Domain Admin Group is actually Domain AdminS

[dbona75]

Describe the bug

If you manipulate Doamin Admins (Add / remove) the query reports null

To Reproduce

Add/remove a domain admins , wait some time (1 hour at least) and run the query

Expected behavior

the change is logged

Additional context

The solution : please rename "Domain Admin" in "Domain Admins" in the code

---

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-amolpatil]

dbona75 Could you please let us know for which file this is for?

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[dbona75]

Hello, no file it's the code of the query having a problem on the group name Azure-Sentinel/Active Directory Sensitive Group Modifications.yaml at master · Azure/Azure-Sentinel · GitHub<https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/Microsoft%20365%20Defender/Credential%20Access/Active%20Directory%20Sensitive%20Group%20Modifications.yaml> Take care of yourself. Daniele Bona Senior Cloud Solution Architect - Engineering Global Technology Team Security Planned leave : 4–5 Jan 2023 Microsoft respects your privacy. Review our online Privacy Statement<http://go.microsoft.com/fwlink/?LinkId=248681>. [cid:cece4aff-e743-43be-80ba-568bbf6fdedc]

…

________________________________ Da: v-amolpatil ***@***.***> Inviato: venerdì 10 marzo 2023 05:53 A: Azure/Azure-Sentinel ***@***.***> Cc: Daniele Bona ***@***.***>; Mention ***@***.***> Oggetto: Re: [Azure/Azure-Sentinel] Domain Admin Group is actually Domain AdminS (Issue #7529) @dbona75<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdbona75&data=05%7C01%7Cdaniele.bona%40microsoft.com%7Ce23ad00b21b04ad5838108db2123542c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638140207867098911%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=UBLJi4un4U2jg3iiK%2Frh1m7sm3%2FSfwZzs09Oy6t%2FN90%3D&reserved=0> Could you please let us know for which file this is for? — Reply to this email directly, view it on GitHub<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fissues%2F7529%23issuecomment-1463267557&data=05%7C01%7Cdaniele.bona%40microsoft.com%7Ce23ad00b21b04ad5838108db2123542c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638140207867098911%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Usf2LumUUe2hgHMKK7DCtsAbDI4hQoHvuNQ5qQIQkM4%3D&reserved=0>, or unsubscribe<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAQCECSDBG7ITOUQAQYHEN7TW3KXS5ANCNFSM6AAAAAAVVNAQJI&data=05%7C01%7Cdaniele.bona%40microsoft.com%7Ce23ad00b21b04ad5838108db2123542c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638140207867098911%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=UUNM4YieEM8%2Bnhmds9Zc4toCa0QyQvXKMp670MqX9uE%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[v-amolpatil]

Closing this issue as changes for this issue are now in master branch. Feel free to reopen if you need any assistance.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.