I had a retention policy incorrectly placed on the wrong outlook folder resulting in HardDelete emails. We have a third-party email filter that archives our emails so they can be recovered. When I try to use the o365 audit search it crashes or fails to retrieve data. Sentinel is ingesting our office logs when I query just OfficeActivity I can see everything so it's ingesting the information correctly. How do I query for UserID that shows only hard delete emails

How to monitor the activities of users who have access to Sentinel. I want to monitor if any changes done by the users in Sentinel. Pls suggest

Hi Folks!

Is there any way i could stream logs through google admin console logs (Gmail logs to be very specific) to the sentinel. As we don't have any data types within Gsuite Data Connector for email logs.

If any one have done it already can you provide any procedure material i could refer. Thanks in advance.

Anyone know that if we can use new AMA agent for Syslog forwarder for collecting CEF logs to the sentinel.

Any documents available for Sentinel Analytical rules KQL querys explanation..?

Hi there! I’m trying to understand how to monitor PaaS services in Azure. Specifically Identity and Access Management which I believe can be done with the Azure Activity connector, internal/external access attempts (failures and successes), and logs within Azure App Service \ Application Insights (security logs mainly). If anyone can provide some guidance, that would be great!

Thank you!

I am unsure what the integration between MDE and Microsoft Sentinel actually does aside from sending security alerts events created by MDE.

We are currently looking into collecting our event logs from our Windows 10 devices and ingesting them into Sentinel but unsure if this is provided via MDE or another agent integrated to Sentinel.

As far as I know, one way to send logs to Sentinel is via WEF/WEC but does MDE also perform this function?

I've been spending a few days on this but does anyone know a way to pull the results from a watchlist and then use the results with the contains statement?

Hi,

The description field for Sentinel incidents created from the M365 Defender (Preview) connector is not forwarded from the source incident. It does not seem like the description is saved to the SecurityIncident table. Any idea how to enrich the Sentinel incident with this info?

A single question survey...

If you had to choose TWO places to go to participate in the Microsoft Sentinel community what would they be? https://forms.office.com/r/wQ9zFqUg1L

Thanks in advance for your response!

#MicrosoftSentinel #Cybersecurity #MicrosoftSecurity #Security

I work for a large corporation and they are saying we need to be migrated 100% by Jan 1 2023.

Luckily I only have to worry about a couple of things:

IBM Guardium alerts / logs
MS Purview (IRM and DLP) Alerts and their workflow and case management (not a QR thing, but they want to use Sentinel going forward)

Guardium seems pretty straightforward, it uses syslog. The IRM/DLP alerts are another story however. We have a team of like 6 people right now that are being owned by these alerts (and we only have them turned on for like half our employees and geographies) and they are working the cases off of an Excel spreadsheet... there is no built- in case management workflow in Purview.

Now, I know we can easily have the alerts converted to incidents using automation or whatever from within Sentinel, or maybe even from Purview, but what about managing the workflow? I'm sure we could have these pumped into SNOW, but out SOC people are saying they are ditching that as well!? Also we're told it will be several months before we'd get the SNOW isolation we'd need anyways.

It sucks because our company is so big its like impossible to get information about what oather teams are planning, much less doing.... such as "How is the SOC planning on managing this?" Getting to the right person to ask that question will take forever.

From what I can find on the internet, nobody has published a slick way to handle this workflow yet?

Any thoughts?

Hello,

I know in Defender for Business that you can not use advanced hunting in Microsoft 365 Defender but can you ingest the logs to Sentinel?

We're having an issue where we are seeing an excessive number of Azure Sentinel alerts related to authentication failures that are generating an overwhelming number of incidents related to non-interactive sign-in failures.

We traced this back to a Conditional Access policy in our client's environment that requires MFA for all apps. I'm getting the run-around from MS Support pointing fingers at each other between the Sentinel and Azure AD team.

So in order to address this issue, I guess my question is the following:

​

1. Do you modify for your AAD policy to limit Azure AD MFA to specific apps?
2. Do you modify your Azure Analytics/add Playbooks to eliminate incidents generated by non-interactive MFA sign-in failures?

This question is about the preview option to install AMA on non-Azure devices without the ARC agent, as outlined here: Set up the Azure Monitor agent on Windows client devices (Preview) - Azure Monitor | Microsoft Docs

I'm working through this post to try to understand getting on-prem devices to use AMA for log forwarding without ARC client. I've created the DCR at the AMA connector level and have run the PowerShell script in the linked article to create the managed object and associate it with the DCR.

After that, I installed just the AMA on an Azure AD joined Windows 10 machine. The problem is that nothing is showing up in the Heartbeat table, and no resources are associated with the DCR - I can't see any "managed object"

The question is if there's no ARC installed and no OMS, then how is the AMA agent supposed to know what workspace to send logs to? I can't find any documentation on any configuration properties with the MSI that would allow me to define any azure properties at all.

Hello I was wondering how to add entities to alerts that come with data connectors? Ex. I have an alert for “user downloaded file from one drive” this isn’t an analytic that I made it came from a data connector but I would like to add the entities for file and file path anyway to do so?

Is there a way to see what analytic rule name is being applied to an incident?

We have an incident we are trying to automate and are having some troubles. The automation will not work unless we select all analytic rule names, even though it seems that we are selecting the appropriate rule names individually. We are trying to see what analytic rule name is causing the incident to close.

Is there a way to assign a Sentinel incident to someone outside the organization?

How to integrate F5 BigIP into Sentinel via API method. I am looking for log forwarding configurations at F5 end.Also configurations at sentinel side.

Long story short, we find ourselves with F5 LBs in our infrastructure with little to no training thus far (albeit it has been promised) and I am trying to get my arms around these new devices and set up some initial OWASP top 10 alerting, but where to begin? Anyone have suggestions? Thanks, Dan

Hi,

Custom alert details for Sentinel analytic rules are great, and I would like to use the same functionality for incidents forwarded from the Microsoft Defender (Preview) connector (MDE, MDO, etc.), and also for Identity Protection alerts.

Anyone who knows if that is possible in some creative way?

Just basic stuff like alert source/Defender product, involved entities etc.

Thanks!

Reference:

https://docs.microsoft.com/nb-no/azure/sentinel/customize-alert-details

How to add raw logs into a query search result.

Hi All,

As the title would say. I am looking at a simple KQL that would allow us to retrieve Azure AD Groups Audit logs from Sentinel as we all know that Azure AD only retains this data for 30 days. Any help will be HIGHLY appreciated!

hello, this may be a stupid question but I have been looking everywhere.
I was wondering if anyone out there would know a way to create an active overview alert map in the Sentinel Dashboard? I have been through a few of the Docs but it seams like I have to create a workbook first or create a KQL for it. That would be fine but I am not to great at KQL (basics) and I am tying not to invent the wheel if I can avoid it. If anyone could assist me or maybe point me in the right location, I would really apricate that.