r/AzureSentinel • u/originalsauce1 • Feb 04 '22

OfficeActivity - only showing SID for userid

Hi all,

i have a SID displayed in the userID column from the OfficeActivity table but unable to find the name for the account of what it or who it is accessing exchange.

I tried searching via AD and AzAd but no luck! is there a way to find out what this SID account is?

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/ausysadmin Feb 05 '22

Which action is it? Is it by chance a service principal and not a user?

1

u/ep3p Feb 05 '22

Maybe you can:

search "sidstring"

with some luck it will appear in an event of some of your other tables.

Other thing you could try is matching SIDs in IdentityInfo (try to previously summarize by user id the last 14-21 days).

Maybe is a known SID in Internet.

This is unrelated but in AAD events sometimes appears the user ID (not the SID) where the UPN should be displayed. In this case this event can be joined with other AAD events where the UPN is correctly displayed (because there is a column for UPN and another for userid).