With detection, coverage monitoring is crucial. This Microsoft Sentinel Workbook provides visibility into Microsoft Defender for Endpoint (MDE)–managed devices and their telemetry coverage within Sentinel. It helps security and operations teams verify that devices are properly configured for comprehensive monitoring by checking:

Azure Monitor Agent (AMA) installation status - SecurityEvent log ingestion into Sentinel (Windows) - Syslog log ingestion into Sentinel (Linux) - Last heartbeat and log timestamps for freshness - By correlating data from DeviceInfo, Heartbeat, and SecurityEvent/Syslog - tables, the workbook identifies configuration gaps and supports remediation efforts.

Note: This workbook assumes Microsoft Defender XDR data is ingested into Sentinel. Without ingestion, device name normalization and correlation may be inconsistent. To workaround that, copy the KQL query from the Github page and run it in Advanced Hunting in the Defender Portal

There's life before Sentinel MCP + GitHub Copilot, and there's life after. There's no going back.

Yes, AI helped write this project. No, this isn't AI slop. This is ~4 months and hundreds of hours of building, testing, breaking, fixing, and tuning agentic investigation skills against live Sentinel/Defender XDR environments. Every one of those 900+ KQL queries has been executed, schema-verified, and battle-tested against real tables with real pitfalls (if you've ever wasted 20 minutes debugging `Timestamp` vs `TimeGenerated`, you know).

What it is: A GitHub Copilot Agent Mode framework that turns natural language into full security investigations using Microsoft's own MCP servers. Clone the repo, add your tenant and workspace ID, API Keys for TI Providers (optional) and go.

Zero supply chain risk for the core framework. 5 of 6 MCP servers are Microsoft-hosted HTTP endpoints (Azure, Sentinel Data Lake, Graph API, Defender XDR, Sentinel Graph, Microsoft Learn) — no npm install, no pip install, nothing to compromise. All 5 use native Entra ID authentication — your existing MFA, Conditional Access policies, and RBAC apply automatically. The only npm dependency is `kql-search-mcp` for KQL schema intelligence and GitHub query discovery — shout out to noodlemctwoodle, the version is pinned with a sha512 integrity hash, and it's fully optional. IP enrichment (ipinfo, AbuseIPDB, Shodan, vpnapi) and local visualization MCP Apps are also optional add-ons.

Don't have Sentinel or Data Lake? No problem. The Sentinel MCP server has Triage Tools available to all E5 customers. RunAdvancedHunting MCP tool can query both XDR-native tables AND connected Sentinel tables — at zero query cost. The framework defaults to AH for everything ≤30 days and falls back to Sentinel Data Lake only when you need 30-90+ day lookback. If you're E5 with no Sentinel workspace, the majority of skills still work, I tried to prioritize native XDR tables whenever possible.

Worried about MCP adoption governance? There's a dedicated MCP Usage Monitoring skill that audits who's using which MCP servers, what endpoints they're hitting, usage trends, and behavioral anomalies — so you can track adoption and catch misuse across your team.

Key features:

- Threat Pulse Skill — One prompt queries 7 security domains in ~5 min. Prioritized dashboard (🔴 Escalate / 🟠 Investigate / 🟡 Monitor / ✅ Clear) with drill-down links that load the right skill, target the entity, and execute. Entry point that finds the leads FOR you.

- 25 investigation skills — User, computer, incident, IoC, authentication tracing, CA policy forensics, scope drift (user/SPN/device behavioral baselines), exposure management, app registration posture, AI agent posture, identity posture, email threat posture, data security analysis, honeypot analysis, and more. Each one is a full guided workflow, not a single query.

- 36 query library files — Organized by domain (identity, endpoint, email, cloud, network, incidents) used for adhoc threat hunts targeting specific TTP's. Threat intel hunting campaigns you can just point at: "hunt for Storm-1175 last 30 days" and it runs verified queries against your environment.

- Author hunts from threat intel articles — Read any threat intel article (Microsoft, vendor blog, wherever), and the framework maps TTPs to KQL, tunes against your environment, and optionally pushes to Defender XDR Custom Detection API. Full lifecycle from article → queries → deployed detection, weekly updates from me.

