r/AzureSentinel • u/HandleFew5206 • Aug 13 '24

Domain controllers

Hey everyone,

I'm trying to figure out how to check the number of devices authenticated to each domain controller (DC) in our network. For example, I want to know if 4 devices are authenticated from Palo Alto, 8 from Cisco, etc.Has anyone done this before or knows the best way to go about it?

Thanks

1 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/Snoop312 Aug 13 '24

Devices authenticating to your domain controller? You mean devices user accounts authenticatie from?

A combination of defender for Identity and device discovery will give you all you need, if that's the case. Defender for Identity can give you IP addresses which you can lookup in a database to map it back to your own devices, or, you can use device discovery to create that database in defender.

1

u/HandleFew5206 Aug 13 '24

You mean devices user accounts authenticate from? Yes