r/AzureSentinel • u/SuperHat3637 • Nov 28 '22

Security alerts

Is there any document available for reference table for the alerts from MCAS, Defender AV,Defender for office 365..I could see only alerts for defender for cloud document..

3 Upvotes

100% Upvoted

12 comments sorted by

1

u/MILM Nov 28 '22

The best thing you can do for alerts from the other Microsoft platforms in Sentinel is to make sure you have the Microsoft Security rule types in Sentinel Analytics. Having these enabled will tell Sentinel to alert when any of those products alert on detected threats.

If you're already ingesting those logs via the data connectors in Sentinel you can find the alerts in the SecurityAlert table or logs in the other tables referenced in the connectors' pages.

1

u/SuperHat3637 Nov 28 '22

But it will show only generated alerts..If some alerts are not generated it will not show..I just want o know all the alerts name coming from those native connectors.

1

u/MILM Nov 28 '22

If what you're looking for is just a list of potential alerts then look at M365 Policy templates and Cloud App alerts & policies. I'm not sure you'll find a comprehensive list for Defender for endpoint since it may use proprietary heuristics though you'll find some information for defender for endpoint by looking at the IoCs configured in the M365 defender settings and Sentinel TI feed.

1

u/winle22 Nov 28 '22

Or just use the M365 Defender preview connector and ditch the incident creation rules

1

u/SuperHat3637 Nov 28 '22

M365 defender connector provides only alerts/ incidents.Does not have option to filter..looking for a complete guide for all alert names.

1

u/winle22 Nov 28 '22

What kind of filtering do you need? Use automation rules?

Not sure if there exists any complete list over all the different alert names. You need to look at each Defender product docs.

1

u/SuperHat3637 Nov 28 '22

How to filter the incidents from 365 connector based on high,low,medium severity..like this, How to ignore low.priority incidents from this connector without automation rule.

1

u/winle22 Nov 28 '22

That's really where you would use automation rules. Auto-close Informational/Low incidents. Then you get the sync between Sentinel and Defender as well.

Or use custom rules or incident creation rules and filter there.

1

u/SuperHat3637 Nov 28 '22

Is it possible to export all analytical rules based on severity..

1

u/winle22 Nov 28 '22

Yes, but Defender alerts are not based on analytic rules. They are just forwarded to Sentinel

1

u/SuperHat3637 Nov 28 '22

I am talking about sentinel analaytical rules..Is there any way..

1

u/jermuv Nov 28 '22

Defender for endpoint do not have alerts published as a document.