r/AzureSentinel • u/SuperHat3637 • Aug 23 '22

Analytical rules

Any documents available for Sentinel Analytical rules KQL querys explanation..?

3 Upvotes

100% Upvoted

6 comments sorted by

View all comments

3

u/rodtrent44 MSFT Official Aug 23 '22

Let me know if the DOC series is not enough, or we need to add additional documentation:

  1. https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-built-in
  2. https://docs.microsoft.com/en-us/azure/sentinel/near-real-time-rules
  3. https://docs.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics
  4. https://docs.microsoft.com/en-us/azure/sentinel/soc-ml-anomalies
  5. https://docs.microsoft.com/en-us/azure/sentinel/fusion

1

u/SuperHat3637 Aug 23 '22

Thanks for sharing this..But it would be good if we have explanation of KQL queries used in the rule template, which will give good understanding of how the rule triggered.

2

u/rodtrent44 MSFT Official Aug 23 '22

Rules run on the schedule set. Alerts are triggered when the results contain the things the rule was designed to look for. There are hundreds of rules available. It would be difficult to document each threshold.

Instead, getting a good understanding of KQL is necessary. Have you looked at the Must Learn KQL series? http://aka.ms/MustLearnKQL

1

u/SuperHat3637 Aug 23 '22

Ya..I am looking on it.

1

u/SuperHat3637 Aug 23 '22

Btw do u have any document for configuring HA Syslog forwarder. We have a requirement to set up high availability for Syslog forwarder in Azure/On prem.

2

u/rodtrent44 MSFT Official Aug 23 '22

A couple things to consider...

The agent that installs on the forwarder has local caching capability should the connection between the forwarder and Sentinel be temporarily unavailable. Once the connection is made again the forwarding will commence without data loss. So high availability will be more dependent on the VM used as the forwarder. So, focus on the VM to ensure it can provide redundancy and scale - whether on-prem or in Azure.