Alerts & Incident

Question

Alerts & Incident

Rajneesh Kapoor 1

I want a KQL query or something regarding whenever I share my screen and grant control of meeting then I should be getting a alert/incident for the same with all the host details and 3rd party user details in Microsoft Azure Portal.

Ps: I work as Security analyst.Please guide and help.

Rajneesh Kapoor 1 Reputation point

2022-10-12T18:48:19.877+00:00

Hi All,

Please help out that how would i can view details in Azure portal/sentinel for the person who granted control to the viewer to make changes to his system.

And second, if not teams then for any screen sharing application like anydesk so how to get host data nad for the same a generated alert in sentinel azure.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-10-13T05:59:21.327+00:00

@Rajneesh Kapoor Thank you for reaching out to us. As I understand you are looking for getting a alert/incident when you share screen/grant control of meeting.

To start with application which is being used for screen sharing, does it have any audit logs ? Are these logs are integrated with Azure Sentinel ?

Let me know if you have any further questions.

2 answers

Your answer

Rajneesh Kapoor 1 Reputation point

2022-10-12T18:48:19.877+00:00

Hi All,

Please help out that how would i can view details in Azure portal/sentinel for the person who granted control to the viewer to make changes to his system.

And second, if not teams then for any screen sharing application like anydesk so how to get host data nad for the same a generated alert in sentinel azure.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-10-13T05:59:21.327+00:00

@Rajneesh Kapoor Thank you for reaching out to us. As I understand you are looking for getting a alert/incident when you share screen/grant control of meeting.

To start with application which is being used for screen sharing, does it have any audit logs ? Are these logs are integrated with Azure Sentinel ?

Let me know if you have any further questions.

Answer 1

Rafael da Rocha 5,251

Hello,
looking at the events that are audited in teams, looks like screen share and control isn't one of them:
Search the audit log for events in Microsoft Teams

Rajneesh Kapoor 1 Reputation point

2022-10-12T18:47:26.31+00:00

Thanks Rafael,

So can you help out that how would i can view details in Azure portal/sentinel for the person who granted control to the viewer to make changes to his system.

And second, if not teams then for any screen sharing application like anydesk so how to get host data nad for the same a generated alert in sentinel azure.
Rafael da Rocha 5,251 Reputation points

2022-10-12T19:00:25.723+00:00

For Teams or any other application this will always depend on the application generating events that can be audited and then ingested by Sentinel.
Each application will have it's own behavior, so there's really no "one size fits all".
Rajneesh Kapoor 1 Reputation point

2022-10-12T19:03:34.623+00:00

So from where i can edit application generated event or how can i edit those policies to generate incident.

PS: please navigate.
Rajneesh Kapoor 1 Reputation point

2022-10-12T19:04:04.337+00:00

Thankyou for the guidance man!
Rafael da Rocha 5,251 Reputation points

2022-10-12T19:41:48.03+00:00

Not much specific help I can provide, as I don't know what kind of events Anydesk or similar applications generate, and if any additional configuration is needed.
The application documentation might have some pointers.

The high level here would be to get these events from endpoints into the log analytics workspace so they can be processed by Sentinel to then trigger the intended automations.
Rajneesh Kapoor 1 Reputation point

2022-10-12T23:48:37.043+00:00

Yeah very much true for the endpoint.

Thank you for the information.

Answer 2

Rajneesh Kapoor 1

Hi All,

Please help out that how would i can view details in Azure portal/sentinel for the person who granted control to the viewer to make changes to his system.

And second, if not teams then for any screen sharing application like anydesk so how to get host data nad for the same a generated alert in sentinel azure.

Share via

Alerts & Incident

2 answers

Your answer