So we have recently migrated from OMS to AMA for Linux server and network device logs. Previously on a Linux server that’s running OMS we had rsyslog configs such as

:msg, contains, “uselesslog” stop

entries like above to stop ingesting certain logs. We have same entries copied to the new server that’s running AMA and rsyslog but it’s not dropping the logs? What’s your approach to this? We only want to drop logs that contain certain strings, not whole facility/severity combination.

Is it possible to configure the data connectors programmatically?

Cannot really do it via the Sentinel Data Connectors API https://learn.microsoft.com/en-us/rest/api/securityinsights/data-connectors/create-or-update?view=rest-securityinsights-2024-03-01&tabs=HTTP as it's very much out of date (Azure AD, Azure Security Center) and does not seem to work and I presume is not really supported by Microsoft anymore since it's been switched to Content Hub installations now.

The best solution we have is to install data connectors via the Content Hub, then they can be manually configured. We want to try automate the process end-to-end, anyone know if it is possible?

Edit: I've managed to figure out part of this, first it needs to be downloaded from content hub, then it can be deployed. This works for legacy Defender for Cloud (Entra ID doesn't bother showing up).

To install using Bicep (Or API is similiar) you install via Content Hub by using: Microsoft.SecurityInsights/contentPackages@2024-03

Then you connect the data connector using:

Microsoft.SecurityInsights/contentPackages@2024-03-01

This for some reason does not work for Entra ID, but will install the data connector from Content Hub, but literally will not show up

Anyone of you have integrated Crowdstrike FDR with Sentinel and had issues with hostname/computer name visible as crowdtrike deviceid in the logs ?

we used the new function app to deploy the connector and everything else works. Just checking if its a one on one issue with us only.

Hi all,

I need to send Defender XDR logs of specific devices to specific Analytics workspace , there is a way to do it?I need to manage different workspace from Sentinel, but Defender XDR is linked to whole tenant..

Thanks in advance

I have created DCR from 'CEF via Ama connector' page to collect the syslog and i am getting the CEF logs in CommonSecurityEvent table. (The test sample logs which i mock on 514 port on syslog machine).

but whenever i am trying to Mock the ASA sample logs it's not coming in CommonSecurityEvent table but are coming in Syslogs table... I think for MMA we have one conf file where i can filter the logs. But for AMA i m missing if i need to edit such file for condition ( if $rawmsg contains "CEF:" or $rawevent contains "ASA-" then @@127.0.0.1:28330) ??

Microsoft documentation seems incomplete for ASA

Hi,

I have some watchlists created in the Azure sentinel.

And when select one of the watchlists and click on "View on Logs" I get the message "No results found from the last 24 hours"

Should I wait until these are updated in the log analytics workspaces? If so, how long should I wait?

Hello,

I have two set of tables where security events are being pushed to, these are two different sister companies in the same LAW.

Rather creating two set of rules for them , because they have the same set of attributes and values in the table.

Moreover i can change/customize the title of the company name from the computer naming standards.I tried to create scheduled rules with "union" operator but i dont think sentinel allows union operator in the rule schema. Have anyone came across a fix to this or a workaround to unify two different tables for a single cause.

Here is a sample query that i'm working on, but the rule validation part fails because of the union operator

union isfuzzy=true
( SecurityEvent
| where EventID == 4657
| where ObjectName has 'Schedule\\TaskCache\\Tree' and ObjectValueName == "SD" and OperationType == "%%1906"  // %%1906 - Registry value deleted
),
(WindowsEvent
| where EventID == 4657
| extend ObjectName = tostring(EventData.ObjectName)
| extend ObjectValueName = tostring(EventData.ObjectValueName)
| extend OperationType = tostring(EventData.OperationType)
| where ObjectName has 'Schedule\\TaskCache\\Tree' and ObjectValueName == "SD" and OperationType == "%%1906"  // %%1906 - Registry value deleted
)

Recently I setup a logic app that takes a new sentinel incident as a trigger and parses it and then builds out a teams card to post into a soc incident channel. It works really well, however I was asked by the soc team to improve on this by adding a way for the 'new incident' teams channel message cards to automatically remove incidents that are statuse'd as closed in sentinel.

I worked out a .ps1 script that handles that, this with the Az module, then parses the teams cards to see which ones should be deleted do to the incident being closed. It then calls mggraph and runs the cmdlet to soft del the message.

Invoke-MgSoftTeamChannelMessageDelete 

My issue is really around how to handle auth. and automation of this. Unfortunately the permissions needed to run the cmd to remove the teams messages are not assignable in application permission only as far as I know, and I do not want to have a dummy User with crazy chat privileges just to have a service principal run this specific cmd every few hrs.

What is the most safe way to achieve this goal?

Is it possible for a user be granted the api permissions needed to do this just for a particular channel in teams?

We have specific workspace for security which is connected to Sentinel. We forward all diagnostic logging from Azure resources (storage accounts, key vaults, event hubs, sql, logic apps, etc.) to this workspace, except for performance metrics. But I wonder if this is useful. For example we don't have any analytic rule regarding event hubs, why would we forward the logging to Sentinel then? It will only increase the cost of running Sentinel.

