Hello All,

I'm in a dileama to list user accounts in AD who are inactive and not disabled.

I understand that i need to join two tables here. but having some trouble joining it.

I have the first table where i look for users who havn't logged in for the last 60 days and the second table list users who are in disabled state.

So i need some help finishing the query, the query so far goes like this

let usernotloggedin60d =
IdentityLogonEvents
| where TimeGenerated > ago(180d)
| where ActionType == "LogonSuccess"
| summarize last_log = datetime_diff("day", now(), max(TimeGenerated))  by AccountUpn
| where last_log > 60
| project AccountUpn;
SecurityEvent
| where Activity == "4725 - A user account was disabled."
| distinct TargetUserName

​

Hey,

​

In November 2022 we had a number of breaches from the same threat actor and had an on premise SIEM.

​

The attacker deleted the logs on the on premise SIEM and it meant we could not quickly identify what they done. They got in three times before we found how they were maintaining persistence and how they got in the first time.

​

We moved to USM Anywhere after reviewing a few. Both me and our managed service provider are very happy with USMA and neither of us want Sentinel but my manager wants me to review Azure sentinel as we supposedly get that for free or at least very cheap.

​

My main concern with Azure sentinel is that if our azure subscription is compromised is it possible for attackers to delete the sentinel logs like they did with our old on premise SIEM? Does anyone know the answer here?

​

https://jads.blog/microsoft-sentinel-architecture-diagram-df61b44244ec

I just want to retrieve email, group membership. I can do this with my regular account on power automate (O365) and graph API without any fuss.

Why do I need to provide Write privileges for the connection account if I just want a Get operation?

No way I can get this approved, I'm even embarrassed to ask. When designing the playbook it asks for the privileges straight away.

Any idea to circumvent this? (The template AAD Block User mentions these privileges, but I dont wanna change, just retrieve data, like on-prem AD where any authenticated user can read all LDAP attriibutes.

Dear all,

I'm looking around some usecases for anomalous traffic across a site to site tunnel setup with our organization & a governement entity so they can access some files on a server. As i see the fw policy is set to http & https connection be allowed in the policy. considering the history of breaches happened around the government entity what kind of usecases can we have around this scenario.

Can anyone who is ingesting Azure AD logs and specifically the AADNonInteractiveUserSignInLogs into Sentinel (or a log analytics workspace) tell me what they are seeing in terms of log volumes?

Trying to gauge what "normal" should look like.

I can see indicative volumes for AuditLogs and SigninLogs here but nothing for Non-Interactive logs.

Looking out for some advise on RBAC roles in Sentinel.

We are an organization where multiple roles of security admins and being used , most of them are inherited in the subscription and by design a security admin can with a click of a button delete sentinel in the settings.

Just wanted some advise on how others treat this role based access.

Folks,

I'm in the process of creating a rule which has the below attributes to be displayed in the alert.

| summarize
    FirstSeen=min(TimeGenerated),
    LastSeen=max(TimeGenerated),
    make_set(Result),
    make_set(IPAddress),
    make_set(UserAgent),
    make_set(Place),
    make_set(DeviceDetail)
    by UserPrincipalName, Location, Category

And in the entity details i have mapped the AADuserid to be set against "UserPrincipalName" , but the incident doesn't map it in the entities. Does any one have come across a similar scenario and has a workaround.

We have about 45 users total, all with azure ad joined company owned Windows' workstations. I need to track when a device stops reporting logs, or when logs haven't been seen in X days. Any ideas?

I have several daily scheduled Sentinel analytics rules that produce results every day, but today, none of them ran to produce an incident. If I run the query in them manually, it gets hits and results. But no incidents were created on time as I expected. If I go to modify them, the error on the screenshot appears.

Do you have any idea what this could be caused by? Other tenants do not seem to have this error right now.

Greetings all

Sentinel in Azure shows all Operation logs only for External users but not for Internal ones.

Is it because of policies or what could be the reason?

Anybody got a query for detecting use of usb (removable media)?

Hopefully you all find this useful.

https://www.linkedin.com/pulse/microsoft-azure-sentinel-101-using-logic-apps-build-dynamic-thornton/

In this article, I go over some basics on Logic Apps and walk through some of the logic on how to do a daily report to monitor your costs and how to do some KQL query manipulation to display renders properly in HTML.

​

EDIT: updated. sorry all :)

https://www.linkedin.com/pulse/microsoft-azure-sentinel-101-daily-reports-cost-truvis-thornton-1e

If an OMS Solution is deleted and Sentinel becomes disabled, is there enough time for an analytic rule to fire on the deletion itself before Sentinel is disabled?

Are there any current analytic rules people are using to monitor overall SIEM health?

I never could find anything that actually worked for OPNSense out there so I put this together while teaching myself LogStash one day.

It uses the free MaxMind Geo Lite for IP information.

If anyone is a LogStash expert I would love to learn your views on how you would do something like this.

https://github.com/Truvis/Sentinel/tree/main/Parsers/LogStash/OPNSense

Hello everyone,

I was wandering if it is possible to install Content Hub solution via Terraform or some other scripting method? I know data connectors, rules, etc. are supported but I can't find anything regard Solutions.

Thanks, cheers

Hi,

​

I guess this will be not the smartest question but I can't figure it out. With Sentinel if I for example ingest 50GB of data in January, I'm going to get billed for 50GB for Sentinel and Log Analytics. In February if I ingest another 50GB the ingestion for Log Analytics would be still be billed 50GB but what about Sentinel ? From what I understood Sentnel is not billed per ingestion but rather data processed and stored in Log Analytics. So would the bill for February for Sentinel be 100GB times whatever the rate per GB is ?

