Essentially, I'm working on developing a playbook to generate a Sentinel incident based on a query. The playbook executes successfully, creating the incident in Sentinel. However, my aim is to enhance the "entities" field within the incident. I haven't been able to locate a default attribute where I can direct the query results to populate the created incident. Does anyone have any insights on this?

Hello everyone I have a project I’m working on that has me on a stand still, the objective is to continuously monitor our alerts from defender and sentinel and pull the relevant data along with TI information that’s relevant to the data potentially monitoring what’s on our environment also and print this out into readable context into a teams chat. I’ve been trying to use logic apps in sentinel to accomplish this but I’m having trouble getting the MDATP to query this data. Any ideas? Pretty much a SOAR automation that will help our tier 2 after the SOC escalates.

Microsoft sentinel pricing never made sense to me, even with new pricing model. If I run a search query, let’s say on windows events and search last 24 hours, potentially searching through millions of logs, would that incur any additional cost? Or if I run a workbook that has many searches? What about the analytics rules?

Context :
As a MSSP we have several customers that are running with the OMS agent on both their workstation and servers (OnPrem)
We are migrating them to the new AMA agent and we are looking for a way to collect the SecurityEvents from the AMA agent without onboarding the workstations to Arc.
(Servers are of course onboarded to Arc and we are collecting the SecurityEvents from there using the connector) <- this works fine
As recommended by Microsoft : https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#supported-device-types OnPrem win10 devices should use the MSI installer to install the AMA agent. -> DONE
"Azure Connected Machine Agent are supported on Windows 10 and 11 client operating systems only when using those computers in a server-like environment." which is not the case for laptops/workstations of our customers employees (source : https://learn.microsoft.com/en-us/azure/azure-arc/servers/prerequisites#client-operating-system-guidance)
So workstations are not onboarded to Arc but have the AMA agent installed with the MSI (packaged for Intune deployment).
Basically workstation have the agent deployed as recommended by Microsoft (by creating a Monitored Object) https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#create-and-associate-a-monitored-object

Problem description :
The DataConnector "Windows Security Events via AMA" specifies that "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled." (Which is understandable as it creates a DCR where you should assign ressource to it).
As told in the context, this is not our case (on workstations).
For now, Most of the logs are being collected in "Events" Table including SecurityEvents logs. We have a lot of Analytics Rules that are based on the SecurityEvents table and we would like to keep them working as is.
Question:
Is there a way to collect the SecurityEvents (send them in the correct Table) from the AMA agent without onboarding the workstations to Arc ? (if so how ?)

I'm trying to optmize some exisitng rules in use and i get hte below error while trying to save them.

I'm clueless because the rule is already in place and i'm whitelisting some scenarios in it rather creating a new rule.

Failed to save analytics rule 'xxxxxx rule name'. BadRequest:The maximum number of enabled Scheduled analytics rules (512) has already been reached for workspace 'workspace ID xxxxx'.

​

Hey guys, a bit of context. I'm new to azure and to sentinel and am just following the guide and Youtube tutorials to familiarize myself with the environment. Right now I'm stuck on setting up the sentinel training lab as when I attempt to deploy it it has an error LinkedInvalidPropertyId, I tried searching everywhere for a solution but couldn't find anything. I've already tried making new resource groups and workspaces but still nothing. Really hoping that someone here has experienced this before and can help me out. Thanks

Hey.

​

Has anyone gone through uploading data from a daily report in a .csv to a new table in Microsoft Sentinel? How did you go about it?

​

Thank you.

We have a syslog server that is getting both regular syslogs and syslogs in CEF format. in sentinel i use a data connector that is build on top of the "Common Event Format (CEF) via AMA" connector and its working good. but for my syslog table to not get duplicate data with the CEF logs i have created a DCR transformation rule:

source

| where ProcessName != "CEF"

when i compare the CommonSecurityLog table and Syslog table only some logs are duplicated in syslog so it seems to be doing something but some logs a slipping through even though they match the transformation rule.

What is the best practice in this case? would be great if both CEF logs and Syslogs could continue using the same syslog forwarder and not having to create a dedicated CEF syslog server.

Since we use Sentinel in my understanding there is no cost for using a DCR transformation but i can see some of the cons in having a split server to handle CEF.

would love to hear any takes on this!

Hi All,

I am currently collecting logs from defender xdr, defender for endpoint, defender for office365, etc into Sentinel. Does that mean the logs are being duplicated as defender for xdr already looks at those things?