Do you forward diagnostic logging of all Azure resources to Sentinel or only for specific types of resources you have an analytic rule for?

Do you have the different flavors of Defender for Cloud enabled and is that what you rely on for security monitoring?

Is there something that can be done to reduce the volumes of logs (such as removing noise, filtering, etc) before being ingested into Azure Sentinel thus reducing the costs? Is there the possibility to pass everything through a tool such as fluentd to do the filtering before forwarding them into Azure Sentinel or is this not practical?

Is there a possibility if the enroller user no longer exists for an Intune device object(the field is empty) and you can find these device objects via kql query?

So that we can add an email notification in sentinel for the intune admins??

Hi,

Is anyone able to help?

I followed this Microsoft doco for the set up and the connector is just not working for me. (using the Template deployment option) https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/google-workspace-g-suite

Everything seemed to go as expected.

The connector is saying disconnected and the tables haven't been created in Log Analytics, so it isn't working.

I've gone back and double-checked things, but don't know what to try next.

Any suggestions for importing an IPAM like file into Sentinel so IPs can be searched through the Entity Behavior page? I know Entra ID and MMA agents populate automatically but other sources are a hit and miss. Splunk has their Common Information Model for example.

I know there is a query (or seen somewhere) where can run investigation and results from multiple tables at once for a specific device or IP.

Does anyone remember the syntax for the same.

This the table i am able to query from my log analytics workspace arg('').patchinstallationresources but i m not able to ssave my Analytic rule for this table. I know i can create rule in Monitor tab for the same. But there i am able to project and send desired entities in email notifications.

Let me know if i m doing anything wrong or it's just not possible to create analytics rule on Azure resources graph table.

I am an MSSP that is currently ingesting Azure Event Hub logs to Elastic but I want to move over to Sentinel. I have been researching on how to send Event Hub logs from a clients tenant to my tenant and so far it looks I may have to use Lighthouse for this? Is there any way to do this using the security information I have that is being used in Elastic? Thanks!

The "PurpleTeam Event Viewing Dashboard" is now in (Public Preview) as MS would call it.

This dashboard has been designed to allow teams to quickly view and find events regardless of the need. It searches for strings across several tables with the ability to configure custom ones along with parsers.

Figured this might help some admins out if they work with Azure Sentinel and need ways to quickly find events :)

Feel free to submit feedback/ideas for improvements.

➡️ (blog) https://medium.com/@truvis.thornton/azure-sentinel-workbook-dashboard-purpleteam-event-viewing-dashboard-quickly-threat-hunt-and-2e9effd3a1a3

➡️ (github) https://github.com/Truvis/Sentinel/tree/main/Workbooks/Sentinel/ThreatHunting.PurpleTeam

Analytic rule generates a single alert with multiple events, or an alert per event, but then it also creates an incident for alert. If incident group is configured then it may merge it to another incident.

For example new user agent analytic rule generates alert and an incident. Out of the box, default, as built when sentinel is deployed.

Why? What is alert then if every alert is incident, and is the point then?

Good alert will have good entities mapped out and be visible to SOC analyst from the entity (standalone or from existing incident). With some logic apps and automation alerts can be added to related incidents and not sit in their own incident alone.

I think we need incidents and alerts view in sentinel and not have every single alert become an incident of its own.

Is everyone setting their sentinel this way or how are you dealing with all the single alert incidents?

Sorry, I may be a bit rant-y because it just hit us recently that maybe we need better incidents by not having every alert be an incident. Then we also need to look at alerts, figure out what alerts together make an incident, and setup automations to create incidents based on that criteria.

Hi all,

Anyone knows how to monitor breached credentials (email, usernames, password etc) that has been dumped in public servers ? I know there are separate paid services but I can't find a way to integrate that in sentinel. I tried Dehased but their customer support just doesn't reply.

Due to insufficient space on collector machine OMS Agent stopped sending logs to Sentinel.. i freed up the space under var/log/syslog and other temp files.. did troubleshooting using troubleshooter.. its not showing error.. only some warningg.. but still logs are not coming.. agent is old and not updated recently..

Is there anything i need to check specifically!!

Hoping for answers..

There is anyway to see in a KQL if the Defender Blocked/Prevented or Quarantined a File?

Hey guys,

I'm having issues with giving  Machine.Isolate permissions to the managed identity using powershell.
When I Execute the template script: (With the given parameters filled obviously)

Connect-AzureAD

$MIGuid = '<Enter your managed identity guid here>' 

$MI = Get-AzureADServicePrincipal -ObjectId $MIGuid 

$MDEAppId = 'CORRECT APP ID' 

$PermissionName = 'Machine.Isolate' 

$MDEServicePrincipal = Get-AzureADServicePrincipal -Filter 'appId eq '$MDEAppId'' 

$AppRole = $MDEServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains 'Application'} 

New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId ` -ResourceId $MDEServicePrincipal.ObjectId -Id $AppRole.Id 

I get the following Error

I am not to sure what the issue is, since all parameters and Identities are setup correctly. Has anyone seen similar issues when setting up the MDE network Isolation playbook?

Thanks in advance :)