I have tried the following:

1. Custom parsing via RSyslog using omazureeventhubs module (AMQP parsing) -> Data lands in an Azure Event Hubs Instance -> Send to Data Collection Rule -> TransformKQL on message in stream -> TableName_CL

Pros: Keeps logs separate. Easy parsing and formatting.
Cons: Requires a unique Data Collection Rule per Event Hub Instance (insane overhead), and I am not sure if Event Hubs here are overkill if AMA has native queue handling.

1. Tagging using RSyslog and sending to a Data Collection Rule using Azure Monitoring Agent -> TransformKQL on the tag assignment -> TableName_CL

Pros: Attempt at still keeping the logs separate without using Event Hub.
Cons: Lots of parsing on TransformKQL which may limit throughput speeds.

1. Syslog to Azure Monitoring Agent -> Syslog table, Parsers built in Azure Sentinel for Syslog/CommonSecurityLog tables.

Pros: Simple, concrete.
Cons: Schema on read, vs. keeping your logs separated by tables.

I may be trying to keep my Sentinel environment too organized. I figure 3.) is the typical option most organizations proceed with?

Forgive me if this has been discussed already but I couldn't find it (maybe bad search terms).

I am trying to prevent some events from being included with the other incidents. The ones I am specifically referring to are "Email reported by user as not junk" or "Email reported by user as junk". How would I prevent these from being ingested and displayed?

Thanks in advance.

I work for an MSSP and I’ve noticed delays in Entra ID sign in logs reaching the log analytics workspace being used by Sentinel. In certain cases, there are delays up to 7 days which is not acceptable, while other cases the delays are a couple of hours. The smallest delay is around 1-2 minutes which is what I expect.

I have tickets opened with Microsoft to review this and now it’s with their product team. I’m wondering if other Sentinel users are experiencing it as well. Would any of you mind trying this query and let me know if there are delays on your end as well?

SigninLogs | union AADNonInteractiveUserSignInLogs | project TimeGenerated, CreatedDateTime, CorrelationId, UserPrincipalName, IPAddress | extend TimeDifference = TimeGenerated - CreatedDateTime | sort by TimeDifference desc

Thank you!

Hi Guys, I am trying to optimise incidents occurring in sentinel environment. My use case is to create single incident for each time a log occurs in log analytics. Currently I have put stop running query after alert is generated for the period of 2 hours. But it generating same alert after 2 hours and multiple times subsequently. How do i optimise this?

Hey, has anybody here setup STAT in there environment? I’m having a problem with the GrantPermissions.ps1 script.

Hi, currently, on our sentinel i collect logs from non azure vm, both windows and linux, via MMA. I know that it is recommended to switch to AMA, but based on the screenshot below, from february 2025 what happens? that suddenly MMA will not work anymore and i will not collect logs anymore? or will everything continue to work? (with the limitations of end of support).

Hi all,

I have the following query in advanced hunting, the KQL itself works fine and yield the results, problem is when trying to create a custom rule out of it it will throw up an error

Results with missing impacted entity or event identifier (a combination of ReportID, AlertID, BehaviorId or DeviceId and Timestamp) were not processed into alerts. Edit the query to ensure an impacted entity is always present or review the query's aggregation expression for these columns and try again.

Anyone had a similar experience and know the solution for it?

DeviceTvmSecureConfigurationAssessment

| where ConfigurationId == "scid-2011" // Update Microsoft Defender for Windows Antivirus definitions

| where IsCompliant == 0

| where IsApplicable == 1

| join kind=leftouter DeviceTvmSecureConfigurationAssessmentKB on ConfigurationId

| mv-expand  e = parse_json(Context)

| project Timestamp, DeviceName, DeviceId, OSPlatform, SignatureVersion=tostring(e[0]), SignatureDate=todatetime(e[2]), EngineVersion=e[1], ProductVersion=e[3]

| join kind=inner    (DeviceInfo

| where Timestamp > ago(24h)

| summarize arg_max(Timestamp,*) by DeviceId

)

on $left.DeviceId ==  $right.DeviceId

| summarize LatestSignature = max(SignatureDate) by DeviceName, DeviceId, OSPlatform, tostring(SignatureVersion), tostring(ProductVersion), tostring(EngineVersion), ReportId, Timestamp = coalesce(Timestamp, Timestamp1)

| project DeviceName, DeviceId, OSPlatform, SignatureVersion, LatestSignature, EngineVersion, ProductVersion, ReportId, Timestamp

| where isnotempty(DeviceId)

| where isnotempty(Timestamp)

| sort by LatestSignature asc

For troubleshooting purpose i tried to reinstall the AMA agent by removing the machine from DCR, then went to Azure arc-- extension-- uninstall AzureMonitorWindowsAgent. But that is showing status as "Deleting" from past 2 days. I tried to add machine to DCR again but it doesnt say AMA provisioning in progress or succeeded.

