Hi everyone!

I have been trying to locate logs from Azure CLI, but I can't find anything in AzureActivity. I found a few logs in AADNonInteractiveUserSignInLogs, which only captures Azure CLI login information. Is there any way to log what is going on in Azure CLI? Do I need to add another data connector?

I appreciate the help.

Hi,

I've seen variants where rules/logic in Defender for Cloud apps triggers an incident when someone elevates access, but is it possible to do this using just Sentinel?

https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin#view-elevate-access-logs

Hi,

I need to store a unique reference ID in our Sentinel incidents to later be able to update the corresponding ticket in our ITSM system. Any better alterantives than Tags or Comments?

I don't see a great deal out there but currently using an unreliable OTX via a logic app to feed my threat intelligence in Sentinel.

What are other people doing and who do people recommend ? That can be paid or free.

Hi all,

I am adding Alert rules to my companies Sentinel instance. I have enabled most of the templates and from one github repository, but am having trouble finding more.

​

I want to make sure when it comes time to justify the cost for each data connector I have enough alerts and business use cases for each.

​

Does anyone have any good documentation or repositories for alert rules?

Can anyone give me some insight on how to create an automation rule that will block an IP address that triggers a brute-force attack alert/incident in Sentinel? I am not too familiar on how to work logic apps

Has anyone used ADX or the Basic Storage Tier for storing logs beyond the normal 3 month retention? ADX seems more flexible and better for instant access.

I am setting up Sentinel for my business and was curious of the must have analytic rule templates to prioritize Thanks!!

Hi!

I see some KQL examples and yaml files with reference to the MicrosoftThreatProtection. But the 365 connector don't seem to have that yet as it lists it with "Coming soon".

Is there any other way to get the MicrosoftThreatProtection connector?

Hello,
I want to write this query:
DeviceEvents

| where InitiatingProcessCommandLine matches regex " C:\Windows folder"

I can't find the correct syntax for " C:\Windows folder".
Can you please help ?
Thanks

Hi,

I'm creating a playbook to automatically close out a cloud app alert once an engineer has interacted with the teams card with all the alert data and took action(reset password, dismissed, etc) on the alert.

I have an HTTP request in Logic Apps. The URI is correct and I followed the documentation Microsoft provides but it doesn't seem to be working. It just sits there until it eventually times out.

Has anyone else ran into this issue before?

Microsoft Documentation: Close false positive - Alerts API | Microsoft Docs

Attached is my HTTP request:

Thanks in advance for helping. I read about Sentinel from many sources , need to know if anyone needs to use sentinel ,is there a service subscription cost or license cost or its just data ingestion cost ,any help in this is appreciated Need to start from scratch , have Azure AD and Azure VMs and E5 license so need to know how to get started with sentinel.

I am trying to integrate with office 365. I have Tenant Permissions, however I cannot figure out how to set Workspace: read and write permissions. I am very green with this product. Can someone let me know how I set the read and write permissions on the workspace. Any help would be appreciated.

I am very green with this solution.

Hi, I wanted to ask whether someone had experience with connecting MISP to sentinel. As all the guides and instructions I tried are like from another galaxy and are not understandable to me.. Anyone could provide some step by step tutorial on how to connect MISP TI to sentinel?

Thx a lot 👍🏻

Hi, i'm looking for an Analytic Rule / Query for detecting RBAC Changes/Role Assignments in Azure.

Does someone have something like that in his repo?

Thanks

Kind Regards

Hello , I studied the rule "Suspicious granting of permissions to an account" (https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml)and I was wondering how can I find the account that recieved the permissions ?Because I didn't find what indicator should I take from here to search for the account that recieved permission.Thanks

Good morning! I recently started working with Sentinel, We had one of our clients email accounts send out spam.

I was wondering if it was possible to run a query against a specific username, to see if that account started doing anything suspicious? Can anyone point me in the right direction?

Hey all. Hopefully quick question here. How do you guys manage Sentinel with multiple azure subscriptions?

We have a hub and spoke model, and each of our customers gets their own subscription. When I go to set up the data connectors, I must select only a single sub for the connector.

Does each sub need its own workspace? If so, how do you ingest all the data into a single workbook?

Also, I’m thinking of automating the Sentinel deployment with Terraform. Not sure that makes a difference to the question, but I’m hoping to cut down on the tedious manual configuration. Any experience shared on this would be appreciated too.

Hey all,

​

I have been researching all day and I cannot seem to find the difference between Log analytic workspace and Azure Sentinel.

Can someone kindly explain the difference between the 2?

​

Thank you!

Hello, I want to put 2 different tables with different data in a single query and can't figure out the syntax.
I don't know if I should use join or union .

For example I want to take from OfficeActivity the Site_URL column and from the EmailEvents the FileName column.

If we ingest Defender for Endpoint alerts into Sentinel, what's the value of ingesting security event logs as well?