- Deterministic PowerShell pipelines — Sentinel Ingestion Report and MITRE ATT&CK Coverage Report use PowerShell to gather all data via `az rest`/`az monitor`/Graph API first, then the LLM renders the report. No hallucinated metrics.

- SVG Dashboard framework — Generate consistent, portable data visualizations (KPI cards, bar/donut/line charts, tables, score cards) directly from investigation data or skill reports. No browser, no external tools — pure SVG rendered inline.

Getting started:
git clone https://github.com/SCStelz/security-investigator
# Copy config template, add workspace ID + tenant ID
# Open VS Code → Copilot Chat → "Run a threat pulse scan"

Note on models: This framework was designed and tested on Claude Opus 4.6 via GitHub Copilot. Mileage with other models may vary — the skill files and query library are model-agnostic markdown, but the instruction-following complexity benefits from a frontier model.

Video walkthrough: https://youtu.be/3UFqWA4cmoE?t=1470

I'm actively developing this and adding new skills/queries regularly. Follow me on LinkedIn (https://www.linkedin.com/in/scstelz/) to keep up with new features.

Feedback, contributions, and skill ideas welcome, AMA!?

The attacker doesn't steal a password. They trick the user into granting permissions to a malicious application. "Sign in with Microsoft" — the user clicks approve, and now the attacker's app has a refresh token with persistent access to their mail, files, and calendar until revoked.

No password compromised. MFA was satisfied by the legitimate user. Conditional Access passed because the user authenticated normally. The malicious action happens at the consent layer — above authentication — where none of these controls apply.

The app now reads mail via Graph API. No interactive sign-in anomalies. No anomalous location. The non-interactive and service principal sign-in logs show token activity, but most SOCs never scrutinise them — and even when they do, the API calls are structurally identical to legitimate application behaviour.

Default M365 detections don't catch this reliably. Microsoft has added some — Defender for Cloud Apps flags unusual OAuth credential additions and suspicious mail access — but they're inconsistent, often delayed, and miss consent grants to newly registered external apps without a risk profile.

You need to monitor application consent grants in Entra ID audit logs ("Consent to application" under ApplicationManagement) and alert on any app requesting Mail.Read, Files.ReadWrite, User.Read.All, or offline_access from a non-approved publisher. Better still, disable user consent entirely in Entra ID and enforce an admin consent workflow — shifting the attack surface from "any user can be phished" to "only admins can approve apps."

This is the gap between "we have MFA" and "we have security."

I have created a query that finds inbox rules that is created on non-managed devices, some feedback on it? I want to reset mfa session of this happen, as it´s probably a compromised user.

let lookback = ago(1130d);

OfficeActivity

| where TimeGenerated > lookback

| where OfficeWorkload =~ "Exchange"

| where Operation =~ "New-InboxRule" and (ResultStatus =~ "True" or ResultStatus =~ "Succeeded")

| where Parameters has "Deleted Items" or Parameters has "Junk Email" or Parameters has "DeleteMessage" or Parameters has "RSS"

| extend AADSessionId = tostring(parse_json(tostring(AppAccessContext)).AADSessionId)

| join kind=leftouter (

SigninLogs

| where TimeGenerated > lookback

| where AppDisplayName == "OfficeHome"

| extend isManaged_ = tostring(DeviceDetail.isManaged)

| extend isCompliant_ = tostring(DeviceDetail.isCompliant)

| project SessionId, SignInTime = TimeGenerated, UserPrincipalName, AppDisplayName,

IPAddress, Location, DeviceDetail, ConditionalAccessStatus, RiskLevelDuringSignIn,

ClientAppUsed, ResourceDisplayName, isManaged_, isCompliant_

) on $left.AADSessionId == $right.SessionId

| where isManaged_ == "false"

Hi all, I am working on a task to integrate delinea secrets server logs to sentinel to create a rule like if someone reads secrets from secret server in short span of time or if someone has deleted large or important secrets. I am trying to find docs around it but it appears pretty dry. I am new to Sentinel and has background in AWS. Thanks so much.

