUserName, EventID, EventTime
| project TargetUserName, EventID, EventTime
10 changes: 10 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,3 +57,13 @@ Use [Issues](https://github.com/microsoft/AzureMonitorCommunity/issues) to call

## Redistribution
Upon redistribution of this repo, please be respectful of the readers and authors of this documentation, and include a link to the [original repo master branch](https://github.com/microsoft/AzureMonitorCommunity).

## Restoring Deleted Built-in Queries in Microsoft Sentinel

If you have accidentally deleted a built-in query in Microsoft Sentinel, you can restore it by following these steps:

1. Navigate to the Content Hub in Microsoft Sentinel.
2. Search for the solution pack that contains the deleted query.
3. Reinstall the solution pack to restore the deleted query.

By following these steps, you can restore the deleted built-in query 'Adding credentials to legitimate OAuth Applications' and any other queries that may have been accidentally deleted.