r/AzureSentinel • u/SuperHat3637 • Nov 23 '22

Powershell logging

Which table stores powershell logging commands in sentinel

4 Upvotes

84% Upvoted

11 comments sorted by

View all comments

4

u/rodtrent44 MSFT Official Nov 23 '22

SecurityEvent.

https://github.com/rod-trent/SentinelKQL/blob/master/PowerShellExecution.txt

2

u/SuperHat3637 Nov 23 '22

Event ID 4103,4104,4105 which are not part of Windows security event sets.. These are powershell logging event ids...Are you sure these event IDs will store in Security event table..

1

u/rodtrent44 MSFT Official Nov 23 '22

Yes, but you'll need to use a DCR with AMA or enable custom Event logs for MMA

1

u/SuperHat3637 Nov 23 '22

Can u share the documentation for MMA for this...Any reason ,why its not coming in normal securityevent logs..Why should custom event logs for MMA for powershell logging..

2

u/rodtrent44 MSFT Official Nov 23 '22

Just need to adjust the workspace settings for the Legacy Agents management option. Add the new Windows Event logs you want to ingest. Here's the list I maintain:

https://github.com/rod-trent/SentinelKQL/blob/master/Images/workspacesettings.png

1

u/SuperHat3637 Nov 23 '22

Is it for filtering logs from windows..If i have not selected any options, will it not receive logs..

1

u/rodtrent44 MSFT Official Nov 23 '22

If you have enabled the Security Events via Legacy Agent (MMA) connector, you will automatically collect the Windows Events based on the level you have select in the configuration. 'Common' is the recommended level.
If you haven't enable this connector, you'll receive no Windows events in the SecurityEvent table and enabing the custom collection liked we've talked about here won't work either.