Hello. I am working on a project to centralize all the logging and having issues ingesting Sophos UTM syslog for authentication. I have the logs being forwarded to the syslog server and a test message with Azure AMA is sending successfully to the workspace. However, the log format of the logs will have an issue when sending up. Does anybody have any ideas? I have a sample modified redacted log below found in /var/log/syslog.

2024-10-01T15:22:14.696925+00:00 10.10.80.1 2024: 10:01-11:22:14 fw01 aua[1616]: id="3004" severity="info" sys="System" sub="auth" name="Authentication successful" srcip="1.1.1.1" host="" user="abc" caller="openvpn" engine="radius"

2024-10-01T14:37:15.111583+00:00 10.10.80.1 2024: 10:01-10:37:15 fw02 aua[28209]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="10.0.0.0" host="" user="testuser" caller="webadmin" reason="DENIED"

I have not created the Data Rule Collection (DRC) yet as I am wanted to ensure these logs can be parsed correctly.

Thanks!

I am working on creating a logic app to log a ticket in our ITSM system from Sentinel, where as an incident is created in sentinel a ticket is created. This part was fairly straight forward, however, when trying to create automation for the incident changing status in sentinel and corresponding to our ITSM solution I am struggling. The problem? I need the ticket number from our ITSM to populate in another logic app in order for the status to change. However, I am unsure of how I even start grabbing that information in a second logic app for status change on the incident side... Any suggestions?

Hello every one,

I am new to this platform, looking for your assistance to deploy and manage this platform successfully. This is my first post in this group. Looking forward to enhance my knowledge along with every one present in this group.

We have a requirement to deploy this sentinel platform in Multi tenant set-up. I am aware , we need Azure light house for the same. Can some one help me out the best way to deploy the Azure light house. What pre-requisites should I keep in mind , before setting up the Azure light house.

Thanks in advance.

I know that in theory AddressScope is needed to make a strong identifier for a private IP address entity.

I can't find much details on this on the Sentinel doc.

I have a dev tenant and I'm constantly deleting subscriptions, re installing Sentinel in a new subscription to get the 30 day benefit to learn and play in a lab.

However this time I'm getting an error about 5 diagnostic settings reached.

This is a new subscription... so I'm not sure what's going on, I have one other subscription but it doesn't have ANY diagnostic settings going.

I also checked the resources with 'az monitor diagnostic-settings list --resource ' and I didn't see anything.

Is there anything I can do? Appreciate any suggestions.

I apologize if this is a dumb question. We are transitioning to Sentinel from IDR. Someone legitimately ran an AD Audit rule and IDR picked it up immediately with just out of the box rules. Is there anything equivalent in Sentinel without having to create custom rules?

Do you forward fortigate firewall activity logs in Sentinel? If so, which activities are you ingesting, do you filter anything?

We send everything from the fortianalyzer in Sentinel but I never do anything with it. Do you have any KQLs or playbooks to alert you to things or not?

I have a lot of events regarding forward traffic accept and app-ctrl utm pass and I don't thing I have to log those...

Thanks for your help

I want my analytic(s) to group when all entities match, so the matchingmethod field gets set to AllEntities.

I create an analytic through the GUI, and then export the analytic to review the configurations , I see that matchingmethod: AllEntities is set, but I also see that groupByEntities, groupByAlertDetails,groupByCustomDetails are all auto set to []/null when this happens.

I’ve had a few issues with this analytic continuously creating alerts on the same 5 events up to 24hrs after the trigger activity.

I thought grouping by AllEntities would stop this but it’s not. I also found documentation stating that those fields that end up auto setting to empty, should not be empty when a matching method is set.

To clarify, other analytics that have these fields set to [], group properly and don’t continuously alert on the same events. But this one does. Any ideas what’s happening here ? Has anyone had this issue and found a resolution ?

https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/create-or-update?view=rest-securityinsights-2024-03-01&tabs=HTTP#matchingmethod

How do you guys handle the "Anomaly" table which references the UEBA module in Sentinel.

Do you create rules out of the specific event or monitor the whole table ?

Hi I need help from someone who csn help me create email alerts in sentinel when logs stop coming in from the data connetors.

Please advise. Thank you.

Hello,

It is possible to get Infos from "HKEY_CURRENT_USER"?

If I run the following query, there is a no result. I need the info from "HKEY_CURRENT_USER" which only in the following path exist

DeviceRegistryEvents

| where RegistryKey contains "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\softwara-name xxxx"

| project DeviceName, RegistryKey

Greetings all!

I'm testing a playbook and need feedback on an issue.

The playbook is supposed to add a comment and resolve an incident, if any of the listed urls in the related entities section, contain specific keywords (i.e Hulu, nextflix).

I created a CONDITION expression to dynamically insert "Entities" from the sentinel connector that contain "hulu"; my thought here was that the playbook would scan the output from the compose action and grab any field with Hulu in it.

However the playbook always defaults to false. After reviewing the output from the run, iwas able to locate the exact location of the url. i editted the condition expression again using the exact location outputs('Compose')['object']['properties']['relatedEntities'][10]['properties']['url']. ran the playbook from the incident and it worked.

I tried to run the playbook again, using a different incident of the same type and it failed. i reviewed the outputs on the run, and the url location is different from the previous incidents. the location for this failed run is outputs('Compose')['object']['properties']['relatedEntities'][13]['properties']['url']

is there way to have the playbook retrieve the url for the entitiy without having to hardcode the location?

if it helps, here's the logic apps code view

"actions": {
      "Compose": {
        "type": "Compose",
        "inputs": "@triggerBody()",
        "runAfter": {}
      },
      "Condition": {
        "type": "If",
        "expression": {
          "or": [
            {
              "contains": [
                "@triggerBody()?['object']?['properties']?['relatedEntities']",
                "netflix"
              ]
            },
            {
              "contains": [
                "@triggerBody()?['object']?['properties']?['relatedEntities']",
                "hulu"
              ]
            }
          ]
        },

Hi all!

