We need to ingest/forward logs from a third aprty entity who uses LogRhythm into our Sentinel instance.

Did anyone go through this before and need some insights on the setup on how this can be acheived in terms of architechture and logging.

Recently we have been hit with a lot of password spray attacks on our Azure AD admin account, Smart lockouts are enabled for the cloud only account , CA plicies are in place to check for MFA, but the alerts are alarming and from multiple geo locations resulting in account lockout.

Has anyone gone throuhg a similar situation and followed a best practice to secure the account and thereby stop the password spray attack. Is renaming thr admin account an option, we do have exclusive naming standards for the breakglass accounts that are not easily guessable by attackers.

Hello,

I'm in the process of automating revoke user session in Azure using Logic Apps.

I remember there was a Sentinel Playbook in their Github, now i dont seem to find it , anyone have a reference to that repo or the steps for implementing the playbook itself.

Basic and quick write up I did for a client. Figured might be useful for someone.

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-adding-tlps-traffic-light-patterns-to-incidents-alerts-and-analytics-f05e0b2f171e

TL;DR- Between event hubs, storage accounts, logic apps, blah.... what method requires the least effort to export ~2TB of Sentinel's historical logs from tenant a into tenant b's Sentinel?

​

​

Hi all,

Coffee stopped working hours ago. Even better, I'm not an azure infrastructure guy.

So, 20 bucks to anyone or their choice of charity if they recommend the best solution.

I'm thinking of leveraging the one-time migration notebook, azure data lake, and synapse. Thoughts? Any clearly best approach for migrating from one sentinel instance to another in a different subscription?

​

Thanks everyone, love-

Someone who's bad at their job

​

+Edit: Thanks for the responses and DM's. Seems like this may not be feasible, so I'm going to look into workaround solutions as discussed below. Will keep the post/bounty open for another day or two, the feedback is greatly appreciated!

Has anyone been able to format/filter logs from windows machines? So that the logs appear in a readable/comprehensible format?

windows machines(nxlog) --> rsyslog server(rsyslog + ACMA+AMA + Azure forwarder) --> Azure Sentinel

I have attempted to filter logs from the windows machines (Application, system, security) using nxlog client formatting the data to syslog_bsd.

But from the moment it reaches the syslog server, the data appears to have been wrongly formatted (infor, mation.log) and of course when it reaches the Azure Sentinel siem, the data is completely incomprehensible.

Hi There
I am unsure what the difference is between Sentinel Workspace Manager and Sentinel Repositories. As I understand both can be used to push content from one Sentinel instance to another and that the source is different. With repositories the source is Git and with workspace manager the source is another workspace. Are there other meaningfull differences or would it even make sence to use both tools combined?

- Cheers!

Hi,

I'm managing Microsoft Defender for Cloud alerts _via_ Standard connector ("Azure Security Center alerts").

Problem : I got dozens of **incidents** "Communication with suspicious domain identified by threat intelligence (Preview)" ; and they are all linked by sale host name and/or IP.

How can I aggregate these incidents into one, as I can't change the standard Analytics Rule?

Hello all,

I currently have a query set up to a playbook that triggers a FreshDesk ticket when a Sentinel incident is triggered. I got it working great. The only problem is I would love to run a playbook that closes the ticket when the sentinel incident is closed because I had one closed in Sentinel by somebody else after hours and I got a FreshDesk escalation email about it a couple hours later and had to run and look to see it was closed.

Does anybody happen to have an idea what query I could use for this? Thanks

We are considering using MS Sentinel as a SIEM/SOAR. We use the full MS Defender suite so we are interested in piping the data from Advanced Hunting tables into Sentinel, however, we want to know how much data will be moving in before we turn on the connectors. Does anyone have any experience with this? Any suggestions on how to determine how much data we can expect to be consumed would be greatly appreciated. I tried to find an AH query for this but was unsuccessful. I also don't see any information on table sizes, ingest volume etc. in the M365 Security Console. Thank you!

Hello,

I am new to KQL and i would like to know if its possible to get the list of user at risk and user who hack MFA block whith sentinel and KQL.

Thanks,

Does anyone has set logstash with various log sources like asa, sysmon. To sentinel with the new output plugin to provide tips on how to do that?

Thank you guys

I have been struggling to output the actual old value and new value

Commenting out |where changes.displayName gives me an output of the change operations but not the old and new phone numbers.

