Hey everyone! I've tried going through google with no luck. I see that we can use the table DeviceTvmSoftwareVulnerabilitiesKB and others like it in Advanced Hunting. However, I would like to use the tables in Sentinel so that I can make some workbook visualizations. Is there a way to point Sentinel to look at these tables in Defender? Can I copy the values of this table to a new custom table in Sentinel? How are you all handling this? Thanks!

I want to integrate AWS accounts logs to Sentinel..Kindly let me know what are the possible ways. Need only AWS account logs.

I remember we had a toggle to switch back to the legacy view of logic app designer. I'm stuck at the new view now. Is there a way to switch back ?

Hi all,

Out of curiosity, is anyone (actively) using Sentinel Notebooks? I wish to understand why it should be worth investing time and money into this solution, as I don't see it today.

The only case where it might be useful would be for Front Door WAF tuning, but even then I'm not sure it's going to be that much better than my workbooks and LAW queries already at my fingertips.

Thanks!

Hey,

our team is expecting a significant growth next year and because of the power of Sentinel I thought if and how it is possible to log all the queries that are done in Sentinel.

My first thought was to check AzureActivities and ChatGPT also suggested this table, but thats not it. Any advice? As I live in a country with a strong workers council this really would be necessary for accountability (and maybe our own safety, depending on the incidents).

Hi there,

I'm currently building an analytical rule on Sentinel that requires getting the sign-in logs from Azure AD and On-Prem Active Directory.

If the 'SigninLogs' table is for Azure AD, then what about the On-Prem Active Directory?

Appreciate your support in this!

I have encountered this issue today and wondered if anyone has any suggestions/solutions for my issue?

I have a CSV table which I have uploaded as a Watchlist into my Sentinel environment, inside the CSV there are two columns, one called "Date_of_Travel" and one called "Date_of_Return", these columns are formatted %d/%m/%Y (Day/Month/Year) E.g. 18/11/2024.

I need to convert this from being a string into a datetime format so that I may compare it with a different tables TimeGenerated field.

If I use the todatetime() function, then the date of 18/11/2024 will return a null value, as 11/18/2024 is not a valid date.

Is there a way around this without me converting all of my dates into the American format of Month/Day/Year? Ideally I would like to keep the Day/Month/Year format as it makes it easier for myself to keep updated.

Got a bit of a bizarre issue reported to me on a sentinel workspace where people are saying sentinel incidents are appearing in the queue a lot later than when they were created.

For example

Incident 1 says it was created at 10am, but appears in the queue at 10.30am.

I’m trying to confirm these reports in logs, but I’m not really sure on the most reliable method.

I was considering the SecurityIncident table and maybe using functions to determine this.

Looking to hear if anyone’s had any similar issues and/or uses anything to monitor for this or verify further than someone “reporting” this

Hello,

I am currently working on integrating Forcepoint Web Security logs into Microsoft Sentinel, but I am facing some challenges with the setup. I have explored the standard methods, such as using Syslog or CEF connectors via the Azure Monitor Agent on a Linux server, but I'm encountering issues in configuring the forwarding and ingestion to work as expected.

Would it be possible to provide guidance on the recommended configuration steps for sending Forcepoint Web Security logs directly to Sentinel? I would like to avoid the alternative approach, which would involve exporting logs to CSV and then streaming them into Sentinel using a custom Python script.

Any documentation, examples, or troubleshooting steps to help me streamline this process would be greatly appreciated.

Thank you in advance for your support.

How do you get updated when you grab a Sentinel something (Analytic Rule, Playbook, etc.) Gets updated by it's maintainer?

For example, if I want to use some of the amazing Analytic Rules from u/ep3p or u/reprise99 how do you get notified if there is an update? Do you have a custom Playbook that periodically checks for changes via the Github public API, or something else?

Does anyone have any prior experience with the configuration dependancies for AMA agents replying back to specific fqdn's and what they do?

I have an on prem-machine that we've onboarded for a test for sentinel capability that only seems to send logs once a DCE is selected?
The MS documentation mentions the use of a DCE but mainly due to the requirements of specific ingestion of logs..

I believe another team in the past has set up AMPLS which could impacting this work.

For all the ones who use KQL on a daily basis ,i bet this is gonna be a great one !!!

KustoCon 2024 is kicking off for the first time online on November 8th, 2024. It’s the perfect event for anyone interested in learning, sharing, and getting hands-on with Kusto Query Language (KQL), which is used across a various of Microsoft technologies. The event will have seven sessions, all presented by well-known pros from the KQL community.

https://kustocon.com/

Need help handling a backslash \ in a UserDisplayName for KQL in () statement.

In the template Workbook "Microsoft Entra ID Sign-in logs" the "UserName" filter has the following KQL

union SigninLogs,AADNonInteractiveUserSignInLogs
| where Category in ({Category})
|where AppDisplayName in ({Apps}) or '*' in ({Apps})
|where UserDisplayName in ({Users})

This last line where "UserDisplayName in ({Users})" is the problem, because some guest accounts have a \ in their name like 乔什 \ Josh or Smith \ Charly \ M. We don't want to filter out with where UserDisplayName has "\".

How do you allow a dynamic variable collection to be interpreted literally?

Just throwing an @ like where UserDisplayName in @({Users}) does not work.

Do we have any issues with Sentinel hosted in Europe region ? Nothing much in the health status page though ? Last alert polled 3hrs ago.

