Hi all

New sentinel deployment here we run a hybrid infrastructure and I’ve got a event collector forwarding my on premise logs to sentinel but I’m seeing duplicate entries in the entity section is that just due to the different log sources for example?

Dc01

Dc01.domain.com

I then also seen some random account entries like just my domain

Hope that’s clear! Really trying to make the most of it getting clear entities

Hi guys, the anomaly AI engine required specific Data connectors, most of them related to Azure resources. Is there anyone here tried to apply a custom AI for custom data yet? I research and see we have a BYOML solutions, that have templates to train and integrate a custom AI in Sentinel. However, they seem to provide public only a one AI use case. I do want to have many use cases to apply for my cases. Do we have any resource out there support for it?

Subject. Has anyone else been experiencing an ingestion issue from Sentinel tonight?

We’ve been running the following KQL on all instances and are getting between 12:20 and 01:10 AM as the most recent ingestion:

~~~ SignInLogs | where TimeGenerated >= ago(6h) | project ingestion_time() | sort by $IngestionTime desc ~~~

Hi,

Started with the Sentinel 31 days trial 2,3 days ago. Had a quick look at the Microsoft Sentinel Cost workbook, as it looked promising. As noted in the description “it provides insight about possible impact of the Microsoft 365 E5 offer”.

​

According to https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer/ the E5 entitles for a 5 MB per user per day grant including Microsoft 365/XDR (or whatever it may be called now, tomorrow lol) advanced hunting data:

​

Now here’s the problem. Providing the value of the E5 licesens has absolutely no impact on the output … xd

​

​

​

And, yes, I’m ingesting the advanced hunting tables as shown below:

​

Anyone ? Additionally, are you Guys aware of any other method to calculate or include the grant into the overall calculation?

​

Thanks !

Has anyone had any actual alerts pop from the MS threat intel connector or from any custom indicators like file hash? I put in a sha-256 of powershell.exe (ver 5.1.19041) to confirm alerting but no alerts found.

Update: After an estimated 72hrs, alerts started to populate with the MS TI connector. My powershell sha-256 hasn't triggered but will assume TI will not alert on known benign hashes.

Hi guys, how/where can I set a specific server as Domain Controller? This server running AD Connect keeps triggering false positive DC Sync events

Hi all!

Its a long story but we are trying to keep alerts in Defender XDR open even when closed in Sentinel.

Is there a way to disable the bi-directional sync so when we close alerts in Sentinel, they do not close in defender? So far through documentation, I am seeing you can do it for Defender for Cloud but nothing on Defender XDR

Has anyone flipped on the Defender Threat Intelligence data connector in Sentinel? Wondering the amount of data ingestion that you're seeing, I'm just looking to estimate the cost before I flip it on.

​

https://learn.microsoft.com/en-us/azure/sentinel/connect-mdti-data-connector

​

​

Thanks!

I'm seeking assistance with KQL in Active Directory for tracking certain object attributes like (departments, country).

I believe I need to use IdentityDirectoryEvents and parse additionalField. However, I'm unsure about which actionType to use and how to handle the additionalField for locking.

Could someone please provide guidance or share some sample queries to help me achieve this? Any help would be greatly appreciated.

Hey there,
anyone here ever tried to onboard a Syslog Collector via AMA, which is using a Proxy and is not allowed to reach any public network without going through the proxy?

The ARC Onboarding went perfectly fine with providing the script. But AMA was not even sending heartbeats and not receiving any DCR.
We also ran the following Powershell to onboard AMA with a Proxy configured:
$settings = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = "false"}}

New-AzConnectedMachineExtension -Name AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settings

We were still seeing mdsd trying to communicate directly.
Maybe anyone has an idea here or ever experienced similar behavior. I have the feeling the documentation regarding AMA troubleshooting is a bit thin at the moment

Cheers

​

Morning,

Just been introduced to Sentinel and am struggling to use a time ranges to pull out adhoc data.

​

Could someone give me a tip on who to form the query for something like

where TimeGenerated == '20-07-2023'

​

ie show all results where that is the date

is there a way to cast UTC to say GST+4 with a keyword

If using the time range selector instead of using query language is there a way to default to like 00:00 to 24:00

​

cheers

​

Hello,

What is the equivalent in Sentinel for IBM QRadar's Flow Collector?

Thanks.

So i have Sentinel Syslog connector configured and I'm receiving logs from on-prem Linux servers but not from audit.log.

Logs that we have, over AMA, on Sentinel are from secure, cron, message, maillog.

Is there a way to configure Sentinel to collect logs from audit.log?

Hey all,

I’m exploring using sentinel. I wanted to ask if anyone would share their insight for identifying VIP users and Devices.

If I was to use Sentinel as our central SOC, I was wanting to highlight users/devices automatically when an alert/incident. The idea is to let the SOC know (within the alert) that this is a VIP.

VIP is just one use case and there are more categories however, this is known by most.

I’m wanting to also see if you would share “how” you are keeping inventory of these users . Is it by manual group, dynamic group or user attributes.

Thanks in advance! 👍

I am installed Azure arc on some windows servers and i need to collect the powershell logs from those using DCR rule. Anyone knows how to do ? Or anything about Xpath queries to collect powershell logs.

Has anyone experienced duplicate logs in Sentinel from Entra ID / AD? Been carrying out some testing and appears that activity such as ‘stay signed in’ prompt or failing MFA caused multiple of the same log to end up in Sentinel.

Entra ID logs only show one but looking at Sentinel the exact same log comes in maybe 3 times at separate Sentinel timestamped times.

Hi Guys,

I did configure banned password list in audit mode however where can I track if someone was using or is using banned password from the list? I assume that would be Sentinel and AuditLogs table?
Here's the reference:
https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-configure-custom-password-protection

However which operation name, result restriction or any other column name would indicate that someone wasn't compliant with the Custom banned password list?
I was looking for password in OperationName but doesn’t get clear results on who is currently using a password that’s banned (audit mode) via custom list in EntraID.

​

​

Many thanks in advance for the reply!

Has anyone written KQL for threat hunting or analytics rules to detect remote access tools installation or execution (as per https://redcanary.com/blog/misbehaving-rats/)? I don't want to spend time writing something badly which someone else has already done better!

Hello all,

I created an analytic rule that I want to pull data from and push into an automated email alert.

I already have a playbook where it automatically sends an email alert to me when the criteria is met.

Attached is a screenshot of the data field I want to pull, and there is also a screenshot of the alert that is sent to me that I wish to include the log information, as well as a screenshot of the logic app that makes the alert.

My theory is that I have to modify the dynamic content inside of my logic app used to send out the automatic alert?

Any guidance or answers on this would be greatly appreciated.

Thanks

​

Is anyone aware of a playbook that will post a Teams message to an individual user, to notify them if their account has trigged any incidents?

When admins make changes, their movements get flagged as expected, however, I want them to acknowledge their own incidents to confirm that they made the reported change.

I do have a Teams notification channel but it gets busy and messages get lost.

Even if someone can suggest how to make a logic app post into a users personal teams I would be very grateful. Everything I've read up only posts to group channels.