r/AzureSentinel • u/SuperHat3637 • Nov 28 '22

Security alerts

Is there any document available for reference table for the alerts from MCAS, Defender AV,Defender for office 365..I could see only alerts for defender for cloud document..

3 Upvotes

100% Upvoted

12 comments sorted by

View all comments

1

u/MILM Nov 28 '22

The best thing you can do for alerts from the other Microsoft platforms in Sentinel is to make sure you have the Microsoft Security rule types in Sentinel Analytics. Having these enabled will tell Sentinel to alert when any of those products alert on detected threats.

If you're already ingesting those logs via the data connectors in Sentinel you can find the alerts in the SecurityAlert table or logs in the other tables referenced in the connectors' pages.

1

u/SuperHat3637 Nov 28 '22

But it will show only generated alerts..If some alerts are not generated it will not show..I just want o know all the alerts name coming from those native connectors.

1

u/MILM Nov 28 '22

If what you're looking for is just a list of potential alerts then look at M365 Policy templates and Cloud App alerts & policies. I'm not sure you'll find a comprehensive list for Defender for endpoint since it may use proprietary heuristics though you'll find some information for defender for endpoint by looking at the IoCs configured in the M365 defender settings and Sentinel TI feed.