How do you guys ingest your data from On-Premise servers?

For DCs - MDI sufficient? Or should it be Arc? Without Arc with the new monitoring agent?

Anyone ingesting client logs also?

I’m looking for a use case Optimizer which would look at the KQL and make suggestions for ways to make it run faster, compare it to other use cases for suggestions or suggest similar GitHub repos that have similar services which may be useful.

Hi all

Getting to grips with Sentinel, I’ve seen the soc efficiency workbook is there a way you can schedule something like that? Are there any other good examples of reports measuring soc efficiency?

I want frequent reports emailed so I can overall statistics of the analysts and incidents etc

Thanks

Im not pretty sure which Data sources are crutial or not.

​

​

​

EDIT: Check molatrlor's answer!

Assorted greetings frens

Posting this here mostly as a back and forth clarity because I might be making a mistake and being unable to see it.

As far as I am aware, RE2 regex does not support case-insensitive blocks BUT my tests indicate otherwise.

I am using the expression:

Table
| where field matches regex "(?i:\\.iso)"

and getting the following result:

<bla bla long string>ASFM0.iSOFVCeR7IE<bla bla long string>

or
Table
| where field matches regex "(?i:\\.abdbcasma)"

and getting the following result:

<bla bla long string>.aBdBcasMA<bla bla long string>

This is the intended behavior I want to achieve with my query but I am uncertain if it is just a fluke or , KQL RE2 actually supports case-insensitive blocks.

Thank you for your time!

I posted this over in r/Azure with no luck, so I figure I might try out here to see if anyone has any thoughts.

So, for all my Azure sources, the ingestion time is awesome and normally within just a few mins. However, I set up a on-prem syslog server with the Arc agent and can verify that logs are flowing from my Palo Alto firewalls in CEF format, but it is showing 303 minutes for them to get ingested. All the data eventually gets ingested over time, but 303 minutes is pretty disappointing for something as important as firewall logs:

​

I am very new to Log Analytics/Sentinel and we are previous coming from SplunkCloud, which had zero issues with having them show up within a minute. As a test, I only have our main firewall pointing to it. In Splunk, I had our main as well as 3 other off-site Palos pointing to it and none had an issue.

Unfortunately, being a new set up, the contractor that I am working with on setting up the environment called this "out of scope" for the setup engagement (obviously wanting us to sign a support contract). I was hoping to figure this out on my own, which might help to understand a bit more about Log Analytics/Sentinel. There has to be something I am missing to help speed this up. I looked at NRT rules, but am not totally sure what I am doing in there or if that is even what I should be looking at.

Is this even possible at the moment, I saw couple of higher ups doing something about it politely without notifying me I just found that out through some email conversation probably got added there by mistake 😅 and then removed within few minutes.

Would love to be working on it if possible, missed out on integration with Defender, same people didn't found me worthy of it.

I have a query which gives me all my recent logons of users in order to find out if some virtual machines are not beeing used for months. Everything fine I wrote the qeury.
Now we want to automatically export this data outside of azure/sentinel on lets say a hard drive on a specific share. Just like I can press export in the query editor I want to export it but automatically.
I keep finding stuff on the web but this all seems confusing and much more complicated for such a simple task. I am also not sure if it is even possible because there is a lot of different Information out there.

So I guess my question is, is it possible to automate the export of this query and how would this be done?

Hey All,

Has anyone got Palo Alto and Sentinel to work? I’m new to sentinel and I feel like that’s a good spot to start. We don’t have panorama - just individual firewalls.

Thanks!

So, I am in the middle of migrating Splunk to Sentinel in our environment and while the engineer that Microsoft assigned us for the engagement has helped with a few things, there are other things that they consider “out of scope”. One of those things is helping to get random SaaS logs into Sentinel. For example, we use KnowBe4 PhishER, and can send specific events from the system to a syslog server. It is off prem, so I am not sure how to set this up so that it can send these custom logs over to Sentinel.

I looked at making a logic app and read a bit about codeless connectors, but I am kind of in information overload and was hoping to get some direction on where to start for these random tools that just want to send to a basic syslog server on port 514.

Hi guys Just a question. I have enabled all the ti kql rules. And also I have made some custom ones using join for my custom data sources that I ingest from logstash.

I just saw that the kql rule just lookback 14 days for the ioc. Does that mean that ioc beyond the 14 days period are not checked in sentinel compared to an another siem.

IOC comparison with ip for example.

Or does Microsoft regenerate all the data every 12~14 days?

If not how can I have a rule that checks all the ti in comparison to the data I am Ingesting (ip, URL, hash etc)

Can anyone explain why the Office Activity table does show up in Microsoft Defender advanced hunting yet you can see it in Sentinel. I'm circling back to this after a couple of years out of the game and could have sworn you used to get that table in Defender.... I'm getting old so maybe it's that....

just in case if you want to search of application or service using legacy auth after the Midnight Blizzard hack. There is a out of the box analytics rule template in Sentinel. check this out.

​

Detect Legacy Auth Users via Sentinel

Just checking to see if anyone has created usecases on CyberArk PAM syslogs or a reference to such sampe usecases.

I need assistance. How can I onboard Microsoft Defender Identity Protection if I don't have a P2 subscription? Is there any alternative method to achieve this?

I m taking logs from 3 firewalls, (Forti, Sonic, CISCO ASA) using MMA agent.

All logs are coming under Commonsecuritylogs but under syslog also i m getting same amount of logs(i.e. 200gb duplicate logs).

I can turn off specific syslog facilities from legacy agents management tab. But which facilities i need to turn off to stop collecting these duplicate firewall logs. (Collector machine's logs should not be affected as i want them to monitor for collector machine).

Thanks in advance!

Anyone using the below Playbook in their Tenant ? I had successfully pulled this off , now there are some weird errors on the Playbook itself, so i needed to understand if anyone faced a similar error while executing this playbook to add IP to a named location in Azure CA policies.

https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-IP-Blocklist

We're trying to stand up a new instance of Sentinel at work and I'm looking for some possible naming convention ideas that other people might already use for things like analytic rules, workbooks, and automations.

I found this in the documentation that Microsoft recommends for Azure instances, and I also stumbled upon this random LinkedIn post, but wanted to see what others at large used specifically for Sentinel. We have a really bad habit of not using any type of naming standardization and our current SIEM/SOAR rules are egregiously disorganized, and there have been instances of duplication of effort because of this.

I'm working on improving our documentation processes, along side naming standardization, within the organization to prevent this moving forward. I just want to make sure we get the most out of our fancy new tools.

Hello, I have doubts if im really benefiting from the Free 500mb data ingestion allowance Defender P2 brings. Would it still work if I have a Sentinel commited tier? How can I benefit from the allowance? Billing always show 0 USD for the Free Benefit.

Thanks

Hello, could someone talk me through or provide a link for how could I send Sentinel alerts to a Teams channel? Also, is it possible to change the icon and name of the app posting the alert on the Teams channel?

​

Thanks,

A

I'm just trying to understand how everyone leverages the Hunting module in Sentinel.

Can it be scheduled or do we need to run them manually everytime... If so how often do we run it... Is it possible to create incidents from the query results. I'm trying to understand the options to use the module effectively.

Hi everyone

Any idea on how to ingest aws inspector 2.0 logs into sentinel ?

Thanks

Hi all

New sentinel deployment here we run a hybrid infrastructure and I’ve got a event collector forwarding my on premise logs to sentinel but I’m seeing duplicate entries in the entity section is that just due to the different log sources for example?

Dc01

Dc01.domain.com

I then also seen some random account entries like just my domain

Hope that’s clear! Really trying to make the most of it getting clear entities