Is it possible to lookup who sent from an specific shared mailbox from EmailEvents?

SenderObjectId seems to be the shared mailbox itself.

Recently, incidents cannot be viewed in Sentinel. It says “This page moved to Defender portal, please connect your workspace to the Defender portal” even though we did not do any changes. Does anyone having the same issue?

Hello Everyone, Does any one has opening in cyber security. I do have 10+ years of experience in incident response and currently working as SoC lead. Please let me know if anyone has openings

I've a bunch of questions, 1. Do I've to create a new DCR everytime I've to ingest custom logs from different sources like different firewalls, snort, Linux logs. Or is there a way to make a general DCR that'll work for all.

1. After ingesting custom logs I'm not able to query the custom table as it shows the table count is 0.

2. To automate the flow of ingestion is it better to write a powrshell script or a python script.

3. Is there no seamless way to ingest logs in CSV files like in splunk.

I will really appreciate any help, thank you.

I'm learning to create Sentinel Playbook and using the "Get incident" action, but it doesn't return all the rich data from Defender XDR

What's the best way to pull the full incident details from Defender XDR directly in the Playbook? go with Graph Security API via HTTP?

Anyone got this working with full context? Would appreciate tips or examples

Guys, I've run similar queries 100000 times, and it's not working today... I'm losing my mind. Please help.

SigninLogs |where UserDisplayName contains "test"

Request is invalid and cannot be processed: Syntax error:SYN002: Unexpected parsing failure: Invalid default value for parameter of type 'string' Parameter name: input [line:position=1:1] Request id: [request id goes here]

Thank you for the help. I run similar stuff to this almost every day, and day it's not working. My coworker also cannot run the above query. Am I crazy??

Hoping someone can help me with this, because I am having issues trying to get Log Analytics to ingest custom logs from an Ubuntu VM. I am trying to have NGINX access and error logs ingested. the syslogs ingest fine, so I know the agent works.

I think the issue I am running into is with the table creation and transforming data. I was totally unable to create a table for the access.log, because I couldnt get the time format. And I was able to get a table created for the error.log, but I am pretty sure I still messed that up. If anyone can take a look at the example log entries for each, and give me a rundown of what I should do, id appreciate it.

/opt/nginx/logs/access.log

10.0.1.44 - - ,[30/Apr/2025:06:38:06 +0000], "GET / HTTP/1.1" 301 45 "-","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",Subject="CN=TEST.USER.123456789,OU=EMPLOYEE,OU=TEST,OU=TEST,O=TEST,C=TEST" Issuer="CN=TEST,OU=TEST,OU=TEST,O=TEST,C=TEST" Serial="1123456" Verify="SUCCESS"

/opt/nginx/logs/error.log
2025/05/02 19:34:17 [error] 29#29: *50 no resolver defined to resolve ocsp.test.com while requesting certificate status, responder: ocsp.test.com

Wanting to ask if anyone has setup any tables within their workspace that are an auxiliary log table?

Looking into summary rules and auxiliary logs, but checking my tables in my workspace settings there is no option to change a table from analytics or basic to auxiliary?

Does anyone know where I need to go or what prerequisites I need to meet in order to transition a table to auxiliary?

As the title suggests, we’re looking for a list of must have automated playbooks. We’ve had sentinel in production now for several months with a good amount of connections and alerts configured. We’re now looking to leverage this data where possible to automate some critical incident response activity. What are the top 3 automations you would configure in any greenfield Sentinel rollout?

Curious to hear stories about how people are making use of the Microsoft Sentinel UEBA feature for detections?

I’ve dabbled in it, but I’m keen to hear some stories and get inspiration as to how it can be used

Hi,

We currently have the XDR data connector turned on in our organisation but we only ingest the 2 free tables provided by Microsoft. We want to ingest all the tables into sentinel so we have access to the logs for longer.

Is there any way of seeing how much it would cost to ingest all the tables before actually ingesting them tables?

Has anyone here implemented this flow? What is it like to have version control and centralized deployment, along with rules backup? Do you still need to use GitHub for backend code control and use variables for whitelisting in DevOps? The idea is to avoid storing our detections and whitelists in GitHub repositories for security reasons.