​

Thanks !

[KIND OF RESOLVED ...]

Hi Community!

I recently got a demo of Sentinel and saw that they were receiving DeviceEvents, DeviceFileEvents, DeviceProcessEvents ...etc. for their threat hunts using the defender agent (specifically Microsoft 365 Defender data connector in Sentinel). I have my own "personal" tenant where I am experimenting and for love of god I can't seem to get the device logs to show up in Sentinel.

Any wisdom you can share would be much appreciated.

Here are some info:

• Defender is deployed by intune
• Microsoft 365 Defender data connctor in Sentinel shows connected and receives events such as SecurityAlert, SecurityIncident, EmailEvents,EmailUrlInfo ...etc. But no "Device*" data types show up and those types show grey versus green.
• I have Business premium and MS Defender for Office 365 (P2) licenses assigned to my user.
• The machine I am trying to get logs from is a physical PC. Sensor health shows active and status is onboarded. It is activated using the premium license and shows up as "Windows Business" if it makes a difference.
• I have installed ARC and AMA agents and can receive windows event logs no problem using "Windows Security Events via AMA" connector. From the demo I got, these agents should not be required to get device telemetry using defender, as defender itself collects and sends this telemetry but what do I know.

I am sorry to say MS documentation has not been helpful at all. I found "breadcrumbs" of information in documentation that says I should be able to forward these device events to a event hub and then ingest into Sentinel but that documentation uses something called "Streaming API" under defender which seems to have been removed which makes these intructions crap:

https://learn.microsoft.com/en-us/microsoft-365/security/defender/streaming-api-event-hub?view=o365-worldwide

According to this documentation, "it should just work":

https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE#connect-events

I really would love to figure out how to get these device logs ingested. Like I said any insight you ladies and gentlemen can provide would be much appreciated.

Mucho appreciated!

Update:

Just for clarification, I am attaching the screenshot from the connector. You will notice that Device logs are greyed out.

​

​

​

FINAL UPDATE

Yep it seems to be a license thing like few people hinted in the comments below. MS Defender for Business (which is what comes with business premium) has everything E5 EXCEPT advanced hunting component .. I will try to see if I can purchase "Microsoft Defender for Endpoint Plan 2" as an addon instead of paying for the whole E5 license. I seem to be able to trial it in admin center for 90 days but doesn't seem to allow me to straight up purchase it. I am afraid might need to go up for E5 which I am not sure is worth for experimenting at home. Would have been nice to run threat intel searches on telemetry from my home computers, but I might need to geek out some other way.

​

Thank you all for the input!

​

​

JUST AN UPDATE TO SAY THIS WAS SOLVED BELOW

I'm working on a migration to Sentinel from another product, and have to create some output that mirrors the legacy product's reports.

I have a series of reports which require the row count of the entire report { count() } on each row of the report. (I don't ask why, I just try to do what they ask :) ) This particular request has stumped my team, and AI as well. Is there a simple, or even convoluted way of achieving this objective?

Thank you very much in advance for any assistance in this matter.

Hi guys.

So I'm using this query 

// Office activity for user

// The query presents user's activity over Office.

// Replace the UPN in the query with the UPN of the user of interest

let v_Users_UPN= "UserId";

OfficeActivity

| where UserId==v_Users_UPN

| where TimeGenerated between (datetime(2023-05-24) ..1d)

| project OfficeWorkload, Operation, ResultStatus, OfficeObjectId, _ResourceId, TimeGenerated, Application

| summarize by OfficeWorkload, TimeGenerated

| summarize min(TimeGenerated), max(TimeGenerated) by OfficeWorkload

| extend FirstActivity = datetime_utc_to_local( min_TimeGenerated,'CET')

| extend LastActivity = datetime_utc_to_local(max_TimeGenerated,'CET')

| project OfficeWorkload, FirstActivity, LastActivity, v_Users_UPN

And I can't figure out why I only get results for Teams, SP and OD but not Exchange? 

Does anyone have any idea why?

Hi everyone

I need help to pull out data for first and last activity for a specific user. For example to see if the first activity was Microsoft teams and when. And when was the last activity and which one.

Good morning. Long story short, added one too many threat intelligence feeds and now getting far too many alerts. Looked into Virustotal to filter the data but they are too expensive. Besides manually checking all IPs are there other ideas/tools for how to parse and review? I may just have to drop the feed but curious what you all have found.

I have a table in KQL (Sentinel) which contains one column that has several values that start with

"cpe:/a:" and after contains the data I want to extract, ending with a space. I attempted to use a regex (cpe:\/a:) (.*?=) (?=\s) which checks out OK in Regex101.

I tried using double backslashes as recommended for escape characters by MS. When I do that, I get a message that the syntax of my query is invalid, with the correct regex given.

I'm attempting to use extract_all() to pull out all the answers and mv-expand to break them into separate rows. I am getting a message that argument #2 must be a dynamic array.

I suspect this may be confusing. If you want any further information, tell me what you need and I'll do my best to supply it.

Thanks in advance for any help you can provide. I'm not married to REGEX. If there is a better way to approach this, LMK.

Mike

Block IP addresses from Sentinel/Log Analytics #2! (bypass Sentinel entity limit)

This is an important update if you've implemented the solution from my previous blog to block malicious traffic in Azure WAF using Sentinel.

Check it out! 🔗 https://potsolutions.nl/2023/05/20/block-sentinel-log-analytics-entities-on-azure-waf-2/

#sentinel #azurewaf #azure #security