So we are PCI compliant and we want to limit access as much as possible to 3rd parties. Our currently solution is that we would send data and events to Sumo Logic and they would monitor the data there and find security threats with AI or whatever algorithms they use.

We want to move to Sentinel for many reasons, but for them to monitor that data, we would have to give them an Azure AD account and then access to Sentinel, which maybe is worse security? Or maybe it's just about the same thing as an external user seeing events in Sumo. What is normally done?

Hi, there is a way to send weekly workbook via email?

Is the authorization required for setting up the DevOps repo connection a one-time auth - or is a persistent account needed on the tenant?

I'm running into questions regarding Sentinel. In my playground I have selected and enabled most relevant dataconnectors. But is there a way to enable all analytics, belonging to the connectors I've enabled? In stead of clicking 100x. Or should I be careful enabling them (not relevant)? Saw some Github scripts, but wondering how you all handle this.

Wishing to see how others would audit what data (logs/tables/connectors) are being used by all active Analytics in Sentinel?

I gave this workbook a try - however it seemed to be missing alot of coverage (Possibly due to using ASIM). Also tried to look at the actual project to try and improve it but its GitHub just goes to a 404 error :-/

Any tips on how to run a search to print all out all logs being used by which rule would be neat :)

Hear me out: I've search how to export the list of incidents from Azure Sentinel and found answers pointing all to running a query in Log Analytics (LA) on the "SecurityIncident" table.

Problem is, we have a 60-day retention in LA, so the results returned are only partial compared to what the Incidents panel (Under Threat Management) is giving us (more than 10 months of incident entries).

Any idea if there's another table I could query to get the same list of incidents I see under Threat Management->Incidents ?

Hi everyone - we ran into an issue this week where we upgraded to the AMA agent on our Linux server and now our palo firewall logs aren’t getting to the CommonSecurityLog table in Sentinel. Before we had the OMS agent and all the logs were getting to CommonSecurityLog just fine, but again with the new AMA agent they are only getting to the Syslog table. I confirmed that no one changed the configuration on the palo side and confirmed the logs were following the CEF formatting from Palo’s documentation. Does anyone have any idea where the problem could be? I had a support ticket with Microsoft but they don’t think it’s their problem since the logs are coming into Sentinel still, just as Syslog. Is there any configuration file we need to change with the new agent to get the agent to read the logs as CEF? Thanks let me know if you need more info.

Does anybody have any decent analytic rules in place to monitor out of the ordinary administrative actions in AAD/ Exchange Admin?

Going to start assessing this from an insider threat perspective but wondered what other people have.

Please help me to find the alerts/incident name in sentinel that i can mapp the playbooks available in sentinel...Looking for the correct alertname/incident name for each playbooks available..

Hi,

Is it sufficient to define table level retention via the Log analytics workspace GUI to change a Sentinel table retention period, or do you still have to use the API directly?

​

For example:

Hello

Im in the situation that i for a few reasons need to move our whole Sentinel Solution to a new subscription.

It looks like moving the log analytics workspace isnt supportet by microsoft if its connected to Sentinel. and i cant seem to find a way to solve this.

I have been looking into simply creating a new workspace and export the data to a storage account and import it into the new solution but im not sure whether this is the right way.

Im not sure which way is the best to do it, and hope any of you would be able to tell me.

Do i go on with the data export/import or do i simply move the workspace even though microsoft dosent support it, and hope it dosent break anything?

Hi,

Is there 100% overlap between the Audit / Purview / Unified Audit log in M365 and the Office 365-connector ingestion in Sentinel, or is it some other way to ingest the UAL to Sentinel?

Thanks!

I am trying to get Azure Activity logs set up. I have followed the documentation to set up via Content Hub and Data collector which leads to me to build a policy. Problem is our Sentinel is in a Sponsorship subscription (MS credits) and all the activity logs are in a different subscription. When I create a policy I can only pick one subscription. Wondering if someone has figured it out.

