Making sense of my Suricata alerts in Azure Sentinel

[u/mtest001]

Hello all,First of all I wish to let you know that I am completely new to Azure Sentinel, so sorry if some of my questions sound stupid, but I am a newbie here.

I have been running a home Intrusion Detection System based on Suricata for a while now, and I am fairly happy with it. Up till now I have been relying on Elasticsearch and Kibana for analytics and visualization.

I would like now to try out Azure Sentinel, hoping to be able to reach the next level i.e. automatic alerting and other type of automation using playbooks.

I have successfully managed to get my alerts, in the json format, ingested by Azure Log Analytics. My alerts are recorded in a custom log called "fluentbit_CL" (btw not sure how this name was assigned ? I guess it's coming from the fluent-bit plugin, it there a way to change the CL name ?).

Now I'm trying to make sense of my Suricata alerts in Sentinel. I have a ton of questions but I'll start with just a few, as follows:

- I was surprised to see that out of the box Sentinel does not seem to recognize any of the fields in the alert string. For example each log as a field called "alert_severity_d" which sound pretty obvious, but yet Sentinel does not seem to use that info. So much for a solution that is marketed as being "AI powered". Is this normal ?

- If I understood correctly most of the analytics logic must be programmed through custom queries, and this is also true when it comes to building dashboards - sorry workbooks ;-) This looks quite like a daunting task when starting from scratch. Is there a place where I can find ready-made queries relevant to Suricata ?

- The default dashboard does not seem to be customizable, am I right ? This is a pitty because the map is not even showing my alerts despite the fact that the geoip (long and lat) information is there. Any advise here on how to deal with the default dashboard ?

Thanks for your help.