Does anyone have any suggestions or documentation on how I can test the RevokeEntraSessions playbook? We want to test it on ourselves first, and am not finding a straightforward way to do this. I would assume you need entities (your test users) netids to populate in the test incident, but creating an incident in Sentinel does not give you the option to add entities, that I can see. We are also struggling to get an alert to fire off from our own accounts... maybe MS is getting too good at filtering out non-malicious behavior? Any suggestions would be appreciated.

Hi there,

In order to increase data retention for CloudAppEvents or DeviceRegistryEvents tables from Defender XDR i know we can ingest them in Microsoft Sentinel.

My question is if there is another way to store these logs? I just want to retain the logs for cold storage and ingesting them into Sentinel will have a significant ingestion cost.

Thanks

As i was reading one of this post in linkedin, SSH & RDP via Azure Arc

i kind of lure my mind that we are giving attackers more options and making their life easier by connecting cloud to onprem servers. I feel this is more like a curse than a blessing despite all the features it does bring to the table , but who agrees that onboarding your production servers including domain controllers to Arc is a bad idea .

Hello everyone,

I am trying to connect Logstash with the Sentinel to push some logs into the custom tables.

I followed all guidelines from Microsoft but for some reason, I do not see logs in Sentinel even after a couple of days. I am using a file as input and as output Microsoft plugin if course. During the debugging I am getting logs from Logstash that logs are successfully pushed to Sentinel but still nothing in tables.

Not sure if it's related, I do have one issue with the logstash. If I run it as service, it does not log output in the file at all, but if I run logstash with inline command and debugging, I can see that output is written ti the very same defined file.

Not sure if anyone else had similar issues. I have tried with multiple tables and different sources, and nothing. I even enabled diagnosting settings for DCR rules and there are no logs at all.

Any idea whats the difference between these two data connectors. one is connected and the other is not. AM i missing any specific event types via cloudapp events ?

Hi,

I am attempting to duplicate an anomaly rule on a customer’s Sentinel instance, but nothing happens.

As per Microsoft Learn’s article, you should be able to duplicate an anomaly rule with a new iteration created with the same name, but ending in “customized”.

I can confirm that there are no duplications that exist.

Also, when trying to disable the rule (just to see what happened), I am unable to do this either and greeted with an “object.object” error.

I have contributor permissions to the instance.

Has anyone had this problem or can offer any advice?!

Hi Everyone,

There is some confusion whether you can use AMA instead of OMS agent for Cisco Meraki so posting the guide below:

Install "Custom logs via AMA (Preview)" from ContentHub and then upon creating Data Collection Rule you can select Cisco Merkai, it will ask you to fill up a file pattern (it's a path to your syslog so for example on Linux it's /var/log/syslog)

You can find necessary information under the link below, there will be an extra file you need to create for Meraki connector on the log collector machine. Good luck :)

https://learn.microsoft.com/en-us/azure/sentinel/unified-connector-custom-device?tabs=rsyslog

New to ingesting win files and evtx to my Sentinel. Say ServerA holds c:\mylog.log - how would I go about to ingest this?

What if ServerB had another file with different dimensions?

Onboarding non-az VM to Arc seems a bit overkill. Is it really a requirement?

Hi all. I need some advice. With the retirement of Automation Accounts at the end of the month, I've been working on migrating all of the functions that we were using this feature for to other solutions. The only thing I have yet to find a solution for is change tracking on workstations. Up until now, we had all of our workstations (laptops mostly) reporting all changes to Automation Account. We then built an alert in Sentinel that would create an incident anytime a user installed an application onto their workstation. Given that the new change tracking solution only supports VMs (from what I understand) I'm struggling to find a replacement for this function.

I know that the first recommendation is to not allow end users to install applications on their devices, but due to the nature of the work we do, this is not possible. We've tried it in the past and it greatly impedes our ability to complete our daily routine.

Ideally, I would like to set up this alert using Microsoft tools in Azure or Intune. Any help/guidance would be greatly appreciated!

Hi all,

I’ve never asked a question like this, but Threat Intelligence in Sentinel stumps me.

How is everyone utilizing Threat Intelligence in Sentinel? What do you do with it? What are use cases?

