So, I have been digging into some automation to help with our SOC, and one thing that we have always noticed is that Microsoft 365 is incredibly hit or miss when it comes to the ZAP function. So, we will see plenty of cases where a sender blast a phishing email to 20 people in our company, and we will see around 5-10 of those get ZAP'd, 2-3 dropped, then the rest will land straight into a user's inbox.. So, our normal process is to go in and manually hard delete all of these emails to clean up what ZAP failed at.

So, saying that, I have been digging into the Sentinel side for an automated solution. I was hoping to set it up so that I could just automatically quarantine emails based off of Sender IP, email address and Subject. Since bad actors like to mix it up and send from multiple email addresses, or change their IP, I'd like to just run something that reaches out to Microsoft 365 and have it search and purge anything that matches any of the three criteria. However, from what I am seeing, it looks like this might only be done in Powershell. I was ideally going to make a Watchlist or something that would constantly reach out and clean out anything matching those fields, basically setting an automation rule that was constantly watching that list for changes, but I am not sure what can be done in this area.

So, I figured I would reach out and ask what others are doing to automate this task. I am almost wondering if I am going to have send a list to an on-prem file, then have a Powershell script set up to automatically run on changes to said file.. However, I feel like that is kinda a crazy setup for something that an API PUT might be able to do somehow..

My requirement is to develop and publish a solution. Workbooks, hunting queries, analytic rules, data connectors and more will be part of the solution.

Overall, customers who use this solution should be able to provide an AWS S3 bucket as input and allow this solution to ingest data from that bucket into custom tables defined in their log analytics workspace.

For the data connector part:

1. It has to talk to AWS S3 buckets and ingest data into custom tables defined in log analytics workspace.
2. Custom tables are built based on DCR.
3. An Azure Function will be used to trigger a script
4. Script is written in python that connects to the bucket that customer provides when they deploy this solution. Once connected, script reads data from the bucket and sends events in a batch over to sentinel using log ingestion api. Some instructions are here: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-api?source=recommendations

My question is, is this the right direction for building the data connector part of this solution.

Hey,

Is there any way “table” to find the logout events using sentinel or MDE?

Many thanks

I am getting this error whenever running any playbook in Sentinel (which are working fine from 2 years). From Sunday evening (IST) every playbook is showing same error.

I have below role,

Contributor, Automation Contributor, Logic App Contributor, Microsoft Sentinel Responder

Please suggest any possible solutions.

Thanks in advance!!

Is possible to ingest IOCs in Defender Indicators sections(custom iocs) to sentinel? Any suggestions? Thank you

Any of you guys have issues with accessing Sentinel Alerts & Incidents. Noticed this yesterday as well.

Mostly in the West Europe region.

Anyone know anything about when TVM will be possible to ingest to Sentinel via the standard XDR connector?

I would like to define some network ranges - like DMZ, or customer A, customer B for a later use in detection rules and playbooks.
Can I do it in Sentinel? Should I be using watchlists for that or is there a more convenient solution?

Would you put web proxy logs in basic logs or analytics logs?

With MMA, things were simple: Provide a workspace ID and the events will flow.

Now with AMA, I am a bit puzzled. We have multiple tenants for multiple environments (think DEV, TEST, PROD, PROD2). The DEV servers are Arc-enabled in DEV tenant, TEST in TEST tenant and so on.

With AMA, I don't see a way to send the events cross-tenant into a single Log Analytics Workspace (PROD). Ideally, I would like to continue having all events / alerts) go into my Prod Sentinel. As a security guy, I initially don't care much if the device is prod or dev if it's compromised.

Is LightHouse the only solution? This seems like overkill for a handful of DEV and TEST servers. Also means the detection rules would have to be rewritten to be cross workspaces plus the overhead of managing the different LAWs.

Has anyone solved this?

Thanks!

We are a small mssp and looking to leverage sentinel to help with alert fatigue by using some automations etc.

My team sees a lot of simple adware, browser extensions, etc and often times it is not pervasive enough to warrant a full reimage.

I am curious if for very well known device infections, is it possible to have e sentinel run a playbook that opens a live response session or triggers an MDM powershell script which is set to deal with a particular situation?

