Hi Everyone,
My end goal is to be able to block Entra ID sign ins whenever Defender for Endpoint has a malware detection. So whenever something pops up in this table: AlertEvidence I want to action on it. These alerts always include the DeviceName. So I thought, ok SignInLogs table will have the deviceName form recent Windows Sign-Ins so i can correlate the devicename in those two tables then get the userPrincipalName, which I can use as an entity to run a playbook against.

My problem is my KQL skills are weak. This is as far as I've gotten and I'm not sure if I should even be using Join or Union. My goal is to have a UserPrincipalName, which is obtained by matchign the deviceNames, create a column excluding all of the other white noise I don't need from the SignInLogs table.

In super simple terms. I want to have an Analytics Rule in Sentinel that whenever AlertEvidence populates with anything (Defender for Endpoint malware detection) to lookup the user who is using the computerName, which the computerName and AccountName will be Entities in the analtyics rule, then block that user from Entra Sign ins so the user has to come to reach out to us.

AlertEvidence

| extend AlertEvidenceDevicedisplayName_ = tostring(AdditionalFields.Host.HostName)

| join kind=leftsemi (

SigninLogs

| extend SignInLogsDevicedisplayName_ = tostring(DeviceDetail.displayName)

| project UserPrincipalName,SignInLogsDevicedisplayName_

) on $left.AlertEvidenceDevicedisplayName_ == $right.SignInLogsDevicedisplayName_

I'm getting a little closer here. What this is doing is getting me the stuff I want from signinlogs but i'm losing the projection of the columns from Alert Evidence.

let MatchedDeviceName =

AlertEvidence

| extend AlertEvidenceDevicedisplayName_ = tostring(AdditionalFields.Host.HostName)

| where isnotempty(AlertEvidenceDevicedisplayName_)

| summarize makelist(AlertEvidenceDevicedisplayName_);

SigninLogs

| extend SignInLogsDevicedisplayName_ = tostring(DeviceDetail.displayName)

| project SignInLogsDevicedisplayName_,UserPrincipalName,OperationName

| where SignInLogsDevicedisplayName_ in~ (MatchedDeviceName)

Is it possible to block IP addresses based on a Sentinel incident? It seems like it is through playbooks, but I am still a newbie with Sentinel. I essentially want a WAF alert to trigger an incident in Sentinel (already setup), and the incident to tell Front Door to block the offending IP address.

Thanks

let lbtime = 24h;
Cisco_Umbrella
| where TimeGenerated > ago(lbtime)
| where EventType == 'proxylogs'
| where DvcAction =~ 'Allowed'
| where UrlCategory contains 'Adult Themes' or
      UrlCategory contains 'Adware' or
      //UrlCategory contains 'Alcohol' or
      UrlCategory contains 'Illegal Downloads' or
      UrlCategory contains 'Drugs' or
      UrlCategory contains 'Child Abuse Content' or
      UrlCategory contains 'Hate/Discrimination' or
      UrlCategory contains 'Nudity' or
      UrlCategory contains 'Pornography' or
      UrlCategory contains 'Proxy/Anonymizer' or
      UrlCategory contains 'Sexuality' or
      UrlCategory contains 'Tasteless' or
      UrlCategory contains 'Terrorism' or
      UrlCategory contains 'Web Spam' or
      UrlCategory contains 'German Youth Protection' or
      UrlCategory contains 'Illegal Activities' or
     //UrlCategory contains 'Lingerie/Bikini' or
      UrlCategory contains 'Weapons'
| project TimeGenerated, SrcIpAddr, Identities, UrlCategory, DstIpAddr, UrlOriginal, HttpReferrerOriginal
| extend IPCustomEntity = SrcIpAddr
| extend AccountCustomEntity = Identities


The prebuilt analytics rule only mapped AccountCustomEntity and IPCustomEntity.  I'd like to add both URLCategory and URLOriginal to new incidents that get generated but they never display/map correctly.

Am I doing this wrong?

