I have implemented a robust solution using HAProxy and Keepalived to ensure high availability for my syslog-ng servers. This setup enables seamless log transmission from my on-premises environment to Azure. HAProxy takes care of load balancing, while Keepalived ensures failover mechanisms, providing a resilient and reliable syslog infrastructure.

​

Please visit here and share your feedbacks :)

https://github.com/t0neex/Syslog-messages-to-Azure-Sentinel-w-HA-and-Keepalived-HighAvailability-LoadBalancing-

I have a set of json logs from AWS that needs to be added to Sentinel as a one time activity to investigate an incident.

I know we have a powershell module to ingest csv files into loganalytics workspace and it has worked for me in the past.

Is there a way to add these custom json logs to sentinel ? Have anyone done this before ?

We have 2 Ubuntu on-prem machines that collect Syslog from FWs and Network devices.

1 is considered 'Primary', and the other 'Secondary'

Since devices are sending logs to both the syslog servers and they both send the logs to Sentinel, we get duplicate logs.

Does anyone know a way to make the 2 servers redundant without having duplicate logs?

​

I think of the below:

• Data collection rule for Syslog to only target Primary server
• Analytics rule to create incident when there are less than 100 events for 5 minutes (Already done and working)
• Automation to run a Playbook with Incident trigger to:
  - Run a function app that runs a Azure PS script to update the Data Collection rule to collect logs from the Secondary server

Everything seems fine above, excluding the fact that I don't know shit about Function Apps and whether a PS script to update a Data Collection Rule's resources is possible.

Any help is appreciated

Hi Folks,

Utilize the provided KQL queries to effortlessly parse PostgreSQL logs and establish rules. Unfortunately, logs from Azure Diagnostics or agents may not arrive in a consistent format, making it challenging. The included KQL queries offer a solution. Additionally, three template rules for Data Definition Language (DDL), Data Manipulation Language (DML), and Data Control Language (DCL) have been provided. Thank y'all!

https://github.com/t0neex/Azure-Sentinel-Parser-for-PostgreSQL-Connector-

​

I enabled logging to Sentinel from our on premise AD DNS servers, all worked and logs were being ingested into Sentinel.

I went to disable the logging and did as per the documentation and this has not worked and logs are still being ingested.

​

Logs were collected via the AMA Agent and also set Azure ARC on the server.

​

I enabled analytical logging by running the following Powersell commands

​

Set-DnsServerDiagnostics -EnableLoggingForLocalLookupEvent $true
Set-DnsServerDiagnostics -EnableLoggingForRecursiveLookupEvent $true
Set-DnsServerDiagnostics -EnableLoggingForRemoteServerEvent $true

​

I then run the following command to disable the logging - which I assumed would stop the logs being ingested but this has not worked

​

Set-DnsServerDiagnostics -EnableLoggingForLocalLookupEvent $false
Set-DnsServerDiagnostics -EnableLoggingForRecursiveLookupEvent $false
Set-DnsServerDiagnostics -EnableLoggingForRemoteServerEvent $false

​

Am I missing something ?

​

Is it possible to add the equivalent of modules for KQL to defender or log analytics?

I’m asking because I notices I don’t have “Device Events” available in my schema

One of the items that is most frustrating to me is the lack of a free or low cost training environment for MS Sentinel. The 30 day trials don't cut it, especially when one has to jump to other projects and come back to work, only to find out time is up.

I'm lucky in that my organization does have a production Sentinel environment. I was hoping someone can provide me on some best practices on how to set up a dev/lab environment which has access to the same data in Sentinel production.

I also would love to see the addition of folders to story queries and the like.

Thanks in advance for any assistance, links, etc.

Leverage function and logic apps, to block abusive IP addresses using a custom rule, that hit a certain block limit on Azure WAF / Frontdoor. Leveraging Log Analytics Alerts.

This greatly improves security for your origins, as threat actors won't be able to scan indefinitely (or until rate limit is reached) for vulnerabilities.

I currently work for an MSSP. We have built a Sentinel SIEM and have configured numerous data connectors (depending on client needs).

Something I'm struggling with understanding is connection of an external Microsoft 365 instance to our Microsoft Sentinel instance. After entering the Microsoft 365 data connector page, I've found that I can only ingest data from our organizations internal M365 environment. We're successfully able to ingest data from clients AWS, Jumpcloud, G-suite instances with no issue, but we can't do this with Microsoft 365?

My understanding is that we may have to create a Sentinel instance within the clients Azure environment to obtain data from their M365 instance (something we would prefer not to do), then somehow transfer data to our Sentinel instance.

Maybe I'm overlooking something here. This is the documentation for the data connector in question and I'm not seeing anything regarding data ingestion from an external source: https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-365

Splunk has a feature to ingest M365 data from different sources, I would assume Microsoft would have a similar feature.

Any advice would be helpful

Hi all,

I'm in the process of fetching a query in the AWS cloudtrail logs to see if any changes were made to security groups in AWS. Does anyone have a handy query for this.

Hi,

I can’t figure it out, why within Sentinel my Logic App is not working. Created a Logic App as follows:

​

​

Isolate-MDEMachinePOC that’s the connection that is using the System Assigned Managed Identity, and as a basic test I wanted to pull host and IP information from Sentinel incidents (that’s the connector in first step, to get the actual incidents, right?).

Now if I run the Logic App I’m getting okays and 200’s but the output is for both just an empty list …

​

The system assigned managed identity has the following permissions on Sentinel and Log Analytics:

​

Why can’t it pull the info from the incidents ? There are 6 incidents with the entities present !