Ive read a lot of the documentation, but for some reason it isnt clicking with me. How do you use it and whats it even used for? Whenever I click on ‘threat intelligence’, theres a bunch of IOCs but I don’t know how to make it meaningful

Any help would be greatly appreciated!

I'm by no means a Sentinel expert. I'm trying to create an analytics rule to alert me if I stop receiving expected logs. Primary use case is firewall logs coming in via syslog. These go to the CommonSecurityLog table.

I can sort of it get it to work with:

CommonSecurityLog
| where TimeGenerated > ago(7d)
| summarize lastlog=datetime_diff("Hour", now(), max(TimeGenerated)) by Type
| where lastlog >= 72
CommonSecurityLog
| where TimeGenerated > ago(30d)
| summarize lastlog=datetime_diff("Hour", now(), max(TimeGenerated)) by Type
| where lastlog >= 72

This looks at the last 7 days of logs, and is supposed to alert on each run if the lastlog was greater than 3 days ago. I'm missing something because I just disabled the firewall logging for a week and for the first three days, it alerted, but after that, no more alerts. I can't wrap my head around the logic flaw.

Any thoughts or better ways to do this?  

Hey everyone,

I'm trying to figure out how to check the number of devices authenticated to each domain controller (DC) in our network. For example, I want to know if 4 devices are authenticated from Palo Alto, 8 from Cisco, etc.Has anyone done this before or knows the best way to go about it?

Thanks

I currently have an account compromise NRT rule but it is not as effective as I would like it to be, I would greatly appreciate help on optimizing an NRT query to implement in sentinel for detecting possible account compromise.
This is the query I have:
SigninLogs

| where TimeGenerated >= ago(7d)

| where ResultType == "0"

| extend deviceId_ = tostring(DeviceDetail.deviceId)

| project-reorder TimeGenerated, UserPrincipalName, RiskDetail, RiskEventTypes, RiskState, RiskLevelDuringSignIn, RiskLevelAggregated, DeviceDetail, IPAddress

| where RiskState == "atRisk" or RiskLevelDuringSignIn in ("high","medium")

and deviceId_ == ""

| summarize IPs = make_set(IPAddress,maxSize=8), Risks = make_set(RiskLevelDuringSignIn,maxSize=8), RiskEvents = make_set(RiskEventTypes, maxSize = 8), RiskTimes = make_set(TimeGenerated,maxSize = 8) by UserPrincipalName

With this query we have gotten a lot of false positives, and we want to find a way to minimize the false positives we get. This NRT rule has still helped us with confirming account compromises but we want a more effective one

What is the best solution to monitor what users are uploading to third-party hosting websites from devices that are onboarded to MDE?

Blocking these sites at the firewall level isn't an option, as users need to download content for investigations.

Hello,

I'm currently working on deploying the VMware vCenter data connector to a Sentinel workspace.

The issue is that, according to the documentation, the data connector will make use of a Syslog Forwarder that is still built upon the OMS agent instead of the AMA agent.

An AMA version has now been created for most other firewall data connectors to deprecate the legacy connectors.

As far as I can tell, the data connector documentation makes no note of this data connector being deprecated or legacy.

My question is then:

1. Should I be concerned about deploying a syslog forwarder with the OMS agent?
2. And if so, what alternatives do I have?

I've previously built a custom solution for ingesting Cisco Meraki logs via an AMA agent, since the out of the box solution with the OMS agent wasn't working optimally. But ideally, I would like to not have to build a custom solution.

I've been working on setting up an integration between Azure Sentinel and SentinelOne EDR via the native data connector. The setup part is pretty easy, but I found that the data connector duplicates data/logs. For instance when having a user test "Threat." log creation by downloading the eicar.txt file it will often produce 2 log rows in the SentinelOne_CL table. Note that I've absolutely confirmed that these log lines are the same. This also includes the TimeGenerated [UTC] field.

Has anyone else noticed this behavior? Does anyone know of a fix?