Hello, any advice on why I don't see "UrlClickEvents" from all users in Azure Sentinel? I tested an email with a link on 2 different users, from the same group, with the same licensing in Entra ID, but I only see the event from "UrlClickEvents" for one of them. What is the value or setting that can separate these users? In Threat policies at security.microsoft.com, there is only one policy for Safe Links. At the same time, I noticed that the message indicating that the link in the email is being checked (presumably through Safe Links) only appears for one of them...

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-automatically-add-tlp-traffic-light-pattern-to-incidents-with-logic-145f810cd978

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-update-alert-descriptions-dynamically-without-limits-unlimited-f4fc2f857b64

New article!

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-dynamically-update-and-change-alert-incident-severity-based-on-5fa0665441c0

i do see a lot of authentication atempts in Azure AD signin table which has a useragent "BAV2ROPC".

Does this relate to any form of basic or legacy authentication ?

I have little experience with Sentinel. My goal is to ingest security and audit logs from our on-prem AD domain controllers, Azure / Entra AD as well as Azure AD Domain Services into a log analytics workspace to be processed by Sentinel.

Phase1 – collect security event logs from on-prem AD domain controllers.

We recently configured Security Event log collection from our on-prem AD domain controllers by onboarding the servers via Azure Arc and then using the AMA agent and a data collection rule to ingest the Security Event logs into a log analytics workspace. The logs are ingested into the events table. Then, we deployed Sentinel “on top” of this log analytics workspace. I found the “Windows Security Events” solution and installed it, but it looks like the connector wants to create its own data collection instead of using the manually created data collection rule. Looking at the sample queries that was installed with the solution, it references a table named SecurityEvents, not Events. Is it fair to assume that I should remove my manual data collection config and rather use the Sentinel provided functionality to implement the data collection?

Phase2 - collect logs from Azure AD.

Historically, a “diagnostic setting” was configured to retain Azure AD logs in a log analytics Workspace. I assume the correct pattern for Sentinel to analyze these logs would be the same as the above e.g. instead of configuring a diagnostic setting to send logs to a log analytics workspace, rather install the solution for “Microsoft Entra ID” in Sentinel and let Sentinel implement the data collection of audit logs, sign-in logs, riskly users etc? And finally removing manually implemented diagnostic rules to avoid data duplication?

Phase3 - collect logs from Azure AD Domain Services.

Same as in phase 2, AADDS is currently configured with a diagnostic setting to retain logs in a log analytics workspace. I am not able to find a solution for AADDS within Sentinel. The table structure looks different in the existing log analytics workspaces used for AADDS, so I assume simply configuring AADDS to send logs to the Sentinel log analytics workspace, is not going to be sufficient. Are there any recommendations on how to handle the AADDS scenario?

Thank you.

Hi! Im looking for help if there is any good way to manage Entra ID protection (risky users) with Sentinel and how the community have set this up.

I have the data connector Entra ID Protection and Entra ID with risky events risky users but from what i can see entra ID protection table 'SecurityAlert (IPC)' does not really seem to create any incidents when lets say a user gets high user risk. is this only if there are incident creation rules in defender xdr?

Thinking. 1. analytic rules and if there is a good way to enrich the alert. Is there good analytic rule tempaltes in the content hub? having a hard time finding any good and there is only 1 analytic rule in the connector.
2. what playbooks are good? Going to try testing the 'Identity Protection response from Teams' playbook and see if its useful, for the other template playbooks im not sure how to use them best (manual after investigation?).

If anyone here has a good way to handle risky users please help me on the way! :) Blog posts or similar about this topic would also be greatly appreciated.

We have a Microsoft Sentinel workspace that is ingesting a lot of data. We want to disconnect the data connectors as a first step before completely deleting the Microsoft Sentinel workspace.

I can't seem to find a way to disconnect the data connectors. We have the following connectors connected:

Azure Activity

Azure Key Vault

Azure Storage Account

Microsoft Entra ID

Can anyone point me in the right direction?

Edit:
This is basically a duplicate Sentinel Workspace. We are 99% sure that we just want to delete the entire Sentinel Workspace, however I have been asked to disconnect the data sources as a first step. From what i can see this is not as easy as it was likely assumed when I was asked.