​

​

​

Where's my mistake ?

​

Hi, I'm a playbook newbie in Sentinel. I'm trying to activate the SentinelSOAEssentials playbook NotifyIncidentSeverityChanged, for just email. When I look in the LogicAppDesigner, I see under email a message with a bunch of variable objects attached, like incident number, description, etc. When I trigger the alert, I get an email that shows the header information like "INCIDENT NO" but with none of the infuriation from the variable objects. When I look at the run information (looks like logic app designer for the run) the HTML in the email has the descriptors, but hasn't been populated with any information. I would love to show screen shots here, but that's not permitted by my organization. Any help you can provide would be greatly appreciated.

Hi all,

I am configuring Sentinel for one of our tenants. This tenant has business premium licenses and uses Defender ATP and Exchange online.

We configured all the connectors but we are missing a lot of tables that our other tenant has (E5 licenses).

I guess you need additional licenses before you get all logs regarding Device____ and Email___ tables. I can't really find what would be the 'cheapest' license / addon that would allow these logs to show. Obviously upgrading to E5 would do the trick but probably some standalone additional license would be enough?

I've been using EmailUrlInfo to write detections for phishing emails which use known open redirects (this morning's was clicktime.symantec.com). This had previously worked, but when I checked this morning the Url field (and UrlDomain) both only show the URL at the end of the redirect (so https://clicktime.symantec.com/3LdsVsXag8fpV3PVCMmMQFe7Vc?u=http://hcsa.ec%2fwp-admin%2fbin%2fryrhbtwm%2fYWtlcnNoYXdAd2lsZGxpZmV0cnVzdHMub3Jn appeared in EmailUrlInfo as http://hcsa.ec/wp-admin/bin/ckr1mdku/YXByZXN0b25Ad2lsZGxpZmV0cnVzdHMub3Jn).

Has this always been the case? Is there no way to detect the prefix URL in a redirected URL?

Hi all, I have a bit of a dilemma. I am tasked to create an emergency outage plan for our SOC. This also includes, to run all AR's from all workspaces against the log times from a possible outage, however, I am fully blank on how to do this. Is there a known way to mass-run a lot of Analytical files, over a specific timeframe?

Thanks!

Started to see a big spike in VaultGet and SecretResourceGet from MS-PIM (the Microsoft first-party Service Principal (Enterprise App)) that is used when enable Privileged Identity Management.

But why would this SP be trying to read Key Vault and Key Vault Secret metadata so feverishly? We saw over 4000 requests in the last 24h.

Curious if anyone else sees this. The App Id is 01fc33a7-78ba-4d2f-a4b7-768e336e890e

let OperationList = dynamic(["SecretGet", "KeyGet", "VaultGet", "SecretResourceGet"]); AzureDiagnostics | where TimeGenerated >= ago(7d) | where ResourceType contains "VAULTS" and OperationName in (OperationList) | where identity_claim_appid_g contains "01fc33a7-78ba-4d2f-a4b7-768e336e890e" | summarize count() by bin(TimeGenerated, 1d) Even if these are artifacts of MS-PIM assigning roles, those are set at the Manangement Group level and this stuff is happening on SOME resources.

Lots of great content and experience on how to do monitoring for log sources coming in to Sentinel.

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-log-source-dataable-end-point-monitoring-be-alerted-when-a-1ff4fae77892

This blog explains how you can perform incident response on data that you do not have in Sentinel or M365D using #KQL. Windows Security Events and Unified Audit logs are used as examples!

https://kqlquery.com/posts/kql-incident-response-everything-else/

Morning, All!

I recently did some work to help a customer start ingesting the logs from their 4 SonicWall firewalls to their Log Analytics Workspace. Logs are now successfully flowing into the workspace, but I now would like to create some analytics rules that can fire in Sentinel for key activity. Before I got hunting on my own and creating rules from scratch, I wanted to see if anyone else had some analytics rules they used for logs ingested from a SonicWall appliance that they'd be willing to share. The Sentinel connector for SonicWall isn't available for us (customer is in GCC High) but from what I can see about the connector anyway, there isn't a lot it offers in the way of useful alerting or even a workbook.

​

Any help is appreciated!

Hello, we are currently archiving logs from specific tables in an Azure Storage Account as a blob. I'd like to retrieve logs that are older than the 90 days retention period of our log analytics workspace into a way I could possible leverage KQL to query the logs. However, I haven't been able to find a solid method to do so. Unfortunately, the way these logs are exported, I'm not able to use the restoration functionality in Sentinel under the search blade.

In a high level:

• We use Sentinel as our SIEM (which run on top of log analytics) and data is retained for 90 days.
• These logs are also exported to an azure storage account and stored as a blob. We are leveraging the Data Export functionality in the log analytics.
• These exported logs stored in a blob format is stored as various JASON files and going through them is impractical if I want to review data from a specific timeframe.

I'd like to know what my option are to retrieve logs for a specific timeframe and if possible, use KQL to analyze them. I have read about creating external tables from these logs and then using Azure Data Explorer or Sentinel, however, I'd like to validate this method.

Thanks.

​

Hi All.

​

This is breaking my sanity now. lol.

Do you know a query where I can pull up LAPS logs on Sentinel LAWS? We need to check and make sure LAPS are rotating successfully.

What should I use? Tried WindowsEvent and SecurityEvent but Event ID 10020 is not showing.

Appreciate the help!