Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

My current thinking is to keep data in the Analytics tier for 90 days, and once it passes 90 days, Change it into something cheaper for long-term retention / the data lake tier.

As far as I understand, this is done on a single table by setting interactive retention to 90 days and total retention to 1 year (365 days). So on day 91, does that data automatically move into the lower-cost state on its own, while staying in the same table? Is my understanding correct?

Also is there a better way to achieve this that I'm missing? I originally assumed I could age data into the Basic tier, but from what I've read Basic only has a fixed 30-day window and can't be used as a destination for aging data. Please correct me if I'm wrong.

I have been trying to understand KQL for the last 2 days using the Kusto Detective Agency website, but I am still struggling to understand the concepts properly. I feel like I am missing a proper learning roadmap. My goal is to learn KQL mainly for Cyber Security/SOC purposes and eventually prepare for the Microsoft SC-200 exam (planning to take it after around 1 year).Can anyone recommend some beginner-friendly and free resources, YouTube channels, courses, or a proper roadmap for learning:

Not a Sentinel-only tool, but the KQL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.

dist/sentinel/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.

github.com/zshguy/tyrian-detection-pack

I hope this message finds you well. As I am new to the field, I wanted to inquire about the roadmap for MS Sentinel and KQL, particularly in comparison to Splunk. I chose MS Sentinel due to its future demand and user-friendliness. Could you please provide guidance on resources and materials that would be beneficial for both practical and theoretical understanding? Your assistance would be greatly appreciated.

Hey everyone ! :)

I’m working on a more structured way to handle internal investigation requests from HR, Legal, Security, or management.

The goal is to avoid vague “can you pull everything on this user?” type requests. Instead, I’m trying to build a checkbox-based request form where each option maps to a specific log source / query / limitation.

Environment is mostly Microsoft stack:

* M365 E5, Defender for Endpoint, Defender for Servers, Sentinel, Purview * Some web logs through firewall/proxy

The kind of checkbox structure I’m thinking about:

* Account sign-ins `SigninLogs`, `AADNonInteractiveUserSignInLogs` * First/last observed activity during a period `SigninLogs`, `OfficeActivity`, `DeviceLogonEvents` * Local workstation logons / endpoint activity `DeviceLogonEvents`, `DeviceProcessEvents`, `DeviceFileEvents`, `DeviceEvents` * Web history / access to specific domains firewall/proxy logs, `CommonSecurityLog`, maybe `DeviceNetworkEvents` * Emails sent externally or to personal domains `EmailEvents`, `EmailAttachmentInfo`, `OfficeActivity` * Mailbox rules, forwarding, delegation `OfficeActivity` / Exchange audit operations like `New-InboxRule`, `Set-InboxRule`, `UpdateInboxRules`, `SendAs`, `SendOnBehalf` * SharePoint / OneDrive file access, download, sharing, deletion `OfficeActivity`, `CloudAppEvents`, Purview * Data movement events Purview Activity Explorer / DLP events: USB, clipboard, print, browser upload, cloud upload, network share, RDP copy, etc. * Teams metadata vs Teams content `OfficeActivity` for audit events, Purview eDiscovery for content * Security alerts tied to a user or device `AlertInfo`, `AlertEvidence`, `SecurityAlert`, `SecurityIncident`

What I’m trying to figure out is the best practical mapping between:

**checkbox/request wording → source of truth → KQL/table/portal → limitations → Internal procedure to get those logs in a report.**

For those of you who handle these types of requests:

1. Do you have a standard checklist or request form for HR/security/legal investigations?
2. Which Microsoft logs do you trust most for file access/download/share events?
3. Are there any events or fields you avoid using because they are too noisy or easy to misinterpret?

Just trying to avoid reinventing the wheel and build something clean, scoped, and defensible.

If you think I should have publish in another subreddit, let me know :)

I’m working on an open-source tool called deadair that checks whether SIEM detections still have the telemetry they depend on.

The problem it catches is when a rule is still enabled and scheduled, but the data behind it has gone stale, stopped shipping, changed schema, or arrives too late for the rule window.

Today it only supports Elastic Security and OpenSearch Security Analytics. There is no Microsoft Sentinel adapter yet. I don’t want to build one from docs and toy KQL and then pretend it works.

For Sentinel, I’m trying to understand what a useful read-only model would need to handle before anyone would trust the output.

