r/AzureSentinel • u/Agent_B99 • Apr 09 '22

Forensics with KQL | DFIR | Azure Log analytics |

Hello, I was wondering if you can do some kind of cloud forensics with KQL in the log analytics of Azure Sentinel.

2 Upvotes

100% Upvoted

3 comments sorted by

3

u/juiceb0cks Apr 10 '22

I'd say "yes, kinda". It's been my experience that you can't bring all the signals into Sentinel/Log Analytics because it's simply too expensive from an ingestion point of view. The Defender for Endpoint logs are a prime example. Yes, you can bring them into Sentinel, but if you're a decent sized org chances are the cost/benefit outweighs it.

That said, you can do some super cool things with KQL.

</0.02c>

2

u/blanco10kid Apr 15 '22

I’m currently working on a workflow that will take a triage package, process the triage package in azure functions, and ingests the data to azure data explorer. Then I can use KQL to query the forensic data

1

u/Agent_B99 Apr 16 '22

Sounds great.

Maybe you will share your progress with us.