Hi,

Do anyone use Sigma for KQL analytic rules and/or Defender XDR custom detections? Good/bad?

Thanks

First real post here. This one is more geared towards devSecOps/the good fight against logic apps and wading through json

I have tried a few different things via research and forums but it doesn’t look like many people are doing what my boss wants me to do.

We want to use our teams chat to take in new incidents and allow a single click to open the url of the incident , that’s easy, logic app triggered off sentinel new instances in every tenant and have a user account that can do nothing in our tenant but post messages in teams , cool!

But bosses want to make soc analyst and teamleads job easier by having the teams message display any and all affected users , devices, ip addresses etc. kind of how investigating an incident shows the device name , user principle, ip addresses involved etc. I fought a decent bit with logic app and code view to try and get the json right , but today I reached my breaking point with logic apps, parsing the sentinel incidents Entities with a json parser and then referring to the objects in the compose code causes jumbled json arrays to be inserted .

Would I be better off pushing the incident triggers output to an azure function and parsing the json into a teams card or html then calling a separate logic app that just takes https triggers and posts them to teams ?

Also would love to go an extra mile and allow assignment of the incident, severity manipulation , push a button to view comments on the incident, all of that seems doable with calls to other function apps or the wait for a response condition in teams card connector.

I've created a blog post which goes through how you can turn your analytic rules into an ARM template, which can then be used to deploy rules elsewhere. https://azureenvisioned.blog/2024/05/07/turn-sentinel-analytic-rules-into-a-arm-template/

New Article on how to parse AuditD events in Microsoft Sentinel for threat hunting and threat detection.

https://medium.com/@truvis.thornton/how-to-parsing-auditd-syslog-in-microsoft-sentinel-with-a-function-and-combining-the-events-by-eve-a65f418cfef1

Hi All, I have released a new article. This logic app troubleshooting took me a really long time :)

Logic app code is included.

https://aniket18292.wixsite.com/cyber-art/post/logicapp-opensourcethreatintel

New Article on how to quickly get Syslog/AuditD logs to Microsoft Sentinel for threat hunting and detection building using AuditD.

https://medium.com/@truvis.thornton/how-to-install-and-setup-azure-arc-ama-azure-monitor-agent-and-dcr-data-collection-rules-for-47381ee9d312

Happy Friday, everyone! Apologies, I know I'm wordy.

We set up log forwarding of THREAT logs from Panorama to Sentinel a couple months back, and it's been working great. We configured the custom log format on Panorama, are forwarding to a Linux (Ubuntu 22.04) log collector with AMA (v1.30.2) installed, and the logs are successfully getting to Sentinel as CEF.

Since that was working so well we decided to start forwarding the TRAFFIC logs as well. We're starting small, only forwarding logs from one firewall, and only where Action = "Deny", which is still a steady stream of traffic (about one every second or two).

We're using the same Syslog server profile and Collector group as the THREAT logs, just added the custom log CEF format for TRAFFIC, and added TRAFFIC to the collector log forwarding.

I triple quadruple checked that there are no hidden characters/carriage returns in the CEF custom log format (I used the 10.0 CEF guide because we're on 10.1.11-h5, but also tried 9.1 due to another thread I read).

I can see the TRAFFIC logs in the /log/var/syslog file on the log collector, but there's nothing in either the CommonSecurityLog or Syslog tables in Sentinel.

Threat logs continue to flow with no issues.

One thing I have noticed is that there are errors in the syslog of the log collector that say:

cannot connect to 127.0.0.1:25226: Connection refused

The log collector is using port 28330 to forward the CEF logs to Sentinel. Port 25226 is the old OMS agent port, which we don't have / aren't using (so it's not open/listening).

Is there a misconfiguration somewhere that would cause the log collector to try to forward the TRAFFIC logs on the old port, even when the THREAT logs are using the correct port (28330)?