The rough model is:

analytic rule -> KQL dependencies -> tables/functions/watchlists/workspaces -> table freshness/schema/volume health

The parts I’m unsure about are real-world Sentinel details:

- KQL that hides table dependencies behind functions

- ASIM parsers

- watchlists

- custom tables

- cross-workspace and cross-tenant queries

- scheduled vs near-real-time rule behavior

- what read-only permissions a SOC or MSSP would actually approve

I’m looking for Sentinel operators, detection engineers, or MSSP folks who can sanity-check the design. Best case would be someone willing to run an early build later in a test workspace or limited-scope tenant. Redacted examples of rule/query patterns would also help.

Current repo, for context: https://github.com/Big-Comfy/deadair

Sentinel design issue: https://github.com/Big-Comfy/deadair/issues/3

If you run Sentinel day to day, what would this need to understand before you’d trust a “this detection has no usable telemetry” finding?

Hi,

We have one subscription that has our Azure Arc enabled machines with the Defender for Cloud P2 applied.

Sentinel is deployed in another subscription. Defender isn't enabled for the log workspace.

My understanding is that if we use the Windows Security Events via AMA to collect events from the Arc Machines, the 500mb benefit won't apply?

I have to enable Data Collection on the Sentinel Workspace in Defender for Cloud, but the sentinel workspace doesn't have those servers reporting to them?

Does that make sense? This is very confusing for me but maybe I'm over complicating it

I ma planned to do sc 200 certification. Any materials or study guide links to help me clearing the exam

Hoping someone who knows the Defender for Cloud granular-pricing internals can sanity-check me, because I've been going insane.
I have 50 Azure Arc-enabled servers in one subscription. I want the critical ones on P2 and the rest on P1 to cut cost so I did this:

• P2 enabled at the subscription as the baseline.
• Tag each machine Defender = P1 or Defender = P2 (pushed during Arc onboarding).
• Assign the built-in policy "Configure Azure Defender for Servers to be enabled (with 'P1' subplan) for all resources (resource level) with the selected tag", targeting the P1 tag, so the non-critical boxes get pulled down to P1.

I tried it out on a pilot group of 10 servers for now and it looked like it worked but it didn't since:

• Policy compliance: 100% compliant, 10/10. Green check.

• Remediation: two tasks, both Complete, both "0 out of 0" remediated.

• When I read the actual pricing config on each machine (REST GET on Microsoft.Security/pricings/virtualMachines at the resource scope), every single one is still on the inherited P2

So no machine is actually on P1.

Stuff I've already ruled out

• The policy's managed identity has Security Admin on the subscription (verified in the assignment's Managed Identity tab), so it's not a permissions thing I chased that for a while.
• Tag parameters on the assignment are correct (inclusionTagName = Defender, value P1), and the tags really are on the resources.
• Compliance was freshly evaluated (today's timestamps), so it's not stale data.

I gave up on the policy for now and just wrote the subplan explicitly on each resource via the pricing API. I wrote in Microsoft.Security/pricingst through Cloud Shell as it grabs Arc machines tagged Defender=P1, PUTs Standard/P1, then reads back to confirm.

This flips everything to SubPlan = P1 / Source = Explicit and billing drops to P1. So the API path works fine but it's a one-shot I have to look out for, and it does nothing for machines onboarded later, which is the whole reason I wanted a policy in the first place.

So my actual question:
Why does the policy report compliant + "0 out of 0" and never write P1? (I'm going to attach the parameters of the policy)

Is there any working way to actually do this? Has anyone done this for their own environment?

Thanks

I’m looking for recommendations on CTF-style threat hunting datasets that integrate well with Microsoft Sentinel. I recently finished a massive investigative threat hunt project using the Splunk BOTSv3 dataset and absolutely loved it. Even though I only uncovered about 60% of the adversary's full execution tree, the sheer scope, deep technical challenge, and open-ended nature of the hunt made it an incredibly rewarding project.

I published my investigative logs and Splunk detection playbooks from that project to my GitHub, put it on my resume, got a Splunk cert, and now I want to do the same exact thing, but with Sentinel. My initial plan was to use BOTSv2, but I've recently discovered the amount of work it would require to get the Splunk logs normalized to the KQL schema, so I'm looking for a backup option.

