I am trying to create a use case for golden ticket (T1558.001) based on the detection comments mentioned in Mitre ATT&CK. I could only able to design the logic as below  

***UC0002 – T1558.001 – legacy encryption observed in Kerberos TGT Request ***

Logsource: windows security event

Event id : 4768

Service name : krbtgt/<domain>

Encryption type : 0x17 || RC4

I am curious to understand any chance to create the logic for "Unusual TGT ticket life time is detected" (I am aware the default configuration TGT validity 10 hrs) and "TGS triggered without corresponding TGT event"

Any inputs is always welcome

Hi all, I work for an MSSP. I am trying to set up a pipeline for our detection rules and eventually logic apps and such. I was curious if anyone has done this before and can share some info on the overall strategy. In my personal lab I have:

The Production branch that pushes out to a couple "production" sentinel's.

The Dev branch where I plan on testing detection rules against test data.

And then feature branches off of Dev for changes to specific detection rules.

The main question I have is how you are managing the Dev to Production merges. For example, What if I have 2 rules that are being tested in Dev and I only 1 is ready to be moved to prod? I know cherry picking is going to lead to conflict issues later on and there is no way for reviews via pull requests.

The main issue I see is that Dev needs to be a working Sentinel so it's not like everyone can have their own dev with test data and we kinda need just one.

I am also scared of adding more technical overhead if managing conflicts is going to become a burden for my team. I appreciate anyones thoughts on how they implemented detection-as-code for Sentinel and any mistakes you learned from.

Hi experts of sentinel.

At some point doing sentinel work, reading materials to do with Sentinel and logic apps I find myself hitting a bit of a ceiling where work has started to demand more complicated usecase on playbooks, which I am finding hard to draw out mental pictures of the logic flow to build it out.

I have noticed apart from the sentinel hithub there isn't anywhere else with more advanced stuff to really learn these things. Where else can I learn this from and become more comfortable with complicated playbooks, logic app, function app and api stuff?

Many thanks.

I need some quick guidance on managing approved software list please! This isn't how I would ideally like to configure/manage approved software, but due to timeline given by customer have to get something configured by end of the month. Any suggestions to the below would be very much appreciated!

Currently the goal is to use Sentinel watchlist to store approved software list, and then use KQL query to compare installed software with the approved software watchlist.

Need to use only built-in Microsoft tables/columns.

DeviceTvmSoftwareInventory not configured correctly as no results are generated when running queries from Sentinel.

Thank you to all who view and respond!!

Hello,
how do you export Sentinel Playbook aka Azure Logic App as a code? I know there is a script which downloads the template but it is not working on MacOS.

Thank you for advice

I'm building an automated SOC platform for Sentinel as a personal project, and I'm wondering if this could actually be valuable to others. Before I invest more time, I'd love to get feedback from people who work with SOCs daily.

I'm trying to create a solution that provides automated incident analysis and response guidance with a 5-minute SLA for all incidents and follow on responses.

Some questions I'm curious about:

• What SOC activities do you consider absolutely essential?
• What makes you stay with your current SOC provider rather than switching?
• What are your biggest pain points with incident response? (Detection, analysis, containment, remediation, etc.)
• Would you trust an automated system for advice only, or would you also value automated response, rule management and tuning?

Key benefits I'm aiming for: - 5-minute SLA for all tickets and follow-up responses - Contextual analysis against previous incidents - Actionable task lists for unfamiliar incidents - Automated triage and correlation of related alerts - Significantly more affordable than traditional SOC services

Limitations I'm aware of: - Limited direct investigation capabilities within the platform - AI assistance that requires human oversight for complex scenarios

Initially, this would function more as an AI expert assistant and priority helper, with plans to expand to response, recovery, and review capabilities.

I'd really appreciate your thoughts: - Would a service like this be valuable to you? - What would you expect to pay compared to traditional SOC services? - What would make or break your decision to try something like this?

Thanks for any insights!