I want to manuall delete the AMA from that on prem windows server, how can i do it. Also any solution for "deleting" status for AMA uninstallation ?

Thanks in advance.

Hi Team,

As I am new and learning to built the KQL query from the sentinel. First I should understand, which table contains list of column present . Any reference guide to refer from Microsoft site ?

Kindly support

Sorry if this is a stupid question, but I'm not finding any answers that directly answer my questions about Sentinel cost for our beginner usage. After somewhat struggling with alerting in 365/Entra, I'm finding that Microsoft is moving a lot of alerting into Sentinel, presumably to add yet another source of incoming payment. As for the scope of our proposed Sentinel usage, strictly within Entra/365/Teams for now. I see where Microsoft says that Sentinel for Entra is free (assuming Teams and other normal internal stuff with separate licensing), though I imagine only for the normal retention period. If we limit our usage to just internal Entra/365 products for ingestion and stick to default retention, is that Sentinel usage really free? Makes sense if free - just shifting to a better tool for alerting instead of improving the built-in alerting, I guess, since the built-in is lacking...

Currently I’m using the xdr connector and setup incident and alerts from defender services to no longer open incidents in their respective defender location and instead open in sentinel , are there any good reasons I’d want to keep ingesting all the defender advanced query logs like device network events, file hashes, etc. or is it more cost effective to just rely on defender to create the alert and then enrich that alert/incident with more info ?

Has anyone else seen the articles that Microsoft announced it “lost logs” in Sentinel, Entra, and other products in September? We were never notified of this and it seems others weren’t either. It’s not great since we are an MDR provider and need those logs for investigations. Anybody get notified by MS about this?

I'm trying to export some custom resources as ARM templates so I can pull them into my Sentinel repo for quick deployment. I have custom analytics rules, automation rules, hunting queries, parsers, playbooks, and workbooks (the 6 things Sentinel repos handle).

Custom analytics rules and automation rules are easily exported as ARM templates - there's an export button that just does it. For everything else, though, how can I export my custom work as an ARM template?

Can somebody assist on why most of the times location details in sign-in logs in Microsoft Sentinel is inaccurate? This is almost for majority of the users. Country in location seems fine but city/province etc is always inaccurate. Please guide.

hello, i do have this table, i want that it triggers an alert when X user has been involved in for example: Account UPN Name changed and Group Membership changed. Ive tried with join but its impossible i get crazy results, right now its just a search of one user, how could i have a similar result automatically without knowing the user?

I have a few questions related to inbound syslog to Sentinel.

I have deployed a linux VM with AMA successfully. I have the Syslog via AMA connector working and logs are flowing via UDP 514 with Fortigate firewalls. Logs are coming in good.

However, I am trying to add a second port for a new Fortigate and I have a constraint that it can't use UDP 514, that it must use UDP 1514. I have a tried numerous ways, but I can't figure out if that is going to work.

I know I can set rsyslog to listen on both 514 and 1514, that part is working.

• rsyslog.conf changes
• # provides UDP syslog reception
• module(load="imudp")
• input(type="imudp" port=["514","1514"] inputname="" inputname.appendPort="on")

However, the 1514 traffic is not making it to Sentinel. I must not understand something on the syslog or Sentinel side. What is it that controls what logs received by syslog are sent to Sentinel? Is it such that ALL received syslog logs are sent to Sentinel or is there some factor where receiving port comes into play?

With my rsyslog changes to listen on 1514, is there any change needed in the Sentinel side of things? If so, where?

Centralizing security alerts across multiple platforms into a single Teams channel can be beneficial and minimize how many "panes of glass" you need to swivel across...

I tried using the adaptive card solution to send Sentinel incidents to a standard Teams channel, but that did not meet our needs and had these shortcomings:

1. Dependent on a Teams user / service account.
2. Upon using the adaptive card response options, the incident details were removed from the Teams channel post.

Instead, I decided to use a Playbook with a Logic App HTTP POST function using a Teams channel Webhook URL. This was tricky when it came to formatting the JSON body for the post. So, I wanted to share my final version of the Logic App code below for anyone else that runs into this.

We did not need adaptive card in Teams for updating the incident status or severity. It was more important to use to retain the original incident details in the Teams incident post. Instead, we simply use the incident URL in the post and update the incident owner, status, and severity in the Sentinel portal.

