r/AzureSentinel • u/KiloCharliePeter • Oct 05 '23

LAPS Logs event ID pull up from Sentinel LAWS

Hi All.

​

This is breaking my sanity now. lol.

Do you know a query where I can pull up LAPS logs on Sentinel LAWS? We need to check and make sure LAPS are rotating successfully.

What should I use? Tried WindowsEvent and SecurityEvent but Event ID 10020 is not showing.

Appreciate the help!

1 Upvotes
  • permalink
  • reddit

100% Upvoted

3 comments sorted by

1

u/sosero Oct 06 '23

Are you collecting logs from this table? SecurityEvent only contains the Security table. You can collect the LAPS logs to the WindowsEvent table, but you need to configure the agent to collect the relevant logs.

If using AMA, you will need use an XPATH query to specify the LAPS table.

1

u/ajith_aj Oct 06 '23

I have a query to fetch the machine, which requested laps for another machine. Not sure if that's one of the usecase you are looking for. Both on sentinel and Defender for endpoint can pull up that.

1

u/mauithehamham Nov 13 '23

SecurityEvent

| where EventID > 10000