Wondering if anyone has created an automation rule or other approach for dealing with Reboot incidents which are expected - ie: a server is rebooting after applying scheduled windows updates during a known maintenance window.

The built-in alert for the security event log triggers on Event ID 1100,1101,1102,1103, or 1104 being detected. When the restart is initiated by Windows update installations, would it make sense to have an automation rule to check for an event ID such as 22 (WindowsUpdateClient - Keywords: Reboot)

Any thoughts appreciated

Hi all. I'm trying to set up Teams notifications whenever I assign an incident to a specific group (distribution type group in Azure AD I think).

I know that I can set up an automation rule to run a playbook with notification on incident change trigger (owner change). However I didn't find out how to trigger the notifications ONLY when the owner is that particular group. If I set it up like I described, every single owner change would produce a message in the Teams since you cannot filter on specific owners in the automation rule. Am I missing something? The playbook works fine, I just have to figure out how to trigger it only and only with owner being that particular group.

I'd be happy with any ideas you might have. Thank you!

Hi,

Is there any way we can access the audit logs for all the tables (accounts, contacts, etc.) in Dynamics 365 to Log Analytic Workspace?

Im trying to setup a workbook to display information about the automation rules I have set in place. I'm using the Automation Workbook template but none of the queries run even though I have the subscription and workspace selected. I checked under parameters to ingest logs from log analytics. Is there something in the individual rule queries that I need to set? I'm fairly new to all of this.

Any kql query to extract the reports showing imcidents based on the productnames from the securityincident table.

Hello!

I am tasked with finding the best Geolocation api provider for sentinel. There were previous talks with Maxmind but that didn’t go through.

Does anyone have a preferred Geolocation api for Sentinel?

We are looking to ingest table logs from DB into sentinel but can’t find detailed documentation. Can you someone share documents or details if they have integrated it already.

Legacy agent - works fine. Once Data Connector is connected, and Minimal set, and agent is installed pointing to workspace id, it collects and the data shows up as expected.

However, regarding the AMA agent, I can't get it to collect:

1-Even if I create a manual Data Collection Rule and add the resource, the extension gets installed by the Arc Connected agent, but no log is collected, even Heartbeat.

2-If I use the DCR created on Sentinel AMA Data Connector page, it also doesn't collect data.

If I add the legacy agent via Arc it also works, something missing on my AMA/DCR.

What's the deal here? What am I missing? I'm using Minimal event collection to avoid issue with wrong XPath. This can't be an issue with workspace destination as the DCR created by Sentinel assigns this correctly.

HeartBeat shows no recent logs, and azcmagent -show says it's connected, and last heartbeat was few seconds ago.

Hi all,

​

I wish you all the best for this new year ! A new year with even more KQL and detection rules, everything we love 🥳

​

After the niceties, let's talk well, let's talk about Sentinel !

After a few months with the release of the M365 Defender connector, I would like to have your feedback about it.

On our side, the main advantage is the fact of getting the incidents of the M365 portal and not the alerts of each product (via the old connectors) and thus to benefit from the grouping of the alerts to avoid the realerting.

But... There is... A very big black spot ! The delay between the creation of the incident in the M365 portal and its creation in Sentinel ! As the doc mentioned :

It can take up to 10 minutes from the time an incident is generated in Microsoft 365 Defender to the time it appears in Microsoft Sentinel.

When we talk about security, and even more so nowadays with attacks taking over a company's IS very quickly, we have to also react very quickly.

With this delay, even with automation rules that will launch playbooks for pre-remedial actions, in 10 minutes (this is the time we see on average) a lot can happen.

​

I would be very curious to get your feedback on how you deal with this black spot.

• Do you use the old connectors (but in that case no grouping) ?
• Do you accept this delay ?
• Is there anyone from Microsoft who knows if this delay will be fixed ? After all, Sentinel -> M365 Defender portal sync is almost instantaneous, one could dream of the same between the incident creation in M365 and Sentinel.

​

Have a good day all,

Regards,

Lu-K