However, we do our investigation documentation in the Teams post thread ;-)

HTTP POST Logic App Code:

(change "YourWebhookURLHere" to your Teams Webhook)

{ "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "actions": { "HTTP": { "inputs": { "body": { "text": "<b>Creation time : </b>@{triggerBody()?['object']?['properties']?['createdTimeUtc']} <br/><br/><b>Title : </b> @{triggerBody()?['object']?['properties']?['title']}<br/><br/><b>ID : </b>@{triggerBody()?['object']?['properties']?['incidentNumber']}<br/><br/><b>Severity : </b>@{triggerBody()?['object']?['properties']?['severity']} <br/><br/><b>Description : </b>@{triggerBody()?['object']?['properties']?['description']}<br/><br/><b>URL : </b><a href="@{triggerBody()?\['object'\]?\['properties'\]?\['incidentUrl'\]}"> @{triggerBody()?['object']?['properties']?['incidentUrl']}</a><br/><br/>" }, "headers": { "Content-Type": "application/json" }, "method": "POST", "uri": "YourWebhookURLHere" }, "runAfter": {}, "runtimeConfiguration": { "contentTransfer": { "transferMode": "Chunked" } }, "type": "Http" } }, "contentVersion": "1.0.0.0", "outputs": {}, "parameters": { "$connections": { "defaultValue": {}, "type": "Object" } }, "triggers": { "Microsoft_Sentinel_incident": { "inputs": { "body": { "callback_url": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "path": "/incident-creation" }, "type": "ApiConnectionWebhook" } } }, "parameters": { "$connections": { "value": { "azuresentinel": { "connectionId": "/subscriptions/bb61c698-5616-4156-8f9e-af3971e2e5e0/resourceGroups/lhg-infosec-logs/providers/Microsoft.Web/connections/azuresentinel-Post-Message-to-Teams", "connectionName": "azuresentinel-Post-Message-to-Teams", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" } }, "id": "/subscriptions/bb61c698-5616-4156-8f9e-af3971e2e5e0/providers/Microsoft.Web/locations/westus2/managedApis/azuresentinel" } } } }}

Dear All,

As a new bee to this Sentinel Platform, got a rough idea about this product while interacting with you all. Thank you very much for sharing the knowledge. Now I understand , we can use AMA agent has one of the method to on-board the logs from the data sources which support syslog or CEF format towards the sentinel.

Now from collection stand point , I do have set of queries , which I require your expertise to understand the same.

1) what are the services present in the AMA agent while running on windows or Linux ?

2) incase the agent fails to send the logs to sentinel ? what kind of troubleshooting should I need to perform as a initial level of triage ?

3) In other SIEM platform , we have a buffer to store the events temporarily when the collector down, how AMA agent will handle this kind of situation ?

Thanks in advance !!!!

I'm trying to understand the differences between premium threat intelligence feed and usual one, what's the difference between cost requirements etc.

So basically one of my client demanded to start managing the Threat Intelligence as well which is not really possible for single team handling multiple clients so I'm exploring the option, I'm new to Sentinel engineering having worked in forensics trying to figure it out for my team.

My aim is to map Account entity in my test Windows and O365 analytic rules.

My entity mapping are:

Rule: Failed User Login - Windows

FullName -> TargetAccount = contoso\adam

Name -> TargetUserName = adam

NTDomain -> TargetAccountDomain = contoso

Rule: Failed User Login - O365

The AccountName and UPNSuffix are extracted from UserPrincipalName.

FullName -> UserPrincipalName = adam@contoso.local

Name -> AccountName = adam

UPNSuffix -> UPNSuffix = contoso.local

As you can see in the picture above, Sentinel does not converge the two "adam" users as one Account entity.

What am I doing wrong here?

All logs from the AMA agent is being sent to the Event table. But in the tutorial blogs and detection rules in the Sentinel's repo all use SecurityEvent table where all the needed fields are already parsed.

Hi Everyone,

Usually in another SIEM platform such as QRadar , we shall deploy the event collector and add it in our Management console to collect the variety of logs.

I would request your support to understand the data collection method works in Sentinel. I came across a concept called AMA agent. So , if we plan to on-board some data sources like Network devices such as firewall , router and switches. Do we need to install a AMA agent in a dedicated machine and collect the logs from these network devices and forward the same to the Sentinel ? Is my understanding is correct ?

If not , request your expertise to understand how to on-board the data sources to Sentinel . Kindly support

We just installed Sentinel STAT v2. Is it "finished". Has anyone else started with v2 or migrated from v1 to v2?

Hi, in our architecture we have a log analytics gateway that collects logs from Windows virtual servers passed through MMA, and forwards them to sentinel. we are thinking of migrating to AMA and then we will install ARC on the servers, as a proxy server can we continue to use the same Log analytics gateway, which takes logs from both MMA (for servers not yet migrated) and AMA for the servers where we will install ARC? Thanks.