3033 event without associated 3077 event #490
Iain McLaren (iainfm)
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi,
We've been trying to use the advanced hunting log to create a policy for an application. However, some binaries that are being caught by CI as not meeting enterprise signing requirements as a 3033 event (AppControlCodeIntegrityOriginBlocked) but without an associated 3077 event. As a result they're not getting included in the KQL results.
Just wondering if anyone knows why this might be, and how to capture the details for policy creation centrally (we can remote-admin the machine in question, so can just scan manually for now).
Many thanks,
Iain
All reactions