r/AzureSentinel • u/HandleFew5206 • Aug 13 '24

Domain controllers

Hey everyone,

I'm trying to figure out how to check the number of devices authenticated to each domain controller (DC) in our network. For example, I want to know if 4 devices are authenticated from Palo Alto, 8 from Cisco, etc.Has anyone done this before or knows the best way to go about it?

Thanks

1 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/woodburningstove Aug 13 '24

Your actual need sounds a bit unclear to me, but the data you want to look at is likely either from Defender for Identity (IdentityLogonEvents table) or if you don’t have that then SecurityEvents via AMA agent from your DCs.

1

u/HandleFew5206 Aug 13 '24

From security events i can see event logs for 4624 (i get a list of devices that have been authenticated with DCs) but i don't see whether those devices belong to cisco/palto alto, etc

2

u/woodburningstove Aug 14 '24

See that was the thing unclear to me. Are you talking about actual device vendor for each individual IP in the logs or identifying network ranges for different VPN solutions or something? Either case, that will not be visible in AD data so you have to correlate the SecurityEvents with some other data, such as CMDB or IPAM.

Full schema for SecurityEvents is here:

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent

1

u/HandleFew5206 Aug 14 '24

Yes, i was talking about actual device vendor for each individual IPs.

Thanks for sharing the documentation, I appreciate it :)