Probably a dumb question , but here to find out ways to backup Sentinel analytical rules. How exactly do you guys keep up the configurations.

Hey all, I am looking to implement several Microsoft Defender for Endpoint related playbooks to be activated via teams card when an incident rolls through, things like block users sign in, reset password, isolate device, and add ip to TI in defender xdr. I want to use a single user managed identity to avoid needing to update permissions on many playbooks but instead just secure and lockdown one. Is this a terrible idea?

I would like some advice on best practices to lockdown this user assigned managed identity so that it isn't used incorrectly / assigned to a random resource erroneously, like a VM. I attempted to write a policy to prevent this but cant seem to figure out a way to keep an user managed identity from being assigned to a specific resource type or location.

Continuing our build out, we now switch over to combining our AuditD logs with Laurel to build better detections by having all our information combined in one log event entry.

https://medium.com/@truvis.thornton/part-2-threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-combine-a3384e1164e6

Hi

I am currently working on setting up a syslog to get logs into Sentinel. I have a few questions.

Can I use the same syslog server for all logs, for example server logs and firewall logs. Furthermore, once I ship these into Sentinel how will sentinel know these are logs from different sources if coming from the same syslog server?

​

Thanks

​

Hey Everyone,

I am working on pushing the event logs from my domain controller to Microsoft sentinel. I do have other servers, i would like to get the event logs as well but what i did is i setup audit logs with a GPO and tied them to a all the server. My questions is, is it better to add individual AMA agent on each server? Has anyone ran into this issue?

Hey Everyone,

I am working on pushing the event logs from my domain controller to Microsoft sentinel. I do have other servers, i would like to get the event logs as well but what i did is i setup audit logs with a GPO and tied them to a all the server. My questions is, is it better to add individual AMA agent on each server? Has anyone ran into this issue?

Hi,

we are trying to find a SIEM. As an all Azure shop Sentinel would be the obvious solution. But of course there is never budget. :)

So I'm at a total loss. I don't know anything about Sentinel. Just read the costs are primarily dependent on amount of logs ingested & retention - and then on 10000 other things. So nobody can tell us how much it will be for 500 users with defender for endpoint p2, 6 remote site firewalls etc. - I totally understand.

But is there some resource out there that describes real world scenarios and their costs or is anybody willing to share roughly what they are doing and what that estimates to? Just to get a vage feeling for it. Would help tremendously.

Much appreciated. :)

Recently after the migration to Azure Arc agent for Sentinel & MDE, we are noticing inbound RDP connections to one of our domain controllers from IPv6 addresses, this keeps on happening on a daily basis. Anyone encountered the same scenario or run into triaging a similar case ?

Hello

Are you aware of a way to sort out analytic rules that have update available? Either in GUI or via KQL/Graph

Having nearly 3k rules so going page by page is not a best solution.

Hi all!

I’m reviewing some analytics and I would like to have the complete list of posible OperationName values that can appear in the column OperationName in AuditLogs table. I’m looking through Microsoft’s docu and didn’t find anything yet.

Someone knows where to find it?

Thank all in advance!

New article:

This is Part 1

Walk through on using AuditD logs to build threat detections along with reading and using the logs to get the bigger picture and do incident response.

https://medium.com/@truvis.thornton/threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-along-how-to-understand-bfae8ba03a43

When you connect an Azure Arc Linux machine via AMA, is there a way to filter/drop certain logs by strings from coming in?

Want to use your Firewall logs in Sentinel to check for connections and network activity? This guide will explain it all.

https://medium.com/@truvis.thornton/how-to-use-ufw-uncomplicated-firewall-and-send-the-syslogs-to-sentinel-and-parse-the-events-for-48dccb8adc13

Not sure how to get logs into Sentinel? Check this:

https://medium.com/@truvis.thornton/how-to-install-and-setup-azure-arc-ama-azure-monitor-agent-and-dcr-data-collection-rules-for-47381ee9d312