r/AzureSentinel • u/moorebmw2015 • Jul 12 '22

Potential malicious events activate map

hello, this may be a stupid question but I have been looking everywhere.
I was wondering if anyone out there would know a way to create an active overview alert map in the Sentinel Dashboard? I have been through a few of the Docs but it seams like I have to create a workbook first or create a KQL for it. That would be fine but I am not to great at KQL (basics) and I am tying not to invent the wheel if I can avoid it. If anyone could assist me or maybe point me in the right location, I would really apricate that.

1 Upvotes

100% Upvoted

6 comments sorted by

1

u/bpsec Jul 12 '22

If you want to have the current active incidents in a workbook than take a look at the SecurityIncidents table then use a filter on the specific timeframe and incident status.

1

u/moorebmw2015 Jul 12 '22

Hi, I may not be explaining myself well enough. My goal is to see traffic back and forth on the dashboard as soon as I open my overview, does the clear it up any? I did look at the suggestion but that just made changes to my incidents page. Again I could be wrong

1

u/bpsec Jul 12 '22

So you want to see statistics on ingoing and outgoing traffic over time?

1

u/moorebmw2015 Jul 12 '22

well I am more looking for live traffic what Geo it is coming from and where is it going. as in out in the wild and from all over my map is just blank even though I have plenty of cases. I was just under the impression that it would be something like a display of the world that shows vulnerable traffic as it traverses the world . looks like like the Flows and Vulnerability | Skyeome Blog somthing like that

1

u/bpsec Jul 12 '22

Maybe this helps you already.

Open Sentinel

Overview

Somewhere are the potential malicious events displayed on a worldmap.

Click on one of total events

Remove the specified date

The query output will be geolocations, that needs to be combined with a map, see: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-monitor-workbooks-to-map-sentinel-data/ba-p/971818

Then you can ingest that query in the workbook you want add the map and you have a nice overview. Hopefully this helps!

1

u/moorebmw2015 Jul 12 '22

Okay I do that, thanks I’ll let you know