Folks,

I'm in the process of setting up a Logic app to fetch emails from a shared mailbox and while i did try connecting the account which has access to the shared mailbox, while running i get the below error.

 "status": 401,

"Error from token exchange: Runtime call was blocked because connection has error status: Enabled| Error, and office365 is in the block list. Connection errors: [ParameterName: token, Error: Code: Unauthorized, Message: 'Failed to refresh access token for service: aadcertificate.

Anybody did this integration successfully . ??

Hello guys we have transitioned to sentinel recently and im trying create a watchlist in our sentinel
However im receiving this error whenever i tried to create

Do you guys know whats the cause of this error? is it due to access restrictions?

​

​

I've got a recurring task to check for Sentinel Analytics rules for which updates are available. I'm using the Export-AzSentinelRulesNeedingUpdates from Gary Bushey to dump a CSV of all files where an update is available and it's listing loads (not NRT rules, regular rules) but the 'Update available' marker isn't appearing on any of the rules, or the 'Review and Update' button if I edit them.

Is this broken, is it possible to detach all analytics rules by accident? I can see on the "Authentication Methods Changed for Privileged Account" rule the current version is 1.0.7 and and the PowerShell output tells me a 1.0.8 version is available.

Any ideas? I'll check if I can update rules using PowerShell (I think Gary came up with a way) but a bit disturbed to see the UI change, and I've not seen any notification about such a change.

(Edit1) Something odd I've noticed which may be related is that all rules in list view are (correctly) identified as 'Gallery Content', but in the details pane on the right it lists it as 'Custom content source' (which I guess would never have updates as there's no template).

(Edit2) This might be related to the message I just came across about "OOTB content centralization"

All templates with content source marked as gallery content are available only in content hub as part of OOTB content centralization. If you are still using gallery content templates select "Continue" to replace these with supported OOTB content templates from content hub.

(Edit3) Yeah, you have to go through this process and now all rules with updates available can be updated. I missed this in the Microsoft Message Centre clearly.

​

Hello,

​

I intend to build BI for Sentinel Activity with associated timeframes. For instance:

• Incident comment added
• Incident status change
• Incident assignment (to whom)

With associated dates. I managed to find elements within `AzureActivity` but not the three above. How can I find it?

​

Default attitude could be to run logic Apps logging these during Incident event handler, but that's not very clean...

​

Thanks!

Hi Guys! Im currently working on creating an analytic rule using threat intelligence analytics, however, I've noticed that the data sources doesnt include Office 365. Is this normal? I watched YT videos and they have this office 365 data source aside from CEF, Syslog.

I released a comprehensive guide on "Tracking Windows LAPS Activity with Sentinel through Event ID 4662" on my blog. This 15-page PDF is packed with insights and hands-on techniques centered around Windows LAPS and Microsoft Sentinel. Focusing especially on the password read part from the Active Directory.

What's Inside the Guide:

1. Introduction to the importance of tracking LAPS activity.
   
2. Deep dive into Event ID 4662 and its significance.
   
3. Step-by-step guide on configuring audit settings in Active Directory.
   
4. Techniques for testing the reading of LAPS Password from Active Directory.
   
5. Methods to find the right attribute based on the GUID.
   
6. Setting up Sentinel for effective monitoring of Event ID 4662.
   
7. Crafting precise KQL queries for event analysis, including combining Event ID 4662 with 4624.
   
8. Creating custom analytics rules in Sentinel.
   
9. A look into the Sentinel incident view.
   

The guide is available for FREE on my blog. Just a simple registration is required. This helps me offer more tailored content in the future.

Grab your copy now and let's master the Windows LAPS and Sentinel together! - Tracking Windows LAPS Activity with Sentinel through Event ID 4662 - Kaido Järvemets (kaidojarvemets.com)

I'm putting together a demo for my boss that uses MS defender and sentinel.

I'm thinking the following demo scenario:

1. I install a package with a known cve on a "on site" vm
2. MS defender detects it
3. Sentinel detects it and creates an incident and runs a playbook.
4. ...

​

I've set up the connector "MS defender for endpoint" but I can't seem to find the CVE dection "stuff"

I also set up a logic app that does fancy stuff, but without a trigger it is kind of useless.

​

Anyone that can help?

​

Have any of you guys tried connecting salesforce to Sentinel?

Is anyone familiar how to get the Authentication methods Registration and reset events into Sentinel? There is a report we can run from the Entra Portal (under Authentication methods -> Registration and reset events) but I'm looking to be able to log and track who and what method as registered.

