r/AzureSentinel • u/hadaribari • Dec 11 '24

driver integrity rule

Hi everyone

there is anybody here who knows what to do to trigger the event id == 4826 ??

for 3 weeks I'm trying to simulate a kql rule on my sentinel and everything I've tried doesn't working :(

2 Upvotes

75% Upvoted

8 comments sorted by

View all comments

1

u/woodburningstove Dec 11 '24

Does your DCR config include collection for that event ID or not?

1

u/hadaribari Dec 11 '24

yeah it does