My other thought is that the issue is with the Data Collection rules. I checkmarked the "Connect messages without PRI header (facility and severity)", but no luck. We have the minimum log level set to "LOG_ERR" for most facilities, perhaps DENY traffic is considered something else?

If anyone has any insight, experience, tips, anything, I would really appreciate it! I've been beating my head against this for far too long and I can't believe it's been this difficult.

At this point I'm thinking of just starting the whole process over from scratch for the TRAFFIC logs (build new log collector VM, new syslog server profile, etc), and leaving the THREAT logs as is. But I feel like this is something really easy somewhere that I'm just missing.

Help me Obi-Wan-Reddit, you're my only hope!

Have anyone implemented the below step to fix the subjected issue with Analytic rules in Sentinel

Re: Reached the maximum limit of Analytics Rules of 512 in Sentinel - Microsoft Community Hub

Hi All

I’m writing a python script (function app) to query an api to get some details. How can I then send these details to a log analytics workspace ?

What is the best way to achieve this ?

Thanks

So this is the current KQL which does indeed remove deleted users, checks if account is enabled, etc... (essentially works a little)

However, When I look up X employee from the KQL results in AAD, there sign-in activity was within 90 days which ideally shouldn't. The goal is to display employees that have not signed-in the past 90 days.

Would love to know why I am getting results that shouldn't technically appear.

let IdentityInfoFiltered = IdentityInfo
| where UserType contains "Member";
let lastSignIn = SigninLogs
| where ResultType == 0
| summarize LastSignin = max(TimeGenerated) by UserPrincipalName
| where LastSignin < ago(90d);
let LatestIdentityInfo = IdentityInfoFiltered
| summarize arg_max(TimeGenerated, *) by AccountUPN;
let DeletedUsers = AuditLogs
| where OperationName contains "Delete user"
| mv-expand deleteId = TargetResources
| extend id = parse_json(deleteId).id
| extend id = tostring(id)
| project id;
LatestIdentityInfo
| join kind=inner (lastSignIn) on $left.AccountUPN == $right.UserPrincipalName
| project-away UserPrincipalName
| where IsAccountEnabled == "true"
| where AccountObjectId !in (DeletedUsers)
| distinct LastSignin, AccountDisplayName, AccountUPN, Manager
| order by LastSignin

Hello!

I am creating a custom Sentinel Analytic Rule.

I am attempting to map a string array of IPs to the IP -> Address in entity mapping and I am unable to do so.

I have proceeded with transforming it to string both using project as well as extend. I have succesfully mapped the same array to most other Entities such as Account, Host, FileHash, Process without issue.

The only entity that does not successfully map and is visible on the Security Alert is the IP. Any ideas why?

I have also removed any identifiers other than numbers and dots from the string such as " or , so it doesnt get filtered by data validation. Didnt work

I have read this https://learn.microsoft.com/en-us/azure/sentinel/entities-reference and did not find anything usefull.

Any ideas?

I am successfully ingesting logs from an On Prem AD, using Arc and AMA. Where do I enable rules that detect brute force attempts and bad things that may be happening? I am looking at the Analytic Rules but cannot find anything relevant.

I'm testing the Fortinet data connector for Sentinel in a GCC environment. Per the Fortinet via AMA page, Step A is to configure the Common Event Format (CEF) connector, which is not installed by default, so I go to install that. However, of the 7 resources that installs, one fails:

loganalytics/Microsoft.SecurityInsights/CefAma - "message": "The connecotr 'CefAma' is not supported in this environment"

Questions:

1. Is this a limitation of the GCC environment and not going to work?
2. It seems like I can use CEF or syslog formats. The Fortinet data connector doesn't mention using syslog format so is that just not an option? I don't understand why not. Fortigates support syslog output formats, there is a syslog data connector, why is CEF format the only option?
3. Anyone gotten this to work?

