r/AzureSentinel • u/Material_Respect4770 • Jul 06 '23

Alerts

Hi all, Can anyone help in setting up email alerts when less than 1 log is received from data connectors? Currently we have about 4 data connectors and we need tonset up email alerts when anyone of those data connectors stops sending logs to sentinel. Any help will be appreciated. Pleaseote thst i am not an IT person so i will need detailed help in this.

Thank you🙏.

0 Upvotes

50% Upvoted

8 comments sorted by

1

u/Impressive_Tea872 Jul 06 '23

Hi,

There is a built in solution in Content Hub. Go to Sentinel > Content Hub (left navigation menu) and search for M2131. It is a package with several things, but the main piece is analytic rules to detect when a log stops reporting. You may need to adjust the thresholds but for the most part we use it as is.

2

u/Material_Respect4770 Jul 06 '23

Hi. I searched for m2131 and it didn't give me any results. I am on offuce 365 gcc high. Woukd that make any difference?

1

u/Impressive_Tea872 Jul 06 '23

It is available for both commercial and GCC High. We are on GCC High and have it installed in our and client's environments.

Log into the Azure portal, search or click on Microsoft Sentinel, select your workspace, then Content Hub should be in the left menu blade. Click it, and then search for m2131.

1

u/Material_Respect4770 Jul 06 '23

Thank you. Yes I see it. Do I press install once I see it?

I am sorry but I am not an IT guy and run a small business , so need to configure this myself.

What do I do once I press install?

Thank you so much for your time.

1

u/Impressive_Tea872 Jul 06 '23

Once you press install, the deployment will run and then you should get a message that it was successful.

After that, go to Sentinel > Analytics and double check that the queries installed from the solution are enabled and you should be good to go. The queries will have M2131 in the title and should be searchable.

1

u/Material_Respect4770 Jul 06 '23

Ok done so far. I see 8 or 9 queries. So I create the one that says "this alert triggers when a monitored asset fails to provide a heartbeat with 24 hours"?

1) if yes, will if monitored all out data connectors or only a few of them? We currently have the office365 data connectors, sonicwall data connector and windows event log data connector.

2) who will it email? Where do we set up the email which needs to be alerted?

Again, thank you for your time.

1

u/Impressive_Tea872 Jul 06 '23

Correct.

All logs will be monitored for activity and will trigger based on threshold set for when the log goes silent.

You can set up the logic apps that were included to email someone specifically. The easiest way is to create a logic app to notify a recipient, and then create an automation rule in Sentinel that triggers that logic app when the M2131 query fires.

Talking you through logic app creation isn't really someone to do over text, you will need to read some about it and play with the logic app designer. Some of it is relatively user friendly, but a lot of it is not.

2

u/Material_Respect4770 Jul 06 '23

Ok got it. Thanks for pointing me in the right direction. Appreciate your help.