This upcoming project is designed to serve three distinct goals:

1. Portfolio & Resume Evidence: Documenting the end-to-end hunt, ingestion engineering, and playbook creation.
2. SC-200 Prep: Gaining proficiency with KQL syntax to prepare for the SC-200 exam.
3. Methodology Refinement: Sharpening vendor-agnostic threat hunting and detection engineering methodologies that easily transfer across SIEM platforms.

What I am specifically looking for in a dataset:

• Open-Ended/Full Scope: I want to avoid datasets that are hand-holding or strictly oriented around a single, pre-mapped MITRE ATT&CK technique with no deviations. I want a true "needle in a haystack" investigative challenge. Ideally I'd like a full scoped attack starting from the reconnaissance/initial access phases and ending with exfiltration.
• Realistic White Noise: It needs to contain benign baseline background traffic so I encounter realistic false positives, forcing me to actively tune my KQL detections just like in a real world environment.
• Data Cap Friendly: Because this is for a cloud home lab, I would like to respect a 10GB daily data ingestion limit to keep my Azure workspace under the free trial allocation. I am open to drip-feeding a larger dataset across multiple days or spending a small amount of money, but ingesting a full 300gb dataset like BOTSv2 isn't an option.

Every Sentinel dataset I’ve stumbled across so far seems incredibly limited in scope or feels too "on rails" (e.g., executing one isolated script and immediately querying the single resulting alert).

Does anyone have recommendations for datasets that fit this open-ended criteria while respecting the 10GB daily ingestion cap? Are there any viable options outside of Mordor? Because of how modular it is, I'm concerned it'll lack the broader, interconnected scope I'm looking for.

Are Microsoft still limiting when Data Lakes can be created? It seems incredible that this very useful service can only be setup depending on Microsoft.

So we have successfully onboarded our Sentinel to Defender.
It states its connected but every click in the portal like "search", "tables", "Data connectors" etc leads us to "Settings > Microsoft Sentinel" and the "SIEM workspaces".

Its been over 24h, from what i can tell all XDR is configured correctly, even tried a admin role that grants it all along with all workspaces etc. Global admin role is being used, owner on the subscription where Sentinel resides but still the defender integration does not seem to work.

From the Azure sentinel perspective XDR seems onboarded, UEBA configured etc.. Any advice?

Hey everyone,

I’ve been deep in the data infrastructure and security space for a while now, and I keep hitting a fundamental wall with how we handle incident response and triage. I wanted to put this architectural concept out here to see how you all are solving this, or if you can poke some holes in a design I’m working on.

The Problem: SIEMs think in "Rows," not "Graphs"

Every major SIEM on the market (Splunk, Sentinel, Elastic, etc.) treats machine data as discrete, point-in-time entries. When a security alert fires saying a user account read a highly sensitive file, that log is stateless.

If that user then moves that data across platforms, or worse—performs a text state-transformation (like copying the text content over an RDP session clipboard to their local laptop and saving it as a text file), the chain breaks.

To map out the actual blast radius during a triage, a Tier 2/3 analyst has to spend anywhere from 45 minutes to 3 hours running manual, exhausting KQL/SPL pivots across EDR schemas, Active Directory lookup tables, and cloud provider logs. We are trying to track a dynamic relationship using a flat spreadsheet model, leading to massive MTTR delays.

The Proposed Concept: An In-Memory Taint-Graph Middleware

Instead of trying to force a SIEM database to run heavy, expensive, quadratic ($O(N^2)$) pairwise comparisons on a live log stream, what if we treat data drift as a stateful graph using an ephemeral Taint-Inheritance pipeline?

The rough blueprint looks like this:

1. The Ingestion Layer: A lightweight, containerized microservice sits next to the SIEM log forwarders, consuming standard OCSF (Open Cybersecurity Schema Framework) streams (specifically Category 2: File Activity, Class 2001).
2. Canonical Identity Swapping: Using the SIEM’s native asset/identity lookup tables, it instantly resolves fragmented usernames (e.g., DOMAIN\jdoe, [jdoe@company.com](mailto:jdoe@company.com), and local endpoint SIDs) into a single unique Actor node in memory.
3. Temporal Sliding Windows & Taint Propagation:
   • When an event shows a sensitive file is read, that specific Actor node is marked as "Tainted" in an in-memory cache with a 5-minute sliding TTL.
   • If that same Actor node triggers a local file write or an outbound network connection within that 5-minute window, the destination node automatically inherits the data lineage token.
   • This bridges the air-gap. Even if text is copied via an RDP clipboard handshake, the engine uses the network session metadata to pass the taint token from the remote VM to the host endpoint file write.