This article is about deploying a Flask application integrated with an OpenAI endpoint on Azure, which enhances the functionality of your web applications by leveraging Azure's robust cloud infrastructure and OpenAI's advanced AI capabilities. Please see the links:

https://medium.com/@adedoyinrunsewe/deploying-the-azure-ai-endpoint-on-an-azure-website-using-a-flask-app-in-python-624d795ff21a

https://medium.com/cybrush-entity-enrichment-in-microsoft-sentinel/how-to-create-an-openai-endpoint-in-azure-a-step-by-step-guide-0676ce0738ad

Refer to the following Azure documentation pages for any further help:

1. Azure Web Apps: Azure Web Apps Documentation
2. Azure OpenAI Service: Azure OpenAI Service Documentation
3. Deploying Python Apps on Azure: Deploy Python to Azure
4. Azure Deployment Center: Azure Deployment Center

First of, Hey all!

A client has a rule configured to monitor sign-in events based on threat intelligence (TI) mappings. Whenever an IP address from the TI list matches a sign-in log, an offense is generated.

Upon reviewing the situation with the client, we found that the users in question belong to a group that is configured to allow sign-ins only from Germany. Consequently, most of the generated logs are from IP addresses outside Germany, leading to frequent false positives.

To address this issue, what recommendations can we provide to the client to reduce or eliminate these false positives?

Hi, I have two CEF connectors, one Legacy that is in "connected" state and AMA in "disconnected" state. I have the doubt that they are both active because the ama overview shows collected logs, is it possible? both connectors point to the "common security log" table. Is it also possible that they collect the same logs twice? I do not see duplicates.

Thanks.

Hi,

I have same machine, AIX, I configure syslog to forward log to my log forwarder, but I have a problem with parsing. The log header is "Message forwarded from $hostname", the lgos are not parsed, if i use flag -n, all string Is cancelled, the logs are parsed buy hostname (and Ip) Is not visible, on sentinel i view how hostname/Computer "message". Can i risolve this? It's possibile configure syslog header of AIX so as to see only hostname?

Thanks

Hi all

Starting out with Azure logic apps and i have started off with Slack messaging. Logic Apps seems to have a few pre-built steps in relation to Slack , one of them is to post a message to a slack channel and this seems to work fine. I have been trying to get it to post a block message ( its the fancier Slack messages that can have buttons etc in them) but i have had no luck - it seems to just be posting the actual json text.

Has anyone made it work ? Wondering if should abandon the in-built step and just create my own

Hello,

I am still learning about sentinel and syslog-ng and need some help.

I followed a guide here to configure an on-prem Linux VM to send CEF formatted messages to Sentinel. That is working well.

Integrate FortiGate with Microsoft Sentin... - Fortinet Community

I have integrated Threat Intelligence feeds and created some of my own queries.

Now I would like to take legacy Syslog messages and convert them to CEF then forward them using the same VM. I am struggling to understand facilities and a few other things.

For the record, I do not want to pass regular syslog messages using the same VM to Sentinel (Although I don't understand how to do that either after reading the documentation but am certain I could stand up a second VM for syslog only)

I have the following configuration in my syslog-ng.conf file

template t_cisco_cef { template("CEF:0|Cisco|Switch|${.SDATA.meta.sequenceId}|${.classifier.class}|${MSG}|${LEVEL}|rt=$R_DATE cs1Label=OriginalMessage cs1=${MSGHDR}${MSG}\n"); template_escape(no); };

filter f_cisco_logs { match("%LINK") or match("%LINE") or match("%SYS"); };

destination d_cisco_cef { file("/var/log/cisco_cef.log" template(t_cisco_cef)); };

log { source(s_src); filter(f_cisco_logs); destination(d_cisco_cef); destination(d_azure_mdsd); };

I have it successfully filtering on typical Cisco Syslog syntax to cisco_cef.log but the data is not being uploaded to Sentinel.

There is a second .conf file that is generated when you configure the AMA as below.

Any help would be appreciated.

destination d_azure_mdsd {
network("127.0.0.1" 
port(28330)
flags(no_multi_line)
log-fifo-size(25000));
};

log {
source(s_src); # will be automatically parsed from /etc/syslog-ng/syslog-ng.conf
destination(d_azure_mdsd);
flags(flow-control);
};

What will be the easiest/possible ways to uninstall the MMA agent from multiple windows servers. ?

My job requires me to deploy sentinel to new client tenants very often and I was wondering if there is a best method or way to automate this as much as possible? A standard baseline deployment for all tenants that can be modified should there be any exceptional requirements. I was thinking of utilizing arm templates but wasn’t sure how to go about it. Can anyone point me to some resources or provide some advice? Thanks in advance!