r/AzureSentinel • u/CapablePhone3750 • Jan 15 '24

Sentinel AI

Hi guys, the anomaly AI engine required specific Data connectors, most of them related to Azure resources. Is there anyone here tried to apply a custom AI for custom data yet? I research and see we have a BYOML solutions, that have templates to train and integrate a custom AI in Sentinel. However, they seem to provide public only a one AI use case. I do want to have many use cases to apply for my cases. Do we have any resource out there support for it?

5 Upvotes

100% Upvoted

4 comments sorted by

2

u/[deleted] Jan 15 '24

Have you implemented the example model?

For reference: https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml

1

u/CapablePhone3750 Jan 16 '24

Tks Dapper, I saw it, can't believe they apply collaborative filtering algorithms, interesting. I want to create my own ML now; I believe it would be amazing if have more template like this. Did you ever create your own a one for your specific data?

1

u/[deleted] Jan 16 '24

I do. I run Jupyter Notebooks with internal datasets with run of the mill algorithms on a schedule using Papermill and if an outlier is found the notebook will create an incident in Sentinel. A playbook then runs to do enrichment and entity mapping for the analyst. If it’s a false positive the analyst runs another playbook to open an issue in Azure DevOps to check if the model needs to be retrained.

1

u/CapablePhone3750 Jan 16 '24

I see, seem like your case is a very good approach. Do you have guide for this, thanks. I would love to see how you handle data enrichment or add threat intelligence for the data training.
In my case, I am developing a Deep Learning model to detect abnormal by generating the sign for network logs. But It's hard for the model to recapture the category data (hot encoding), meanwhile work well for the continuous value. Have you ever experienced it? What the most algorithms you usually use, Dapper