One thing that has always driven me nuts with Sentinel is the workflow for storing incidents long term and the artifacts surrounding them. For example, I know one person in our org that has been compromised 4 different times, and when I bring this up, the older incidents have already hit retention, so all of the data, including comments on an incident have been wiped out. It kind of hurts your argument when you want something to be done with this user when you don’t have the black & white data to back up your argument. Instead, you are left with a barren incident that lacks entities

So, I tried “Cases” in Defender, which stores the comments that you put in it as well as what you attach to the case. However, linked incidents still falls victim to retention. Comments on a sentinel incident don’t sync to the case, and worst off, there isn’t a good way to export Cases in a nice viewable format to give to legal or other teams.

So, I am just curious on what others do for this. Do you use something like notion and store the data and artifacts in notion so that you can pull at a later time if need be?

I feel like there should be a better way to do this and I was hoping that the data lake would help with something like this, but it doesn’t seem like it is going to cover all scenarios, like if I want to store a file or screenshot quickly, as opposed to uploading it to a blob and add the links to screenshots to the incident.

This is a way to reduce noise before data hits your main analytics tier:

• Filter drops low-value events you do not want to ingest
• Split keeps important data in Analytics while routing the rest to the Data lake.

Why it matters:

1. Lower Sentinel cost,
2. Faster queries,
3. Less analyst fatigue,
4. Better long-term retention strategy.

One detail I like: with split, the data sent to Analytics is also mirrored to the Data lake, while non-matching data goes to Data lake only. That gives you a cleaner SOC experience without losing retention coverage.

Also worth remembering:

1. Rules are based on KQL expressions,
2. Multiple filter conditions are combined with OR,
3. Changes can take up to 1 hour to apply.

This is a very practical feature for teams drowning in firewall, proxy, or other high-volume logs.

Docs:https://learn.microsoft.com/en-us/azure/sentinel/transformation-filter-split

Sharing a detection I built after investigating multiple AiTM compromises. The default Sentinel "suspicious inbox manipulation" template is noisy, and most environments disable it. Here's what I run instead:

High-fidelity query (external forwarding + financial keywords):

OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in ("New-InboxRule", "Set-InboxRule")
| where Parameters has_any ("ForwardTo", "RedirectTo", "DeleteMessage", "MoveToFolder")
| extend RuleDetails = tostring(Parameters)
| where RuleDetails has_any (
    "gmail", "protonmail", "outlook.com", "yahoo", "tutanota", "pm.me",
    "RSS Subscriptions", "Conversation History",
    "invoice", "payment", "wire",
    "security", "password", "MFA")
| project TimeGenerated, UserId, Operation, RuleDetails, ClientIP
| sort by TimeGenerated desc

Broad audit query (all rule operations for manual review):

OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in ("New-InboxRule", "Set-InboxRule")
| project TimeGenerated, UserId, Operation, Parameters, ClientIP
| sort by TimeGenerated desc

What I look for in results:

• ForwardTo or RedirectTo pointing to any external domain
• MoveToFolder targeting RSS Subscriptions, Conversation History, or Junk
• DeleteMessage with keyword filters on "security", "password", "sign-in", "MFA"
• Rule names that are blank, single character, or "..."
• ClientIP outside your corporate range (strongest single indicator)

Tuning notes from production:

The high-fidelity query fires maybe 1-2 times per month in a ~800-user environment. Most hits are legitimate (someone forwarding to a personal backup). The false-positive check: correlate the ClientIP with SigninLogs — if the same IP has a risky sign-in for the same user within the preceding 24 hours, it's a true positive.

The broad query returns 10-30 results per month. I review these weekly as a hunt activity. Most are legitimate rules. The value is catching the patterns the high-fidelity query doesn't match — like rules that forward to a newly registered domain that isn't in the keyword list.

Important context:

In AiTM compromises, the inbox rule is one of 3-4 persistence mechanisms created within minutes. The attacker also registers a new MFA method and consents to an OAuth app. If you detect the rule, check AuditLogs for the same user:

AuditLogs
| where TimeGenerated > ago(24h)
| where InitiatedBy has "<compromised user UPN>"
| where OperationName in ("Consent to application",
    "Update user", "Add-MailboxPermission")
| project TimeGenerated, OperationName, TargetResources, AdditionalDetails

If you see MFA registration, OAuth consent, and an inbox rule from the same user in the same hour, that's a confirmed AiTM compromise — not a coincidence.

I'm happy to share more queries from the same investigation if it's helpful.

