LoFP LoFP / entityanalytics_entra_id

entityanalytics_entra_id rule

TitleTags
authorized red team or penetration testing engagements that register devices with this os profile will appear in the device inventory and match this rule. if this is expected, add exceptions for the specific host names or device ids.
authorized red team or penetration testing engagements that use roadtools to register devices will appear in the device inventory and match this rule. if this is expected, add exceptions for the specific host names or device ids.
unmanaged or imaged windows 10 20h1 hosts may legitimately report the `10.0.19041.928` build with a default \"desktop-\" host name. validate against your device inventory and patch baseline before escalating.
unmanaged or never-patched windows 10 22h2 hosts may legitimately report the `10.0.19045.2006` build with a default \"desktop-\" host name. validate against your device inventory and patch baseline before escalating.