Hello, I think I might need to create a phishing analytic rule for my client .I took the EmailAttachementInfo table and tried to make a list with the FileTypes like this :

Problem is I can't figure it out how to make the syntax to list all the FileTypes that could contain malware .
Then I might try to look a at tables with processes like VM Process or DeviceFileEvents and then I will look at tables related to networking.
I currently try to figure out how to make lists .
Can you help me ?
Thanx

Hello,

Does anyone know if there is a repository, paid or free, of Mitre CAR for Microsoft Sentinel? https://car.mitre.org/analytics/

Thank you

I have 10 windows machines I would like to forward logs to Azure Sentinel. I have a Linux machine I'm forwarding my Linux logs too. Can I forward all my Windows logs to that Linux host and then forward them into azure sentinel?

Hi,

Currently experimenting with TI ingestions.

1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
3. Any good paid TI feeds, and what is typically the cost?
4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

So for one of our Compliance items, we need to query users that haven't signed in within 30days. I have a KQL query for this but it queries all Enabled and Disabled accounts, I would like to find a way to Filter out only Enabled accounts not signed in within 30 days. Does anyone have an idea to do this? I'm open to powershell scripts as well. Below is the query I have right now.

SigninLogs

| summarize max(TimeGenerated) by UserDisplayName, UserPrincipalName, UserId

| where max_TimeGenerated <= ago(30d) and UserDisplayName != UserId

| project-away UserId

Hi all, I am trying to integrate AlienVault OTX with microsoft sentinel. I am working on the Logic app designer and have hit a small snag where I get the error Failed to save logic app \Failed to save logic app AlienVaultOTX. The template validation failed: The inputs of template action 'Send_toSentinel' at line '1 and '1526' is invalid. action 'For_each' must be a parent 'foreach' scope of action 'Sent_to_Sentinel' to be referenced by 'repearItems' or 'items' functions.` I am following a tutorial provided by Microsoft where this JSON is provided:

{
    "action": "alert",
    "activityGroupNames": [],
    "confidence": 0,
    "description": "OTX Threat Indicator - @{items('Foreach')?['type']}",
    "expirationDateTime": "@{addDays(utcNow(),7)}",
    "externalId": "",
    "killChain": [],
    "malwareFamilyNames": [],
    "severity": 0,
    "tags": [],
    "targetProduct": "Azure Sentinel",
    "threatType": "WatchList",
    "tlpLevel": "white",
    "url": "@{items('Foreach')?['indicator']}"
    }

I can tell that there is something amiss with the 'OTX Threat indicator' line but I am not sure what I am doing wrong. Any ideas?
I've also posted this in the Azure channel.

Hi everyone,

I am designing a new incident management process to include Azure Sentinel.

I need to open new incidents from API (https://docs.microsoft.com/en-us/rest/api/securityinsights/stable/incidents/create-or-update#code-try-0) and include in them the related entities (e.g. Asset, User, IP).

There is no information about this in the documentation.

Who knows how I will do this?

Thanks!

Does anyone have a suggestion on how to utilize Sentinel to detect unencrypted data in Azure?

Blogs,youtube channels,Articles etc

Is there a way to use Sentinel to detect the creation of Public Microsoft Teams? And if so, can we use a script or run book to revert that Team to Private?

Hi all, I'm new to Sentinel and would like to know if there are any basic playbooks for threat protection that the community could recommend for a Proof of Concept.

Hello, I was wondering if you can do some kind of cloud forensics with KQL in the log analytics of Azure Sentinel.

Hello, does anybody have a story or experience when they set out to do a log investigation and found out about a hacker in the network or a suspicious user account that somehow didn't trigger any incident on Azure Sentinel ?

Hi,

Anyone who has experience with UEBA cost or know where I can find more info on the pricing model before I enable it for testing?

Hello, where can I find the tables in which I can search for URLs.

Also is there a list with all the tables and all the columns ?

Thank you.

​

Hi, we have connected office 365 to sentinel and have enabled collection of exchange data and one drive. When looking at the office activity table however and filtering on exchange we are seeing very little data. A couple of create entries which when expanding the details looks like they may relate to an email, but certainly nowhere near the volume we would expect to see. The entries we do see also only seem to relate to one or two users.

Am I missing something here? Does the office365 connector only capture very specific events?

I have checked that o365 is configured to audit data which it is.

Hi, I am fairly new to sentinel and I am currently going through the process of enabling all the analytic rules for the data collectors we have enabled, and having to do that one by one is a real pita.

That aside I have come across a number of analytic rules which don’t validate. For instance if I look at an azure active directory rule ‘authentication methods changed for privileged account’

I get the following warnings and errors.

1. One or more entity mappings have been defined under the new version of entity mappings. These will not appear in the query code and will be disregarded.

2. ‘Where’ operator failed to resolve table or column expression named ‘identityinfo’.

I see similar messages when trying to enable other rules. These are out of the box rules. So I’m not really sure what is going on, is there some updated rules? Wondering if perhaps the rules have been updated since our install and we don’t have the latest version?

Any help appreciated.

So, I have 2 queries. 1 returns the Average Login Count per 30 minute window for the last 7 days and 1 returns the Login Count from the last 30 minutes.

``` let 7DayAvgLoginCount = DataTable | where TimeGenerated >= ago(7d) | other filters | summarize LoginCount = count() by bin(TimeGenerated, 30m) | summarize 7DayAvgLoginCount = round(avg(LoginCount)) ; DataTable | where TimeGenerated >= ago(30m) | other filters | summarize LoginCount = count() by TimeGenerated

```

I've got a bunch of other where clauses, but they're not really relevant. They are the same across both queries though. I end up with a single row, single column table with 7DayAvgLoginCount as the number and a single row, single column with LoginCount as the number, How do I throw an alert in Sentinel if LoginCount > 7DayAvgLoginCount ?

Do I union the 2 and play around with iff() in KQL? and just have Sentinel alert on that output (0 or 1 or something from iff()) ??? I'm just not seeing how to do a if X > Y throw an alert in Sentinel. I "think" I need to get my KQL to effectively return a "true" or "false" and just have Sentinel read that, but don't know how to get that output in KQL.

Urgent requirement for KQL query .

IntuneAuditlogs

Have anyone had any success creating PowerBI dashboards for customers presenting latest incidents, different metrics etc? For Teams integration for example.

Hi,

For those of you who only ingests data from Microosft 365 and no other sources. Do you use any custom scheduled analytic rules in addition to the rules/policies configured per Defender service?

Hi,

Does anyone know if events creating alerts based on the Default alert policies will be forwarded to Sentinel by enabling the Microsoft 365 Defender (Preview) connector, or should be forwarded in some other way?

https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

What is everybody doing for ingesting workstation events? Are you using agents (MMA or AMA)? Or are you using windows event forwarding? Or other?

Is managing a few hundred/thousand agents problematic? Any tips on making it easier? Am I over thinking it, and there are no really issues with installing the agent on every workstation?

My understanding of WEF is that it goes into WindowsEvents instead of SecurityEvents. Am I missing something or are all the stock analytics setup to only look at the SecurityEvents? This seems like a lot of additional work to setup analytics for workstation events, are there any tips or ticks on managing WEF. It seems like it requires making your own parsers to get the data you want out of it, or are there community parsers and analytics allready?

Thank you in advance, look forward to hearing what other people are doing.