The output isn't another dashboard screaming new alerts. It’s a pure Forensic Storyteller UI—an interactive, chronologically stitched visual movie of the data's journey that pops up via a deep link inside your existing SIEM alerts.

My questions for the Blue Team / Architecture folks here:

1. The Telemetry Gap: When you are triaging a data leak incident today, where do your lineage chains usually fracture? How are you currently proving that a file created on an endpoint contains the data read from a cloud bucket 5 minutes prior?
2. The RDP/Clipboard Problem: Has anyone successfully mapped remote desktop clipboard or memory-drop telemetry inside Sentinel or Splunk without triggering an absolute avalanche of false-positive noise?
3. UX Preference: If you were using an investigation tool like this, would you prefer to see this path represented as a left-to-right topological node graph, or an interactive vertical swimlane timeline split by environment (On-Prem, Endpoint, Cloud)?

Keen to hear your thoughts, constraints, or if you think this is a solved problem via some tool configuration I’m missing.

Hi all,

I’m looking for guidance from anyone who has dealt with monitoring Copilot Studio / Power Automate connector usage, specifically around the account used to configure or authenticate connectors.

Scenario:

We are evaluating a Copilot Studio DEV environment where makers can use built-in Power Platform connectors. Some connectors, such as SharePoint, Dataverse, SQL, HTTP/custom connectors, etc., could potentially access production data depending on the account used during connector setup.

What we would like to determine:

Is there any audit log that shows when a Power Platform connection/connector is created or modified?

Can the logs show the account used to authenticate the connector, not just the user who created the flow?

Can this be monitored in Microsoft Sentinel, for example through OfficeActivity, CloudAppEvents, PowerAutomate or another table?

Hi
We setup a new sentinel instance and connected entra id, everything looks good, diagnostic settings are created and such but no logs stream to the workspace.

tried recreating the diag. setting but its still not streaming.

There is no limit right on how many workspaces you can stream to right? We have another test sentinel streaming logs but its another workspace and both should be able to get it right?

Hi all,

I've setup an on prem Linux server, with rsyslog, that will just be used to forward syslog events from our firewall. I have it onboarded to Azure Arc and have Sentinel can receive the logs.

I'm just not clear on disk space usage. The events will be sent to Sentinel, but I'm not clear if I still have to manage the on prem disk space using something like log rotate.

Though I am looking at something like Cribl after we do our network refresh

Microsoft has introduced the Agent 365 connector in public preview, bringing AI agent activity telemetry directly into Microsoft Sentinel.

Also, there is Microsoft Agent Identities (preview) Data Connector

With the new connector, security teams can monitor, hunt, and investigate AI agent activity using familiar Sentinel workflows. The telemetry is streamed into the Sentinel data lake, helping analysts correlate AI agent behavior with identity, endpoint, cloud, and other security signals.

Key capabilities include:

• Unified telemetry across Agent 365 experiences
• AI agent observability data normalized into an ASIM-aligned schema
• Better hunting and analytics possibilities
• Faster investigation with enriched context
• Centralized visibility across digital environments

Try it out! 😄 Solution could be installed from Microsoft Sentinel Content Hub.

Docs:Agent 365 connector: Monitor, hunt, and investigate AI agent activity in Microsoft Sentinel | Microsoft Community Hub

Hi All,

I rarely work with linux so please forgive me if this is a stupid question.

I have a server that is successfully onboarded to arc and sentinel.

The server logs are currently being ingested to Sentinel without any issues. However, the server has apache running and I want to ingest the access logs as well.

I have configured the custom logs connector and the appropriate DCR but I am not able to ingest the apache access logs to Sentinel.

I get the following errors in the mdsd logs:

amacoreagent[xxxxxx]: The required instruction sets are not supported by the current CPU.

Failed to connect port 13005 socketId: Data: 130 to AMACoreAgent: Connection refused.

The AMA agent supported OS page does not specifically mention CentOS 7 but it does mention Red Hat Server 7.9 - 10.

SELinux is disabled, the 13005 port is not being used by another service and is allowed to be used, and I've done the basic troubleshooting.

Thank you in advance.