LoFP / investigate if threshold setting in pim is too low.

Techniques

• t1078

Sample rules

Too Many Global Admins

• source: sigma
• technicques:
  • t1078

Description

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Detection logic

condition: selection
selection:
  riskEventType: tooManyGlobalAdminsAssignedToTenantAlertIncident