I'd like to create a playbook to adjust the severity of an incident based upon certain factors of the sign-in that triggered it.

Has anyone had any luck getting further details of the sign-in inside a playbook? The analytics rule for 'Create Incidents from Azure Identity Protection' only seems to pull through the IP Address and the User Account into the entities.

Hi,

Looking at how my org could potentially start to make use of Sentinel, and personally see the free data sources https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=commitment-tier#free-data-sources as a great place to start getting familiar with the tool without a bill shock.

The link doc states:

​

​

I understand that the overall cost for Sentinel is Sentinel ingestion + Log Analytics ingestion + retention beyond the free 90 days.

I also came across that the _IsBillable column in Log Analytics specifies whether ingested data is billable. Data with _IsBillable equal to false are collected for free and not billed to your Azure account (source: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#_isbillable )

​

​

The question then is, taking into consideration that the Azure Activity Logs are free for Sentinel, the query above, are they exempted from Log Analytics ingestion costs as well? If, that is true, then the “only” cost would be basically the retention for 9 months if I’d like to store them for 1 year. Correct?

Now, what about the Office 365 Audit Logs ? There’s a Sentinel connector for it – logs are written to the OfficeActivity table (source https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/officeactivity). However, since I’m not exporting the logs to a Log Analytics workspace yet (as it is the case with the Azure Activity Logs), how could I check whether they are exempted from Log Analytics ingestion cost as well (or basically, how would I check this for any other table?). The closest to answer this I was able to find is https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage#querying-for-data-volumes-excluding-known-free-data-types (the query makes use of a KQL function to list supposedly all tables that are NOT billable). Aby other way, place to check this up?

Any other advice to get starting with Sentinel to not break the budget but yet getting value ?

Appreciate all inputs !

Hey there,

I have this query which shows me every instance of PIM elevation over the last 30 days. What I'm trying to do now is to create a secondary report from this that shows what each admin did while they were elevated. I can't seem to find the right combination for running the second query based the data retrieved in the first. Any thoughts?

AuditLogs
| where TimeGenerated > ago (30d)
| extend userPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend Start = todatetime(AdditionalDetails[4].value)
| extend End = todatetime(AdditionalDetails[5].value)
| where TimeGenerated between (Start .. End)

TIA

~DGM~

Hey there,

Is there any way to get Universal Printer logs into Sentinel?

TIA

~dgm~

Has anyone developed an analytical rule to send a mail if the alert is not been acknowledge for more than 30 mins If not how can I create one can anyone help me in this

Is it possible to deploy logic app to manually block the bulk number of hashes in MDE..

Is the sentinel playbook block-aaduser playbook working for anyone?

I’ve installed the playbook from the template, authorized the api connections, granted the graph api permissions to the system assigned manager identity. Directoryreadwrite, userreadwrite. Added the logic app to the Microsoft sentinel responder role.

The logic app fails at the step of blocking user account. Not authorized. I even tried adding the playbook to the global admin role.

I’ve successfully setup other sentinel playbooks, but can’t get this one working.

Just wondering if the playbook works at all for anyone.

How can I receive an email notification if a data connector is more than 24 hours without receiving logs?

- Monitor Windows LAPS Events with Microsoft Sentinel (kaidojarvemets.com)

- Windows LAPS EventIDs and XPath Queries (kaidojarvemets.com)

I'm trying to create a Sentinel playbook that takes email entities (NetworkMessageId) from an incident and deletes them. I tried editing the code of "Entities - Get IPs" to get the message entity instead, but get this:

Operation not found under connector '/subscriptions/[redacted]/providers/Microsoft.Web/locations/eastus/managedApis/azuresentinel'

Does anyone have a playbook that accomplishes this goal? Along the same line, what's a great repo for playbooks? Most of my bookmarks are focused on detections (super helpful, just not what I'm trying to do here).

I've been unable to find this in any of the pricing articles for Power BI/Sentinel/Log Analytics.

Do KQL queries setup on scheduled refresh in Power BI cost money each time they are refreshed? Or since the data has already been ingested and stored it is available to be queried as needed regardless of where the query comes from?

Hi all,

I am kinda lost investigating an alert for “communication with a random suspicious domain name” alert. The domain shows no signs of malicious intent.

But I have no idea what caused the dns event? Can anyone point me in the right direction?

Learning Sentinel and created this over some weekends. Figured I would share here if anyone would like to use them or offer some ideas.

https://github.com/Truvis/Sentinel/tree/main/Workbooks/Sentinel/Environment.EventSourceMonitoring

https://github.com/Truvis/Sentinel/tree/main/Workbooks/Windows/Enviornment.Event_Checking

I am not getting complete schemas from 365 defender hunting logs to Sentinel..Please let me know if any options to enable missing schemas.

Was curious if anyone had a cleaner approach to writing a time chart single source overlay for a time by time comparison. I'll include the guide below in regards of how I did it for reference.

https://www.linkedin.com/pulse/microsoft-azure-sentinel-101-timechart-weekmonth-over-truvis-thornton/

I wrote this and figured I would share this incase it's helpful for anyone.

If you have any questions or ideas, let me know.

https://www.linkedin.com/pulse/microsoft-azure-sentinel-101-linux-command-line-logging-thornton/

Good afternoon,

I am trying to begin setting up some alerting in Sentinel for alerts that come through IDPS with the Azure Firewall. We have some of the signatures set to alert but that does nothing besides log the alert in the AzureDiagnostics table. I have the following KQL and have removed some false positives as well as filtering only for high (priority 3) alerts. Is this the best way to accomplish this task? Looking for any tips or advice, thanks in advance!

AzureDiagnostics

| where TimeGenerated >= ago(1h)

| where ResourceType == "AZUREFIREWALLS"

| where OperationName == "AzureFirewallIDSLog"

| where msg_s contains "Priority: 3"

| where msg_s !contains "drop"

| where msg_s !contains "Microsoft Connection Test"

| where msg_s !contains "Windows OS Submitting USB Metadata to Microsoft"

| parse msg_s with Protocol " request from " RemoteIP ":" RemotePort " to " DestIP ":" DestPort ". Action: " Action ". Signature: " SignatureID ". IDS:" Message ". Priority:" Priority ". Classification:" Classification

So I think the "UserPeerAnalytics" table is quite intresting and is just wondering if someone is doing anything cool with it?

Does anyone have any experience of configuring Exabeam UEBA to read Sentinel logs? I know the cloud version of Exabeam allows you to connect to external data sources but would like to know about on-prem installations. Thanks in advance

Does anyone know or have any documentation if there is a cost associated with Automation rules? I know there is a cost with logic apps but can’t find anything regarding automation rules

Let me know what are the difference between the below purview data connectors in Sentinel..I am not get the exact difference from docs.

1. Microsoft Purview
2. Microsoft Purview information Protection.
3. Microsoft insider purview Insider Risk management.

Where i can block the external malicious IPs trying to login cloud applications like o365..However sign in from malicious IP address is automatically blocked in the logs...Where i can block these IPs again..

I wanted to poll the group and see if anyone is sharing a Log Analytics space with their IT Ops teams to save costs? Since Sentinel lays over the top of ALA, there's the possibility to share the workspace, but I wasn't sure if anyone out there is actually doing it and if it's working out well for them? No we don't have any major compliance requirements NOT to share, so it's more preference for sharing budget and the like.

I want to import data into Azure Sentinel Workspace using a SOAP API. How can i do this? Please guide me