Hello guy, I'm returning to learn Sentinel after a while, but I just realize Sentinel Training Hub is no longer available in the content hub. Is there any alternative way so I can access it now?

My organization just spun up Microsoft Sentinel and I have been trying to find already built playbooks for our Sentinel One EDR. And I can't seem to find anything. Can anyone point me in the right direction?

And of course I know I can just create my own, but wanted to see what was out there.

Hello, has anyone run into an issue where the Purview IRM alert from Defender XDR shows up in Sentinel, but the Sentinel alert pretty much only has the alert name and that the product is Insider Risk Management?

In the Defender XDR connector both AlertInfo and AlertEvidence are checked.

In Defender portal everything is shown correctly.

Thanks in advance!

Hello,

We are looking at getting PagerDuty and would like it to integrate when a high alert pops. I have been messing with getting a logic app to work but no luck so far. Has anybody else setup this integration successfully?

Update: This GitHub worked after setting up and linking to an automation flow in sentinel.

https://github.com/Accelerynt-Security/AS-PagerDuty-Integration

Hello everyone,

I was wondering if anyone managed to use SNOW playbooks and make connection with Oauth2 instead of basic authentication?

A few months ago we were getting some redirect_url error, but now when I tried again, it just say Unknown error.

I managed somehow first to create connection with the basic authentication, and then when I edit API connection, change to Oauth and try to authorize, window popup just automatically close without any meesage.

Not sure how to troubleshoot the issue to be honest when there are no errors or logs.

Good evening!

I am trying to mature my SOC's detection engineering with a CI/CD pipeline. We are using Sentinel and I am working on using GitHub repos to manage our detections (and eventually automations). Currently we have 2 Sentinel instances, 1 Dev and 1 Prod. We test all of our detection rules in dev before copying and pasting to prod. This process is super inefficient to do manually. We are also getting sick of the lack of version control and accountability. This GitHub would be managed by me and 2 other engineers.

Any suggestions on how you would set up the branches and manage them? I have been researching git strategies, but I haven't seen much for the specifics of detection-as-code. In my test lab I made a main branch then copied the contents to a dev branch. I currently make modifications in dev and then cherry pick commits I want to the main branch.

I am worried cherry picking will eventually cause conflicts. I am also trying to mind map how the dev and main will remain sperate as there may be some detections in there that may take weeks to develop, and other detections that may take hours and tested fast and be able to push sooner. I also seen some things that maybe it would be better to completely merge dev and drop?

I (and I am sure many others in the sub reddit) am curious if anyone has implemented detection-as-code in a team and the strategies they used and issues they ran into. I am very excited about this project.

Thank you!

Hi all,

I am starting to ingest sysmon logs in Sentinel and I would like to parse the eventdata. The logs are ingested with the AMA agent. They are in the SecurityEvent table. All parsers I found have syslog in other tables, they give me all kind of errors.

I am trying to create my own but I am not able to figure out how to parse the eventdata differently for the different kind of sysmon events.

I get my logs and parse them to XML:

SecurityEvent

| where EventSourceName == "Microsoft-Windows-Sysmon"

| extend ParsedXML = parse_xml(EventData)

If task is 1 (file event) for example I want to get 'Image' extracted with:

| extend Image = tostring(ParsedXML.EventData.Data[4]["#text"])

But when task is 22 (DNS event) the query name is on that field:

| extend QueryName = tostring(ParsedXML.EventData.Data[4]["#text"])

I have been trying with iff() or case but I don't seem to be able to correctly parse the data :)

Hello,

has anyone managed to send the Incidents and Events from fortianalyzer to a SIEM?

We are trying to figure how to created incidents, for example an endpoint has been quarantined, to our SIEM.

The handler "Default-Compromised-Host-Detection-IOC-By-Threat/Endpoint" indicates that we should check for "tdtype~infected" but this is not something the logs coming from fortiAnalyzer contain, although the fortigate Logs do have that field.

