Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Dataverse - Honeypot instance activity

Identifies activities in a predefined Honeypot Dataverse instance. Alerts when either sign-in to the Honeypot is detected or when monitored Dataverse tables in the Honeypot are accessed. Note: Requires a dedicated…

Description

Identifies activities in a predefined Honeypot Dataverse instance. Alerts when either sign-in to the Honeypot is detected or when monitored Dataverse tables in the Honeypot are accessed. Note: Requires a dedicated Honeypot Dataverse instance in Power Platform with auditing enabled.

Detection logic

Detection requirements

Platform
ESXiIaaSIdentity ProviderLinuxmacOSOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source product
dataverse
Log source service
dataverseactivity

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice