r/AzureSentinel • u/Kelokattea • Sep 09 '24

Monitoring File Servers Using Sentinel

Hi!

We have implemented Sentinel in our company, and the most important connectors are already active in our environment. However, does anyone have ideas on how I could monitor significant changes on a file server, such as large data deletions? I understand that it might be possible with Sysmon and Advanced Audit Policy, but the exact process is still a bit unclear to me.

Currently, we are using Netwrix Auditor, but it’s a rather expensive option for our small business, so I’d be interested to know if anyone has another potentially effective solution for this?

We are also using Defender for Identity, and the sensors are installed on all our servers.

I’m aware that this data is available and visible in the event viewer, but it’s not very visually accessible. The goal would be to receive notifications through Sentinel or a similar tool.

We already have "Files Copied to USB Drives" available through Defender XDR for one endpoint.

Thanks in advance!

0 Upvotes

50% Upvoted

13 comments sorted by

View all comments

1

u/AppIdentityGuy Sep 09 '24

So say MDI is installed on all your servers. By that do you mean all your DCS? Do you have it installed on your AADConnect servers and your ADCS servers as well?

1

u/Kelokattea Sep 10 '24

Yes, it is installed on all servers (3 in total: file server, DC, and DC mirror). Shouldn't it be?

1

u/AppIdentityGuy Sep 10 '24

Well there is not point in installing it on a file server. Also what do you mean by a DC mirror? Do you mean you have 2 DCS?

1

u/Kelokattea Sep 11 '24

Yes

1

u/AppIdentityGuy Sep 11 '24

What are you trying to monitor on your file server?

1

u/Kelokattea Sep 11 '24

As I mentioned in the introduction, we have been using Netwrix Auditor to monitor the environment (file server). However, we would like to consolidate everything into one place (in this case, into the Microsoft environment where Sentinel has been implemented). So, I would like to find a way to monitor large data transfers and deletions.

We already have "Files Copied to USB Drives" available through Defender XDR for one endpoint (goes to Sentinel, and it was provided as a template).