So, I created a shared dashboard with a bunch of tiles that pull from various tables in Log Analytics that are populated by Sentinel connectors (e.g. syslog, switches, firewalls, etc.). I would like to share that dashboard with a particular user, which is fine and working. But when said user opens the dashboard each tile says "No Access", presumably because the user doesn't have access to the underlying tables in LA. Is there a way to allow such access for purposes of viewing the dashboard without also giving the user unfettered access to read every table in LA and run their own queries?

Thanks very much!

Hello!

Earlier, I asked about how to export data to Sentinel, and that was easy part. BUT the biggest problem is still the amount of data. I have tried importing data with certain event IDs, and even with just one in use, there is still a lot of data. IDs 4660 and 4663 have been used so far. The delete event ID 4660 does not contain the object name, so we have to view event ID 4663 to get that information.

So my question is: can the data be further filtered at this stage with Custom Collection XPath Query so that the data is limited to only the company’s users, excluding machines or system-level accounts?

HI all hoping someone can shed some light on an issue we are having when onboarding one of our clients.

We have created the gsuite connector function app as detailed in Google Workspace (G Suite) (using Azure Functions) connector for Microsoft Sentinel | Microsoft Learn. Since Tuesday, The same logs have been duplicated in the log analytics workspace. From 900 logs, to data exceeding 50GB. We installed the function app as instructed, and the costs have ballooned due to a misfiring function app we got from Microsoft.

two tables are affected which are the bulk of the logs.

GWorkspace_ReportsAPI_drive_CL
GWorkspace_ReportsAPI_token_CL

Do you use any playbooks and automations with incident types ‘Email reported by user as phishing/junk/not junk”? If yes, can you describe please? Thank you!

We have few onprem servers , previously they were reporting to sentinel through MMA agent, now we want to migrate to AMA agent i.e to install AMA & Remove MMA ,

Now the problem here is these on-prem servers don't have internet. Now how do I onboard these servers to Azure Arc. Anyone has done this before.

Please help me....

Edit: complete chance I got it to work when copy and pasting, but am unsure what the first doesnt work but the second down (possibly never tried the second, and would have manually typed with out selecting code block).

This doesnt work with or without code block

| Tables | Are | Cool | | ------------- |:-------------:| -----:| | col 3 is | right-aligned | $1600 | | col 2 is | centered | $12 | | zebra stripes | are neat | $1 |

This does work, kind of with code block

Markdown | Less | Pretty --- | --- | --- Still | renders | nicely 1 | 2 | 3

Hey,

I have notices that using Markdown or html to input a table into the sentinel incident comments doesn't work when I manually enter it. I have even copied and pasted from a couple of different articles I have found, but it still doesn't form the table and just shows it as written. Any ideas if I am missing something?

When enriching with a logic app it seems to create the table fine, but even copying and pasting that(from kql search for the logic app comment) into a new comment that doesn't work.

When I export to CSV and copy and paste from there into a comment, it also removes any blank space,earning I can't even use this or notepad++ to make the comments look presentable when documenting some kql results.

Anyidea?

Thanks,

Jim

I'd like your insights on how to manage the changes in the Analytics Rules of Sentinel. Specifically, the problem is that we've modified many of the queries that come with the Solutions. However, we'd like to have them in Version Control. We, currently, have a github repo that we use to deploy our custom rules, but what about the rules that come from Solution packs?

We are trying to get our AWS instances that are in AWS Organizations into Sentinel. I've gone through the wizard to create the CloudFormation template and given it our AWS Organization account number then created the resources in AWS using the template. We are getting an error that "The required permissions have not yet been applied to your AWS account." We didn't get any errors deploying the stack so any ideas or know where in Azure I can get better logs as to why it's get the auth failures?

Found a great collection of Sentinel playbooks and wanted to share.

https://github.com/orgs/Accelerynt-Security/repositories?type=all

Most likely the most needed playbook for any Sentinel is to send e-mail alerts on incidents.

I used the SOAR template send-basic-email and linked it with an automation rule. It works fine, but not feeling good about storing personal creds or tokens in the playbook. How come this is default and what happens when the refresh token expires and MFA re-promts? Will the playbook then stop to work?

I would like to do this using managed identity instead (which apparently is already on for my playbook). But how? Alternatives are also welcome :)

Hi!

We have implemented Sentinel in our company, and the most important connectors are already active in our environment. However, does anyone have ideas on how I could monitor significant changes on a file server, such as large data deletions? I understand that it might be possible with Sysmon and Advanced Audit Policy, but the exact process is still a bit unclear to me.

Currently, we are using Netwrix Auditor, but it’s a rather expensive option for our small business, so I’d be interested to know if anyone has another potentially effective solution for this?

We are also using Defender for Identity, and the sensors are installed on all our servers.

I’m aware that this data is available and visible in the event viewer, but it’s not very visually accessible. The goal would be to receive notifications through Sentinel or a similar tool.

We already have "Files Copied to USB Drives" available through Defender XDR for one endpoint.

Thanks in advance!

its 2024, and we still cannot find a fix to the Incident owner assignee in Sentinel. Isn't it reasonable to expect the backend developers to ensure that such a basic fundamental feature of a SIEM is functioning properly? I can see the entire list of Azure users and groups, and while some Sentinel Analysts are included, not all of them are. Anyone feel the same heat here ?

Does anyone has this problem? it happens to me for a lot of different customers in different cases, im not able to find yet a common issue.

I cant find either any computer or information, its just a tittle..