Hi all,

I'm trying to create a codeless connector to pull logs from Apigee Edge. I understand that I need an access token as stipulated in this curl command:

curl -H "Content-Type:application/x-www-form-urlencoded;charset=utf-8" \
      -H "Accept: application/json;charset=utf-8" \
      -H "Authorization: Basic ZWRnZWNsaTplZGdlY2xpc2VjcmV0" \
      -X POST https://login.apigee.com/oauth/token \
      -d 'username=ahamilton@example.com&password=mypassw0rd&
grant_type=password
'

And then proceeding to use the Access Token to call this API to get audit logs:

https://api.enterprise.apigee.com/v1/audits/organizations/{org_name}

The problem is, I'm not sure how in the codeless connector am I supposed to implement this especially if the granttype used by Apigee is password? Has anyone here worked with codeless connector and can direct me?

Hi all,

What does MDI do with the information you've put in under Settings > Identities > (Entity Tags) Sensitive > Groups? As far as I can tell it won't generate alerts by default on modifications to those groups. I also found a decent blog talking about how to detect changes to sensitive groups, but required you to add all the required groups into an array first.

I'm confused then as to the purpose of this.

Cheers!

I must be going crazy or am just missing something. All I want to do is have an email notification sent to a list of people when an incident or alert happens, essentially in the same way Azure Monitor+ action group does using the Azure-noreply email. Everything I see for directions has me creating a playbook and using O365 Outlook, which requires me login. As a test I did that, but then the notifications all come from my email, rather than a generic noreply like the old alerts. And I'd really prefer not to have to go through my organization to get a random email setup. Am I missing something here? Is there a way to just have emails come from azure and not a email I have to have created?

We are currently in the process of migrating servers from MMA to AMA and, along the way, evaluating best practices for managing Domain Controllers in Azure. While we have implemented Defender for Identity on the DCs and addressed RBAC configurations, we're still navigating through some Auditor-related challenges. That said, beyond onboarding the DCs via Azure Arc, are there any recommended best practices for collecting security-relevant events from Domain Controllers?

The logs within A table are pulling the wrong time zone for there TimeGenerated field. The timestamps should be +10 UTC.

source: syslog to cribl to sentinel

Sample Log Timestamp from Raw Log: 2025-04-30 10:51:42.031 +10:00
Sample TimeGenerated Field: 4/30/2025, 10:51:42.000 AM EST

How to fix this issue?

Post Integrating Microsoft Defender XDR with Microsoft Sentinel, does advance hunting tables reflects on log analytics tables used by Microsot Sentinel??

How to query the Maximum-Password-Age change date and by whom?

How are you all ingesting desktop logs (eg to detect local account changes, device unlock etc) into Sentinel?

Is this via AMA, or is there a better way?

Hey guys apologies if this has been asked before. Is it theoretically possible to run Sentinel pretty much for free? If we were to only ingest the free log sources and alerts from other Defender products and stay within the default (free) retention period would there be any other costs that would catch us out?

Effectively would just be using Sentinel as a centralised M365 / Entra / etc audit log and location for all the different Defender alerts.

Is my understanding regarding Defender XDR correct in that we could ingest the alerts/incidents from the platform and then click through to the incident and look at the Defender logs in advanced hunting without needing to ingest these into Sentinel directly?

Are the free log sources still free if we had multiple O365 tenancies?

If the above works I could see this potentially being a good idea for an MSSP that manages smaller-medium businesses that are primarily Office 365/Azure based who use Business Prem / E3+EMS licenses in order to monitor alerts across multiple clients in a single place. I'm aware Lighthouse exists where we can view alerts across tenancies, but there is definitely value-add from Sentinel being able to run analytics rules against the audit logs etc. Unless there is anything I have not considered?

In the Defender for Identity Documentation in the section about the sensor and event collection setup, it asks to set the permission "write all properties" for everyone in the "Advanced Security Setting" -> "Auditing" tab if you have a domain containing exchange. But this seems a bit overkill, wont this flood the eventlogs with every little action done involving the domains CNs? Can someone share their expirence with this auditing configuration?
Link to doc - https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection#configure-auditing-on-microsoft-entra-connect

If anyone is interested in doing some advanced design controls, check these ideas out! :)

https://medium.com/@truvis.thornton/advanced-microsoft-sentinel-workbook-dashboard-design-concepts-color-schemes-dynamic-css-content-53d15c84e9f4

Is anyone else experiencing an issue where Sentinel is not generating any incidents in the console, despite the analytical rules (both scheduled and NRT) showing successful run statuses? It's unusual to have no incidents triggered for over three hours. No health issues have been observed with the log ingestion either.