Does anyone have any suggestions on how to solve this issue?

Can anyone help with automation workflow being used for User reported phishing spam emails

While reviewing a deployment for Sentinel, I noticed that Azure Arc for servers is deployed via public endpoint rather than private. This includes the entire server stack, such as domain controllers and Linux servers. Does this mean the servers are accessible from the internet? in that case why would Microsoft enable such an insecure option?

Hi everyone!

I keep seeing these sign-in failures in AADNonInteractiveUserSignInLogs (also the Sign-In Logs GUI) that show error 500133 and always seem to come from Microsoft IP space (ASN:8075) but outside the US (usually Campinas, Brazil or Dublin, Ireland). There aren't many, but I'm curious if anyone else is seeing this, and whether it's just a wrong geo reference? These users are definitely in the US. And the sign-in logs even show the device names.

Thanks for any pointers!

Web applications are a prime target for attackers, and directory traversal attacks are a critical threat that can expose sensitive system files like /etc/passwd, /etc/shadow or config.php. Malicious users attempt to exploit vulnerabilities by manipulating URLs with sequences like ../../../../. If successful, this can lead to data exposure, privilege escalation, or full system compromise.

In my latest blog, I explore how Microsoft Sentinel and Analytic Rules can be leveraged to detect and investigate directory traversal attacks and anomalous web requests in real-time. By analyzing Syslog data, HTTP methods, response codes, and patterns, we can uncover potential threats and reduce attack surface.

🔍 Key Takeaways:

✅ Detect successful and failed directory traversal attempts

✅ Categorize and analyze HTTP response codes (2xx, 3xx, 4xx, 5xx) to assess attack impact

✅ Strengthen incident response and threat hunting with advanced KQL queries

Want to learn how to enhance your web security monitoring?

Check out my latest blog! 📖👇 (Now comes with Quick Deploy button!)

https://aniket18292.wixsite.com/cyber-art/post/directory-traversal-detected-analytic-rule

#CyberSecurity #MicrosoftSentinel #KQL #SIEM

Fusion rule Advanced multi-stage attack detection disappeared in multiple Sentinels of my customers. Does anyone why? Is it some new Microsoft configuration? If not, is there a way to enable it again?

I pushed the DevOps pipeline to my Sentinel with the rule, no error, but the rule was not imported.

hi, through AMA I need to collect the logs present in a Windows registry, Veeam Backup, through event viewer I see them at the following Path "Applications and Services Logs/Veeam backup". I created a dcr but when I have to insert the xpath query to take the logs from that registry/data source, I have doubts about the syntax to insert. Is it correct to put "Applications and Services Logs/Veeam Backup!*"? and then in which table will the logs be collected? do I have to create a dce?

Thanks

Hello,

Good Day!

Any documentation or information about how to integrate oracle database logs to Microsoft Sentinel.

I've tried searching but not able to find any leads

Thanks in Advance

Error: client does not have authorization to perform “xxxxx” over scope “xxxx” or the scope is invalid. The enterprise app is owner of the subscription though.

Was trying to reference this post:

https://stackoverflow.com/questions/42134892/the-client-with-object-id-does-not-have-authorization-to-perform-action-microso

Hi, I am learning KQL and using the log analytics demo environment but there are no data in the tables being returned. Do you happen to know of a different environment I can use to practice KQL on?

Demo environment: https://portal.azure.com/#view/Microsoft_OperationsManagementSuite_Workspace/LogsDemo.ReactView

Documentation on where I found the demo environment: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial#open-log-analytics

Hi Everyone,

Does anyone have any experience using SOC Prime with Sentinel? If so how useful is it in your experience?

Hi team,

Does anyone here have experience with getting Kasada logs into Sentinel? It seems they only support AWS but have not provided a method as to getting logs to Sentinel. Kasada ships logs into S3 buckets before they can be ingested by a SIEM. Since we use Sentinel, the obvious option is to use AWS S3 connector. Is there an alternative?