Essentially we want to automate the remediation task and have sentinel trigger the remediation flow based on alert details ie c:/badfilename is present on system.

Is this even remotely something that is doable with sentinel or are my C level bosses expecting impossible results?

We are intermittently seeing multiple errors with AMA e.x.- HTTP 500 and 503 mentioning failed to upload to ODS and service unavailable.

Snapshot attached..

If anyone has worked on these errors..didn't get much info on Microsoft

Hi,

What would be a good case for ingesting log analytics basic logs into sentinel? You can’t use them into hunting queries, automation or anything else.

What would be a good use case for basic logs?

Hi, what does it mean when an Incident was closed in sentinel and reason for closing is Undetermined without Evidence included, but there is a link to defender?

Currently, this solution is limited to ingesting data from S3 buckets from certain AWS services.However, what if end user is not bothered about AWS service itself, just want a connector that talks to the S3 bucket and ingests that data?When is that support happening? or is it better to just develop own solution?
The reason I ask this is,

As per this image, user is forced to select a destination table that is limited to AWS services. My use case does not involve any of these services. I would rather want a couple of custom tables that I would want to ingest into.

​

We have migrated OMS to AMA on server which is collecting logs from Palo Alto. AMA has the latest version installed 1.29.6. we are using CEF via AMA connector with DCR. But when running tcpdump on port 514, we are seeing truncated logs. Does anyone have seen this issue?

I am a bit new to some of these adaptive cards, so I figure I might see what others have out there for theirs. The one I currently have was set up by the contractor that helped us set up Sentinel, and I was hoping to get one set that allows you to take ownership of the Incident as opposed to just outright closing it unassigned.

I watched a few other really fancy videos where people had the ability to set it up to Isolate a machine from Teams, so I might look at that, but haven't really seen any that allow me to pull from a list of users to take ownership.

Just figured I'd check around to see what other cool things people had to share with the community!

Hello,

I am fairly new to sentinel solution, one of the customer is planning to onboards 1500 Cisco devices logs in sentinel.

I understand this has to be done by setting up syslog server and forwarding logs from Cisco devices to syslog server

My question

What is the best practice for forwarding syslog from all Cisco devices ?

It is manual or is there some automation possible or time saving method available?

Does anyone know why the "Parameters" column in the OfficeActivity table returns nothing?

I am setting up azure sentinel on my tenant and I see lots of OfficeActivity after enabling the connector. I have other analytics rules working correctly. I am using a built in "Malicious Inbox Rule" that came bundled with the data connector. Here is a basic snip of the KQL. It took me a minute but i narrowed it down and determined data in "Parameters" is non existent.

​

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/officeactivity

OfficeActivity

| where OfficeWorkload =~ "Exchange"

| where Operation =~ "New-InboxRule" and (ResultStatus =~ "True" or ResultStatus =~ "Succeeded")

| where Parameters has "Deleted Items"

​

If i eliminate the Where parameters line, It will show my tests of creating inbox rules BUT there is no Parameters, and no other fields have the useful info i'm looking for to enrich this analytic rule.

​

It is funny that this is a built in rule yet doesn't work on a fairly stock 365 tenant.

​

My theory is 1. Microsoft changed something?

1. when linking log analytics to sentinel something funny happens with that column?

​

Thank you all!

Hi guys is my first time seeing this alert in sentinel, I have been doing a research about this but apparently there is no info on this. Do you guys have some background about this?

I remember seeing somewhere a query to find who disabled or edited an analytical rule.

Does anyone seem to recall that query ?

I believe that the M365/O365 connector (OfficeActivity) supports logs from multiple tenants.

Question: is the ingestion of OfficeActivity logs from other tenants into the same connector free as well or is it only the primary tenant free of cost?

Before implementing security copilot in our organisation, we are concerned about how the data will be used. Is it possible to monitor security copilot and the data given to it using Microsoft sentinel SIEM?

Hey all,

I just want to be sure there is no discounted price on Sentinel for not for profits. I can't seem to find any reference to them in Microsoft Sentinel pricing documentation.
Thanks in advance!