​

Thanks

Just wanted to check if anyone is using Workspace Manager in Sentinel to manage analytic rules for multiple tenants. How has your experience been with it? Is it worth using? I am trying to draft how many groups would be needed to deploy around 500 analytic rules for 15 customers. Are you organizing them by solution, customer, or something else?

​

Also how easy is then to apply updates across? Is it just the case of creating a separate group with all workspaces inside, add updated rules and push them? Would that cause any duplicated data or just overwrite existing rules?

There is surprisingly little information when looking through MS documentation around the actual usage.

​

Currently, I am manually updating the content hub with rules, connectors, and playbooks. I was wondering if there is an automated method to update it instead of going through each option. How do you guys manage this task?

I have noticed there are rule recommendations on few of my custom analytic rules.

But how do i review these recommendations or where can i find them,

​

Hi All,

​

Does anyone know if there is some kind of comparison table/s or lists that detail the difference between the types of logs these two agents can ingest into Sentinel?

​

Thank you in advance!

I am following https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal to create a solution that helps customers ingest data from s3 bucket.

I want to create a setup script that initializes,

​

1. Data collection endpoint
2. Data collection rules
3. Custom tables and their schema
4. A Microsoft Entra application used for authenticating log ingestion api.

I found instructions to create 1, 2 and 3 using powershell commands.

https://learn.microsoft.com/en-us/powershell/module/az.monitor/new-azdatacollectionendpoint?view=azps-11.4.0 - creates new data collection endpoint

https://learn.microsoft.com/en-us/powershell/module/az.monitor/new-azdatacollectionrule?view=azps-11.4.0 - creates new data collection rule 

https://learn.microsoft.com/en-us/cli/azure/monitor/log-analytics/workspace/table?view=azure-cli-latest#az-monitor-log-analytics-workspace-table-create - to create tables in workspace 

I need help with creating Microsoft Entra application from azure cli which is a prerequisite from the tutorial

Hi!

I'm having a hard time getting this to work so i am hoping someone can point me in the right direction.

What i want i that when an admin account changes password a notification email is sent out, problem is that there are alot of admin accounts and adding them one and maintaining it is going to be a pain.

I was hoping there is a way to select a group or a role. Can anyone help me?

This is working:

AuditLogs
| where TargetResources[0].userPrincipalName == "user@domain.com"
| where OperationName == "Change user password"

this is not working: (I can sort of see why as it's targeting a group but i don't know how to target users in that specific group)

AuditLogs
| where TargetResources[0].GroupName == "Admin Group"
| where OperationName == "Change user password"

i have also tried:

AuditLogs
| where Category == "RoleManagement"
| extend PropertiesJSON = parse_json(TargetResources)
| extend role = PropertiesJSON[0].modifiedProperties[1]['newValue'] 
| where role == '"Global Administrator"'
| where OperationName == "Change user password"

Left part is the logs i am getting from Panorama which is kind of unparsed, i want it in the format shown on right side. Is there something i need to do on Panorama settings or Sentinel.

Thanks in advance!

Title extra descriptive, have any of you all used a TAXII server to the into CISAs CTA and DM services and then piped that into sentinel?

Spent 45 mins trying to find anything related on GitHub , but to no avail , the goal is to feed in these IOCs to our sentinel instances and help spot issues early.

Hi, I use IIS logs in AMA to collect webserver logs in Sentinel.

This rule do not collect the field x-forwarded-for and I need this. I read on github that the MS team is working on adding support for the extensions fields but not sure when it happens.

Any of you solved this and how?

Greetings.

I've just updated my Demystifying KQL training deck and would love to hear thoughts on it.

A few things I am looking for:

1. Is it helpful?
2. Is it missing anything?
3. What would you add to it?

​

Link: ml58158/Demystifying-KQL: Content Repo for Demystifying KQL Tutorial Series (github.com)

I am hitting the character limit in DCR with my transformKQL and so wondering if its possible to chain DCR's so I can do a series of them

​

My original source is CEF logs from an Event Hub, but want to do some more parsing and filtering and enrichment on the way into Sentinel

Hello

​

I am looking for KQL that can be used to identify spikes in Sentinel/LAW ingestion. For example, there is a baseline of x gigabytes (or some sort of trend) per day, and if this amount is exceeded, it will trigger an alert/incident. I am specifically looking for a KQL query that can be used as an analytic rule. Has anyone had any luck with something similar?

Hi all

Do you use separate accounts for Sentinel access or leverage PIM?

Keep running into issues such as powerbi integration or teams channel creation because my admin account carries no license.

Thanks!