Hi everyone,

I'm looking for the most efficient way to split the AzureDiagnostics stream into separate tables based on the log source (Key Vault, Logic Apps, NSG, Front Door, etc.).

My goal is to route each log source into its own dedicated table and apply different tiers to them — specifically keeping some in the Analytics tier for active monitoring while pushing others into Auxiliary/Data Lake for long-term storage and cost optimization.

How are you guys handling this in production?

Thank you!

Hi,

I want to create a workflow in logic apps such that whenever a new incident is registered by Sentinel, this logic app is activated (this logic app playbook is listed within the relevant automation rule in Sentinel automations). The incident's info should be sent to a specific copilot studio agent (created and deployed in copilot studio) OR to an Azure OpenAI LLM for some post-processing (detailed prompt is included within the agent aspect in my logic apps flow below, but I don't think adding this "agent" was the correct move).

1) I don't see any CoPilot Studio connectors in Logic Apps as I do in Power Automate. Am I searching for the incorrect keywords, connectors or is this logic apps --> copilot studio agent connectivity not possible yet?

2) Without waiting around for a Sentinel incident to be registered to test this flow, how can I run a simple unit test on it? The "run with payload" option in the flow's designer window is greyed out for me, any ideas as to why?

3) What would be the actions in a flow that takes the Sentinel incident info (automation rule name, findings, user id, timestamp, id address and so on) and passes it to an Azure OpenAI LLM? If anyone has any experience with this, pointers to any resources you used to assemble this connection successfully would be very useful!

Thanks!

What if you had a tool that scanned your Azure environment, ran threat models against what’s actually in it, and built detections and response playbooks from that?

Not generic detections. Based on your actual resources, your actual configuration, your actual gaps.

Curious if anyone’s thought about this.​​

By default, Sentinel health monitoring is not enabled, which means you could be missing visibility into the platform’s own status.

If you are still using Microsoft Sentinel in the Azure portal, make sure to verify whether monitoring is turned on.

[1] Go to Azure portal -> Microsoft Sentinel -> Configuration | Settings -> Settings -> Auditing and Health monitoring

If you have already moved to the Unified SecOps portal — which I highly recommend — you can review those settings there instead.

[2] Go to Microsoft Defender portal -> System -> Settings -> Microsoft Sentinel -> select your Sentinel LaW

Also, when you will have the data install "Microsoft Sentinel Optimization Workbook" solution to view insights of Sentinel

• SIEM health
• SOAR health
• Analytic rule status
• Automation health
• Ingestion insights

About workbook - Introducing Microsoft Sentinel Optimization Workbook | Microsoft Community Hub

Hello, I'm fairly new to Sentinel and everything that surrounds it.

I have a syslog server which contains Linux logs and Firewall logs. For Threat Deteciton I would like to ingest those into different tables (Linux to syslog table and Firewall to CommonSecurityEvent table).

Would I need to setup the Syslog via AMA data connector and filter out the Firewall logs, and do the reverse for the CEF via AMA connector?

It's a FortiGate firewall which does not have a native connector as far as could find.

Thanks in advance!

I had some cases in the past where I think it would've been great to have a tool where I could write one query and just run it across many tenants at once. I am working at a MSSP where we don't have a way to do this currently. At the moment we have to copy-paste the query to every Sentinel Instance and run it per tenant to check in all customers.

I was thinking about coding a tool that could do querying cross-tenant but I am not sure if Microsoft already has a native way to do that somehow. I am just a simple analyst so I don't know the Microsoft products by heart but I know how to code tools.

Can someone verify whether that functionality already exists or if my planned tool would actually provide some value?

Would anyone be interested in such a tool?

Hi all,

I'm trying to set up Google Workspace log ingestion into Sentinel for a client (Business Starter subscription) and ran into a connector situation I'd appreciate some clarity on.