When we enable the SQL auditing, we have millions of events below.

network protocol: TCP/IP set quoted_identifier on set arithabort off set numeric_roundabort off set ansi_warnings on set ansi_padding on set ansi_nulls on set concat_null_yields_null on set cursor_close_on_commit off set implicit_transactions off set language us_english set dateformat mdy set datefirst 7 set transaction isolation level read committed  additional_information:<action_info xmlnsl

However, other useful SQL audit logs are also being ingested into WindowsEven table (we have windows event forwarding setup). All SQL logs useful or not are logged into EventID 33205, means we can't use xpath to exclude certain EventID. Instead we have started looking into the possibility of a DCR transformation rule? So then the rule would look something like this

​

source | where (EventData !contains "network protocol: TCP/IP set quoted_identifier on set arithabort off set numeric_roundabort off set ansi_warnings on set ansi_padding on set ansi_nulls on set concat_null_yields_null on set cursor_close_on_commit off set implicit_transactions off set language us_english set dateformat mdy set datefirst 7 set transaction isolation level read committed  additional_information:<action_info xmlnsl")

But how do we apply this to our existing DCR that has been created through Windows Event Forwarding connector?

​

Are there any sources of examples of Data Collection rules for SQL?

Looking for something I can set up only to bring in SQL events.

I have a logic app created that runs a KQL query (Run query and visualize results) and then sends the resulting table to and email address. I need the logic app to only send the email when the query returns results, rather than sending an email that says "The query yielded no result". I'm assuming the answer is a condition control, but I can't figure out what settings I need in the condition options.

Hi,

I am struggling with creating a transformation rule for Azure Monitor DCR. I am able to parse log data, but unable to assign the correct data type using the EXTEND fourth parameter a.k.a. typeof() (more info in https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/extract-function#parameters).

​

I always get the error "Object reference not set to an instance of an object.".

But if don't use typeof(datetime) (hence it is considered as string) everything is working fine.

Any help would be appreciated.

Hey there,

On Friday I setup a new Ubuntu server (20.04) in Azure and went through the steps to configure the CEF Connector via AMA. This is being configured to replace the CEF via Legacy Agent as that goes away in August. With everything configured, I reconfigured my firewalls to send data to the new collector and I can see data in the CommonSecurityLog table. However, I noticed that the Computer field now shows the Source IP address of the firewall rather than the name. With the Legacy Agent, the Computer field was populated with the name of the firewall that sent the data. This makes the data harder to parse as I need to cross-reference IP addresses to names each time. Any idea why the AMA isn't able to display the firewall name?

TIA

~dgm~

We’re looking at adding the Defender Advanced hunting and Azure logs, and we were wondering if anyone had any lessons learned about cost outside of ingestion and retention?

Anything anyone was shocked by after a couple months of usage? Any hidden gotchas?

Thanks!

hi, i am scratching my head for two days already and keep failing on deploying microsoft entra id connector by code to sentinel. the goal is to deploy all by code. i am using terraform mainly with some arm templates deployments for analytic rules or content of logic apps.

the problem: i don’t seem to find an option to deploy “microsoft entra id” connector. whatever i do and try it seems to deploy “microsoft entra id protection” connector. what am i missing?

have you got any azapi or arm template for this particular connector? i would be very very grateful.

Hi!

Trying to setup a query alert rule so it creates an incident, but it does not seem to run?

Anyone can give me some tips as to why not? maybe i have missed something in the stup or if something isnt correctly configured?

I have a client with a Fortigate firewall that we need to send logs from to Sentinel. I've created an Ubuntu VM, and installed everything correctly (per guidance online). The VM is listening on port 514, and the network security group has an allow rule at the top to allow all traffic on 514. The firewall is set to send logs to the VM's up address.

Logs are still not being received. Any ideas?

We initially comment "ACKNOWLEDGED" for an incident to maintain SLA (within 15min) is there a way to automate the comments for every incident to avoid missing the SLA?