ep3p / sentinel_kql Goto Github PK

Hi there

I used your the below KQL for my work.

AWSCloudTrail
| where EventName contains "EmergencyAccessToken" //EventName == "AdminGetEmergencyAccessToken"
| project
    TimeGenerated,
    UserIdentityAccountId,
    UserIdentityUserName,
    UserIdentityArn,

I later found that there is no such event name available in AWS CloudTrail. https://www.gorillastack.com/blog/real-time-events/cloudtrail-event-names/#direct-connect-cloudtrail.

If EmergencyAccessToken is available, can you please let me know how to create this event in AWS?

Thanks
Manohar

Any ideas why this watchlist fails to import as a watchlist? The sentinel message is not super helpful.

"Watchlist [Value-WindowsEventsDictionary] could not be properly saved. "

At first, I thought it might have been because of some non ascii chars (the " and '), but after removing those it still fails to import just the same.