How can I find a username associated with a memberSID in Sentinel?
Asked by
SunnySky829
I received an alert saying "user account added to built in domain local or global group." The raw logs show a memberSID, but the member name is blank. I've opened a ticket for assistance, and now the POC wants me to identify the username linked to that memberSID. I'm not sure how to do this—any guidance would be really appreciated!
Answers
If you're uncertain about where to start with searching for the username, you might want to try Google for PowerShell cmdlets that deal with SID lookups. It really helps to focus on the Active Directory context instead of Azure.
Reply to this answer
This seems more related to Active Directory than Azure! You can use PowerShell to find the username from the memberSID. Check out commands like Get-ADUser to pull the details you need. Just make sure you have the right permissions to run these queries.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions