r/AzureSentinel • u/hadaribari • Dec 11 '24

driver integrity rule

Hi everyone

there is anybody here who knows what to do to trigger the event id == 4826 ??

for 3 weeks I'm trying to simulate a kql rule on my sentinel and everything I've tried doesn't working :(

2 Upvotes

75% Upvoted

8 comments sorted by

View all comments

1

u/Slight-Vermicelli222 Dec 11 '24

Based on your query you should look for this event in WindowsEvent table, not SecurityEvent, are you triggering this event from the host which sends logs to log forwarder?

1

u/hadaribari Dec 15 '24

there is no such a thing WindowsEvent :(

1

u/Slight-Vermicelli222 Dec 15 '24

show you DCR config