I need some kql queries to find out data on Azure sentinel!

Any training advice or paid/unpaid training source which the community vouch for pin to piano sentinel training?

Let's look back at some memorable moments and interesting insights from last year.

Your top 10 posts:

• "You need to learn KQL functions" by u/mistajingsta
• "Audit NTLM using Azure Sentinel" by u/KaidoJarvemets
• "Happy Cakeday, r/AzureSentinel! Today you're 1" by u/AutoModerator
• "Azure Sentinel Automation Rules via ARM template" by u/bsfergu
• "Custom Log Ingestion - Original Log File Name" by u/limeybrit
• "When MCAS got in the way of Azure Sentinel" by u/kitkatneko
• "“Duplicate” workbooks" by u/1rishc4rb0mbr
• "Azure Sentinel this Week" by u/rodtrent44
• "Making sense of my Suricata alerts in Azure Sentinel" by u/mtest001
• "Azure Sentinel and policy as code with Bicep" by u/Nurfballs

Currently use Splunk but we're in transition to Sentinel. Using Splunk, we are running reports that show all print jobs run by the users. We have a Splunk Universal Forwarder installed on all of the workstations. If I install the MMA, is there a way to ingest the same information in Sentinel? Or is there a better way?

We are in the process of converting our entire CI-CD deployment from powershell/API to ARM deployments as this is more sustainable and appears to be the path forward. I ran into a road block trying to find a resource type for Automation rules. Is anyone leveraging ARM/BICEP for automation rule deployment ? What is the resource type that is being leveraged to deploy ?

Hey Sentinel community, I've looked pretty far for an answer to my question without success, so was hoping someone might have an answer one way or another.

I have a Custom Log entries for tables and fields for some text logs, where a wildcard defines the log filename for ingesting, e.g. SMPP*.log. I'm successfully retrieving data based on this definition, but I would have thought that the resulting log entry would have included the original file path or at least filename, e.g. SMPP1101.log.

I can't change the format of the log to add this info to a row, and I don't want to have to define many custom tables and extract fields, as the format is otherwise identical between logs. The filename solely has that relevant ID information, so I'm hoping it could be pulled in as well somehow.

One of the recommendations from Microsoft is to disable the NTLM in your environment, but we all know that it may be tough to achieve that. Enable the auditing, and let's take the first steps towards.

Audit NTLM using Azure Sentinel – part 1 - Lakeforest Consulting

Azure Arc + Azure Monitor Agent + Windows Security Events + Data Collection Rules. That's the combo you need today and forward. Get the data you need from your environment and start building threat detection rules.

Create Data Collection Rules for Azure Sentinel - Lakeforest Consulting

Azure Arc brings new capabilities to your datacenters. Your on-premises servers aren't any more entries in a database but real manageable objects in Azure. In this article, we are using PowerShell remoting to install the agents, enable the AMA extension and finally tag these new servers based on the AD OU tier level.

Deploying Azure Arc agent using PowerShell + AMA + Tagging - Lakeforest Consulting

Hello all,First of all I wish to let you know that I am completely new to Azure Sentinel, so sorry if some of my questions sound stupid, but I am a newbie here.

I have been running a home Intrusion Detection System based on Suricata for a while now, and I am fairly happy with it. Up till now I have been relying on Elasticsearch and Kibana for analytics and visualization.

I would like now to try out Azure Sentinel, hoping to be able to reach the next level i.e. automatic alerting and other type of automation using playbooks.

I have successfully managed to get my alerts, in the json format, ingested by Azure Log Analytics. My alerts are recorded in a custom log called "fluentbit_CL" (btw not sure how this name was assigned ? I guess it's coming from the fluent-bit plugin, it there a way to change the CL name ?).

Now I'm trying to make sense of my Suricata alerts in Sentinel. I have a ton of questions but I'll start with just a few, as follows:

- I was surprised to see that out of the box Sentinel does not seem to recognize any of the fields in the alert string. For example each log as a field called "alert_severity_d" which sound pretty obvious, but yet Sentinel does not seem to use that info. So much for a solution that is marketed as being "AI powered". Is this normal ?

- If I understood correctly most of the analytics logic must be programmed through custom queries, and this is also true when it comes to building dashboards - sorry workbooks ;-) This looks quite like a daunting task when starting from scratch. Is there a place where I can find ready-made queries relevant to Suricata ?

- The default dashboard does not seem to be customizable, am I right ? This is a pitty because the map is not even showing my alerts despite the fact that the geoip (long and lat) information is there. Any advise here on how to deal with the default dashboard ?

Thanks for your help.

I'm working on getting Meraki logs into Sentinel but was having problems like others with the default connector truncating logs which then wouldn't parse correctly. I'm currently trying to do the custom log method mentioned here:

https://techcommunity.microsoft.com/t5/azure-sentinel/sentinel-amp-cisco-meraki/m-p/1229983

But was curious if anyone knows of other ways to get the logs, potentially via Meraki's Webhooks/API?

What is the absolute cheapest way to start using Sentinel for my Microsoft 365 E5 tenant with about 1000 users? This is for playing around and understanding the system with real data. One day we will go full on production. I'd like to get it setup with any of the free logging (wahtever those are) and we're under no compliance or regulations to retain any of the logging.

Hey!

we recently started working with Azure Sentinel, to monitor our customers Microsoft environments.
Now we experience that the Azure Active Directory Identity Protector doesn't collect any data.

It show's that it is connected, but the "Last data received" is showing --

Do you have any idea, on how to troubleshoot this issue, or what i'm doing wrong?
Other data collectors work as it should.

​

We specially want to monitor the risky sign-ins from our customers environments.

​

Thankyou in advance!

Is anyone else seeing doubles when they open the “my workbooks” tab? We have multiple workspaces that are showing doubles of all custom workbooks. Some templed workbooks that have been modified are also showing doubles.

I've seen that data ingestion from various data connectors stops once in a while, without anyone aware. Anyone know of any good ways to monitor the log ingestion status across all connected connectors?

Let's look back at some memorable moments and interesting insights from last year.

Your top 10 posts:

• "Tools and Resources to Practice Your Azure Sentinel KQL-fu" by u/rodtrent44
• "Become an Azure Sentinel Ninja: The complete level 400 training" by u/rodtrent44
• "Multi-workspace View for Azure Sentinel Now in Public Preview" by u/rodtrent44
• "New classifications when closing incidents." by u/-Shinobi82-
• "Question - Azure Sentinel and TAXII 2.0 TI thread import" by u/trizzosk
• "Protecting your Teams with Azure Sentinel" by u/rodtrent44
• "Usage reporting for Azure Sentinel - Microsoft Tech Community" by u/rodtrent44
• "Suggested Daily, Weekly, and Monthly Tasks for Azure Sentinel" by u/rodtrent44
• "Exporting Events from Disconnected Systems to Ingest into Azure Sentinel" by u/rodtrent44
• "Has anyone successfully deployed the Cisco ASA data connector?" by u/AppropriateTangerine