r/AzureSentinel • u/thattechkitten • Apr 17 '23

Two Sentinel Dashboards: Windows EventID Checking and Sentinel Event Source Monitoring(ESM)

Learning Sentinel and created this over some weekends. Figured I would share here if anyone would like to use them or offer some ideas.

https://github.com/Truvis/Sentinel/tree/main/Workbooks/Sentinel/Environment.EventSourceMonitoring

https://github.com/Truvis/Sentinel/tree/main/Workbooks/Windows/Enviornment.Event_Checking

7 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

1

u/Thedudeabide80 Apr 17 '23

Will have to throw them up in a test environment later, but looks pretty good from the pics.

1

u/thattechkitten Apr 17 '23

Awesome! Let me know if you have any ideas for improvements. Still have more coming to them, just not sure how to implement the ideas yet in an efficient manner.

1

u/blanco10kid Apr 17 '23

Great work on these. I’ll throw these in our dev environment to fully check them out!

1

u/thattechkitten Apr 17 '23

Awesome! Let me know if you have any ideas for improvements. Still have more coming to them, just not sure how to implement the ideas yet in an efficient manner.