Alerting when break-glass domain admin account has been used by someone

Question

Hi, I have a break-glass domain admin account in several forests whose DCs have MDI sensors installed. Is it possible to get alert/mail notification when that account has been used by someone leveraging MDI events/logs?

Answer 1

Hi @Bojan Zivkovic ,

You can use the Link to incident tab after creating the required query to get the identity logon events. here is the link https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-link-to-incident

Once this is done, use this link to set it up for alerts - https://learn.microsoft.com/en-us/defender-xdr/configure-email-notifications