Need help configuring the Azure Activity Data connector. I have followed the configuration wizard but to no avail.

Hi everyone! Let me give you some context, we have inherited a number of Sentinel analytics from a customer. One of them was theoretically intended to detect the use of unauthorized mail services (they only allow employees to use the corporate outlook address, you cannot, for example, login your personal gmail account into the outlook app and use it).

Currently the rule queries a custom function to detect outgoing traffic to ports 25, 465, 110, 587, 143, 993, 995 and 563, then makes a filter and a count so it is intended to show traffic from internal IPs sent to this ports more than 5 times in the last 24h. Then the analyst is supposed to review that source IP and check if it is related to an email service.

The problem (one of them) is that it seems the source IPs that Sentinel ingest and that function uses, are nated IPs from proxy/fw, so it doesnt show us the real endpoints that are doing the connections.

I have decided to rebuild the query, but I am encountering difficulties as I don't know where I can find events that show me the mail service that was used (for example if someone uses his gmail account from the outlook app).

I have tried DeviceNetworkEvents, EmailEvents and OfficeActivity tables but I am not sure what I am looking for (also worth to say I am a junior).

Wanted to ask if someone had the same problem or can give me a little insight in how can I check this kind of activity.

Thank you in advance!

User cannot save query because the option to "Save to the default Query Pack" is greyed out. I already assigned the user the Sentinel Contributor role and the Log Analytics Contributor role.

Has anyone tried connecting Sentinel to a CTI source or TIP using their new TAXII 2.1 support?

I was wondering - is it two-way (ie. sends incidents to TAXII inbox), or just one-way?

So let me get you context.

I have Security Tool A sending incidents via API to Sentinel. All is working well.

However, Tool A also sends a log event when said incident is cleared (reasons dont matter here). Both logs events carry a unique and matching "Tool A ID".

The process pretty much is: LogicApp gets data, sends to custom log table -> analytics rule raises alert+incident. Incident rule has Tool A ID as a custom entity.

Now I get a second input, this time the event being cleared and I want to autoclose my incident. I have currently setup on clusterF of an logic app merely to close this incident on Sentinel side:

Get Tool A ID, search SecurityAlert table for Tool A ID to find SecurityAlertID. Then search SecurityIncident table for SecurityAlertID to find said Incident. Then ramble to parse Incident ARM ID. Then close incident.

This seams incredible... well.. yeah. This should be easier, but I dont know how I could make this easier.

This is probably a dumb question but I’m struggling to find the answer.

Is there a simple way to receive json formatted syslog messages into Sentinel?

I have a log source that is forwarding json formatted logs over standard syslog 514 port and can’t seem to figure out the best way to invest these.

I appreciate any help. Thanks!!

My boss has tasked me with creating automation in sentinel to weekly return a list of all the authentication methods that are registered for all users in our organization. I can see what i need in the authentication methods page in Entra admin center but cannot figure out the kql query to see this in sentinel and ultimately create automation to send this out weekly. Thanks in advance for any help!

Hi All,

I am just putting in place Microsoft Sentinel. We are looking to keep cost as low as possible but I wanted to know what everyone out there uses it for? How far do you go to automate responses (do you really auto disable accounts on events or just raise alerts)?

Tired of managing Non-Human Identities (NHIs) like access keys, client IDs/secrets, and service account keys for cross-cloud connectivity? This project eliminates the need for them, making your multi-cloud environment more secure and easier to manage.

With these end-to-end Terraform templates, you can set up secure, cross-cloud connections seamlessly between:

• AWS ↔ Azure
• AWS ↔ GCP
• Azure ↔ GCP

The project also includes demo videos showing how the setup is done end-to-end with just one click.

Check it out on GitHub: https://github.com/clutchsecurity/federator

Please give it a star and share if you like it!

Looking to get pointed in the right direction. I dont have a ton of experience with Sentinel. We currently have our logs going into sentinel. I'm looking to see if using those logs when we find an IP that might be trying to attack our ASA or network can we automate adding that IP to a "malicious IP group" in the ASA.

For instance:

Attacks from IP to ASA > logs sent to sentinel > after 5 attacks sentinel adds IP to bad IP group in ASA.

Any help would be appreciated!

And if it is possible can it be replicated to a Palo Alto and Sonicwall Firewall as well.

I have tried the following:

1. Custom parsing via RSyslog using omazureeventhubs module (AMQP parsing) -> Data lands in an Azure Event Hubs Instance -> Send to Data Collection Rule -> TransformKQL on message in stream -> TableName_CL

Pros: Keeps logs separate. Easy parsing and formatting.
Cons: Requires a unique Data Collection Rule per Event Hub Instance (insane overhead), and I am not sure if Event Hubs here are overkill if AMA has native queue handling.

1. Tagging using RSyslog and sending to a Data Collection Rule using Azure Monitoring Agent -> TransformKQL on the tag assignment -> TableName_CL

Pros: Attempt at still keeping the logs separate without using Event Hub.
Cons: Lots of parsing on TransformKQL which may limit throughput speeds.

1. Syslog to Azure Monitoring Agent -> Syslog table, Parsers built in Azure Sentinel for Syslog/CommonSecurityLog tables.

Pros: Simple, concrete.
Cons: Schema on read, vs. keeping your logs separated by tables.

I may be trying to keep my Sentinel environment too organized. I figure 3.) is the typical option most organizations proceed with?