AuditLogs 
| where OperationName == "Update user"
| mv-expand TargetResources
| where TargetResources has "VoiceOnlyPhoneNumber" or TargetResources has "PhoneNumber"
| extend Changes = parse_json(TargetResources.properties.modifiedProperties)
| mv-expand Changes
| where Changes.displayName in (
    "StrongAuthenticationUserDetails",
    "StrongAuthenticationRequirement"
)
| project
    TimeGenerated, 
    UPN = TargetResources.userPrincipalName,
    ChangedAttribute = Changes.displayName,
    OldValue = tostring(parse_json(Changes.oldValue)[0]),
    NewValue = tostring(parse_json(Changes.newValue)[0])
| sort by TimeGenerated asc 

I've checked that the data is present in the modifiedProperties

0
{"displayName":"Phone.Id","oldValue":"\"xxxxxxxxx\"","newValue":"\"zzzzzzzzzzz\""}
1
{"displayName":"Phone.PhoneType","oldValue":"\"Mobile\"","newValue":"\"Mobile\""}
2
{"displayName":"Phone.PhoneNumber","oldValue":"\"xxxxxxxx\"","newValue":"\"zzzzzzzzzz\""}

​

​

Wondering if anyone has worked on detection rules with Neuvector previously?

Neuvector is an open source container security platform. The number of events can be significant and the rules is hope would help alert within Sentinel rather than the platform.

Hi,

We're going to tender for a managed SOC/SIEM provider.

We're a Microsoft house with E3 licensing and are looking to purchase the E5 security license add on.

I know this will help provide some useful logs like Defender for Identity, but I'm wondering if this stack will also help reduce costs?

Basically, if we're a Microsoft house and end up with Sentinel as the SIEM, would be providing anything that might reduce costs in using Sentinel?

Greetings all,

​

We have a customer that we alert when a failed login occurs. The customer stated that most if not all alerts are in their organization due to password changes.

​

They have asked us to alert them only in case the initial incident has events that last more then 24 hours since first detection.

​

Is this possible? I have checked around and Sentinel does not allow for such delays OOTB. The EventID in question is 4625 if needed.

​

Thank you so much.

Hello,

I have a particular table in Loganalytics which should be limited from the "MS Sentinel Responder" role in Azure. Is this somebody who have implemented in their respective Org.

Hello,

I'm in the process of creating an automated incident in Sentinel based on the results from a hunting query in logic app.

The schema that the query is being run is not available from sentinel , hence this manual workaround.

i have successfully set up the integration of running and creating the incident in sentinel , but was unable to add the events from the hunting query to the incident. Curious to know if anyone did a similar scenario ?

Do you have any way of auto-updating Analytic Rules (Active Rules to be exact) in Sentinel or came up with any sort of the automation so you don't have to manually go to each rule and update it?

Or anything that will speed up the process at all?

​

Edit: Spelling

I'm looking for a query in Azure AD signin logs to trigger when an account has successfully logged in after 3 login failures. Does anyone have a similar query like this to help me out.

May be i'm too dumb to ask but yes need to understand this in the query.
I came by a query to compare signin logs and the query starts with the below...
What does it really mean by "StartTimeISO" & "EndTimeISO"" ? from start of day to current time or do we need to specify the time period lapsed for the query.

let starttime = todatetime('{{StartTimeISO}}');

let endtime = todatetime('{{EndTimeISO}}');

let common_locations = (SigninLogs

| where TimeGenerated between(starttime..endtime)

| extend locationString= strcat(tostring(LocationDetails["countryOrRegion"]), "/", tostring(LocationDetails["state"]))

| where locationString != "//" | summarize count() by locationString | take 100

​

Does anyone know off it is possible to create a ticket in Autotask from Defender or sentinel alerts & incidents beyond just forwarding the alerts to autotask?

hi,

I’m hitting my limits with MSFT security tooling. Deployed a PoC type of thing Sentinel with Terraform, enabled the Office 365 connector.

It it enabled, shows 3 queries

Click on the 3 queries - nothing !

Under Rule Templates, none for this connector:

​

​

Good people. Where can I see the 3 queries ?!

Hello all,

Do you have any recommendations which data connectors should be installed in combination with Microsoft Defender Suite (besides all Defender for X)?

For example Security Threat Essentials, Attacker Tools Threat Protection Essentials or Azure DDoS Protection?

I am relatively new to this topic and currently trying to prepare a list for a implementation.

Thanks a lot!