Updated NTLM Protocol Name for the Identity Advanced Hunting Tables
The identity tables in Microsoft 365's Advanced hunting feature will soon see the NTLM protocol name updated. The change is aimed at creating parity with other hunting tables, and the rollout is scheduled to begin in late February. The affected tables are the IdentityLogonEvents, IdentityQueryEvents, and IdentityDirectoryEvents. The old protocol name 'Ntlm' will be replaced with the new name 'NTLM'. If your organization currently uses the 'Ntlm' protocol in case-sensitive format, it is advised that you update it to 'NTLM'. The change is expected to be completed by early March.
Message ID: MC509576
The post Updated NTLM Protocol Name for the Identity Advanced Hunting Tables originally appeared on M365 Admin.
Published on:
Learn more
Related posts
Improving the pipeline of Identity-related tables in Microsoft 365 Defender Advanced hunting
Microsoft 365 Defender Advanced hunting is making an improvement to the pipeline of Identity-related tables to reduce delay times in identity-...
Advanced Threat Hunting with Microsoft 365 Defender
In this podcast episode, Michael and Michael dive into the world of advanced threat hunting using Microsoft 365 Defender. Joining the conversa...
Basic Authentication Deprecation in Exchange Online – Autodiscover Protocol
In an effort to further enhance security measures, Basic authentication for the Autodiscover protocol will be turned off in Exchange Online. T...
Turned-Off Remote Power Shell Protocol
In a recent bid to improve tenant security, Microsoft has disabled the Remote Power Shell (RPS) protocol for Exchange Online. This retirement ...
Microsoft Defender for Office 365 Permissions Update | Advanced Hunting
Microsoft Defender for Office 365 is updating the permissions mechanism for accessing Email & collaboration schema in Advanced Hunting to ...
Advanced Hunting Updates in DeviceInfo
The DeviceInfo and DeviceNetworkInfo tables in advanced hunting are getting several updates that aim to improve data freshness and add new dev...
Data Loss Prevention – Out-of-box Advanced Hunting queries for Data Loss Prevention incidents in Microsoft 365 Defender
This post provides information about how to use out-of-box advanced hunting queries for Data Loss Prevention incidents in Microsoft 365 Defend...
WDAC Advanced Hunting Retired ActionTypes and Fields
Microsoft will be making changes to the PolicyNameBuffer and PolicyIdBuffer fields in MDE Advanced Hunting WDAC events by renaming them to Pol...
Disabling Remote PowerShell Protocol in Exchange Online – 7 Day Notice
If you're an Exchange Online tenant user, take note that in around 7 days, the Remote PowerShell (RPS) protocol will be turned off by Microsof...