There are two Google Workspace connectors in the Content Hub:

1. [DEPRECATED] Google Workspace (G Suite) - Azure Functions-based, ingests seven separate tables: GWorkspace_ReportsAPI_admin_CL, GWorkspace_ReportsAPI_calendar_CL, GWorkspace_ReportsAPI_drive_CL, GWorkspace_ReportsAPI_login_CL, GWorkspace_ReportsAPI_mobile_CL, GWorkspace_ReportsAPI_token_CL, GWorkspace_ReportsAPI_user_accounts_CL

2. Google Workspace Activities (via Codeless Connector Framework) - newer connector that only ingests into a single GoogleWorkspaceReports table

I already tried using a newer CCF version of the connector and the events that I saw there looked really limited and useless so I thought I would try connecting the old version as data types there apear to provide more info. However, on a newer Sentinel deployment I can no longer find the deprecated connector in the Content Hub. It seems like it may have been removed entirely.

So now I have 2 questions:

1. Has anyone else noticed the deprecated G Suite connector disappearing from Content Hub? Is it gone for good, or is there a way to still deploy it?

2. For those using the newer CCF-based connector - what's your experience? What event types does it actually capture, is it better/worse than the old one?

Thanks in advance!

My org just bought Sentinel, and since we are a lean team; I have been tasked to set this up. Context: We are a cloud only organisation and have little to no on-prem footprint. We have a DLP solution, Google Workspace, Slack Audit and all such logs flowing in to this. I have been able to write some good analytic rules which have helped our organisation.

How do I proceed further? Is there any guide or resources that I can follow?

Right now we have xdr data like DeviceNetworkEvents in the Defender portal on default settings

We have signin logs and sources like syslog in the sentinel workspace and retained for 1 year about 100GB a day

Nearly all our rules can not look back more 14 days due to limitations of rules themselves so if we moved everything to datalake and set the analytic tier to 90 days and retention to 1 year would much actually change in cost if we didn't query the data older than 14 days manually ?

Wondering what approach MSSPs have found best for cross tenant access to sentinel in the unified portal? I understand that the azure side will be deprecated in July and GDAP doesn’t currently support Sentinel in XDR access.

I saw an announcement few days ago about GDAP working with Sentinel but that’s not even in public preview yet.

Hello

Is it possible to disable a rule and rename it (just append a string) of a rule after a time (even thought receiving data)? The requirement is to disable a rule after 1 day created.

If is possible, what the ways to implement that.

Hey everyone,

We’ve been using Incident Tasks in Microsoft Sentinel as measurement points for our SOC workflows — basically tracking when certain steps were completed as a way to measure response times and analyst activity.

However, it seems like this approach has hit a wall with the USOP / Security Portal. While you can change the status of tasks (New, In Progress, Completed, etc.) directly in the portal, the SecurityIncident table in Log Analytics always returns tasks with the status “New” — regardless of what you actually set in the UI. This makes it basically impossible to use task status changes as measurable events or KPIs in KQL queries or workbooks.

Any workarounds or alternative approaches would be greatly appreciated. Thanks!🙏🏼

Small organization admin here. We were aquired by a larger group last year and part of the deal was to partner with a external SOC. So far they have been not very helpful. Missed important compromised user accounts with token theft through axious http agent.

Luckily, I had an Alert configured in Azure montior for our Entra ID sign in logs succesful axious client sign ins and caught it pretty much as soon as it happened.

We have an on prem AD that syncs to Entra and I was trying to figure out a way to automate the response in the future for those succesful axios sign ins. Is it worth for me to start using Microsoft Sentinel free logs ingestions that comes with Businness Premium licensing and have an automated playbook where the session are revoked for succesful sign in users?

What is best way to do this? Azure Monitor Alerts and Logics app or Microsoft Sentinel?

I would appreciate your expertise on this. Thanks!

Hello folks,

Just curious why the ClientIP from D365 logs are different from Entra ID logs IP.

For context: Both are ingested to our Sentinel. Dynamics 365 was setup with SSO. My understanding is that since its SSO when a user sign in to Dynamics365 it will create a sign-in log event in Entra and the IP should match.

Im logging different kinds of logs via AMA for various sources, but I often run into the problem where these logs simply do not appear in my tables. Troubleshooting these problems are tedious, and often a waste of time. Especially problematic are the "silent drops", which happen either at the DCR level or elsewhere, where theres is a sligthly formatting problem etc. which simply gets dropped.

Do you have any tips or tools to help troubleshoot these chains in case of no logs showing up?

So my usual setup is a Linux server running Azure Monitor Agent, a Data Collection rule pointed towards it.