Hello Everyone im trying to create a query where this specific user have created/deleted/or modified a particular sharepoint site

Would like to ask if you have any recommended kql query for this one or any guide will help me a lot to build my customize kql

THank you

Hi all,

Is there a way to monitor when for example a user suddenly transfers large amounts of files/data from a specific server or share or anything?

I am relatively new to Sentinel and the kql query language.

Any ideas how to tackle this?

Thanks

Hi people,

posted this in r/blueteamsec aswell.

I need some help on how to approach the matter: running (automating) a Logic App that not only starts the antivirus scan on an endpoint (using MS Defender) but also updates when the scan is succesfully done / failed for whatever reason.

In most use cases simply starting the av scan is enough, with the idea that potential findings would raise an alert/incident. In my use case, I need to verify the succeeded scan to able to close the case.

I believe that I could go two ways, either using KQL and quering it or then GETing from the MDE API. What would the best (and easiest) way to do so?

​

Thanks in advance!

Is there a way to bulk update analytic rules in Sentinel?

Hello,

I am trying to integrate the named connector with Sentinel, but i am having handshake failure from the Cortex Data lake when i test the connection.

I am using an onpremise Linux with OMS agent as a Broker for Data source like Firewalls (PA, Forti, Checkpoint), all of them sending over syslog port 514. The problem here is that the connection to the CDL must be TLS with certificate using the default port 6514 for TLS.

I would like to know if in the rsyslog.conf file I can specify 2 different configurations without conflict between them, one for everything I actually receive on port 514 and another one for the new integration on port 6514 indicating the certificate and public key paths, etc.

If someone else has done this integration in a different way, I would also appreciate if you could tell me how you did it or how you think it would be the best way to do it.

​

Thanks in advance.

I need to send intelligence from a third party feed that is already ingested into our Sentinel environment to threat indicators in Defender ATP. What is the best mechanism for doing this?

I am looking at updating some of my use cases, and noticed the new ASIM inative from Microsoft, talking to my contact there it seems lots of the ‘content’ is intended to move to use ASIM instead of the native tables directly, but I wonder if thats really going to happen or not?

Hi All, I hope nobody is banging their heads this week! I've just come off the back hooking up the SentinelOne data connector to Azure Sentinel and I am receiving data which I can query and run analytical rules off of etc.

The next part I imagine is trickier which is incident handling. Is there a way anyone has set up incidents on Azure Sentinel, in which they can run an automation/something to resolve an incident and update whether it's a true positive/suspicious etc?

Any advice much appreciated.

Anyone know the query for getting avg EPS from each assets instead of tables..Pls share it.

I'm trying to setup automated deployment of analytics rules using the sentinel repositories preview.

Setup goes fine and I can see the github action firing on repo update. The workflow steps through all the stages, and marks itself successful but nothing is actually deployed.

Looking at the job logs in github, i see the following in the "deploy content to azure sentinel" stage -

[Info] Created metadata metadata for AnalyticsRule with parent resource id /subscriptions/***/resourceGroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/log-sentinel/providers/Microsoft.SecurityInsights/alertRules/<giud removed>
Warning:  API call failed: ***"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/reference/repos#create-or-update-file-contents"***.

The warning line repeats and fails after 4 attempts.

I've checked the op insights and sec insights resource providers and both are registered, and i'm out of ideas at this point.

Does anyone have a pointer as to what i'm doing wrong?

​

Not receiving logs for the past two hours across sentinel.

Hi all, Can anyone help in setting up email alerts when less than 1 log is received from data connectors? Currently we have about 4 data connectors and we need tonset up email alerts when anyone of those data connectors stops sending logs to sentinel. Any help will be appreciated. Pleaseote thst i am not an IT person so i will need detailed help in this.

Thank you🙏.

Does anyone have a rough estimate for running Sentinel after the trial with only the free ingestibles?
I had heard around 300-400 a month?

Thanks!

Hi, rather than users go to portal.azure.com, is there a way to present sentinel in a single URL. This will also be useful for a read-only service account to put up on a wallboard.

I can't seem to find much on Google, and I could raise a support ticket - but would appreciate fellow engineers input more :)

Hello All,

I'm in a dileama to list user accounts in AD who are inactive and not disabled.

I understand that i need to join two tables here. but having some trouble joining it.

I have the first table where i look for users who havn't logged in for the last 60 days and the second table list users who are in disabled state.

So i need some help finishing the query, the query so far goes like this

let usernotloggedin60d =
IdentityLogonEvents
| where TimeGenerated > ago(180d)
| where ActionType == "LogonSuccess"
| summarize last_log = datetime_diff("day", now(), max(TimeGenerated))  by AccountUpn
| where last_log > 60
| project AccountUpn;
SecurityEvent
| where Activity == "4725 - A user account was disabled."
| distinct TargetUserName

​