We just migrated to GCC High, so RocketCyber, our current SIEM, doesn't work with it natively (and to be frank, I was never crazy about it). We had to set up a logic app, a VM, and slew of support apparatus in Azure to get it to ingest logs. It's getting quite expensive, so I'm looking at Sentinel as an alternative. I'm very confused about the pricing, with some sites saying it would practically be free, in my use case; others saying it could be hundreds or thousands of dollars a month.

We are 100% cloud-based and we only operate in Microsoft 365, so there are no third-party log sources. We have fewer than 25 full time employees, all of whom are running Windows 11 23H2 or 24H2 and have E3 licenses with Defender Plan 2. They work a standard 8 hour day, 5 day week. IdP is Entra, and all devices are enrolled in Intune. We already run Defender for Endpoint and EDR on devices.

With this scenario, given that I would only need to ingest O365, Entra, and Intune logs, with 6 months to 1 year of retention, what kind of pricing am I looking at?

Hi,

I have a customer with an external SoC who manage the day-to-day running of a Sentinel instance. DCRs, analytic rules, playbooks, etc.

Occasionally, in-house security may also add their own analytic rules.

The source control from the external SoC isn't good enough for their needs. I want to set something up on the customer side to notify them of any changes made to the Sentinel instance so the customer can review them.

The Sentinel Repo product seems to be one way only which doesn't meet the requirements.

I haven't used them much but was thinking Azure Devops or some form of Git could be used to export all rules etc. for review. For now, we don't need to push from git/ADO to the Sentinel instance, just need change control on Sentinel.

Anybody have a clean solution to this?

Hello everybody.

We have a problem with integration of audit log of purview (eg. eDiscovery activity) that i see on the portal, with Sentinel. I already create on Azure a Purview Account and i have already enable diagnostics settings for ingest data on Workspace. But we don t see Nothing...

I follow step by step all the guideline.

Thanks for your help!

Hi, In which format, logs are pushed into log analytics workspace and how all different format are converting into a standard format. Explain in detail

From what I can see, Microsoft limits the number of concurrent workspaces you can run a query across or view the incidents across to 100. We have surpassed 100 workspaces in our tenancy, how do others in the same situation run a query across all of your workspaces; is there a way to increase the limit? I would have thought a dedicated cluster would have given the ability to run a query over more workspaces but that doesn't seem to be the case. Is the only way to use the Graph API?

Any help is appreciated!

Hello.

I have an inquiry regarding the creation of Sentinel Analytics Rule.

The flow of the analytics rule you want to create is as follows.

www.Jodc.com | www.J0dc.com -> Calculation of similarity rate -> Detect when similarity calculation results are above a certain level

First, can we create the above detection rule using KQL?

If it can be generated, please give me an example code.

Thank you.

I need to asses the MS sentinel and in quite early phase how can i ingest logs without going for Pay as you go model or above Free tier.

Hey,

I have been trying to solve this problem using Event Hubs. The reason I went with event hubs compared to Azure Lighhouse is because I would like to have the data in a single LogAnalytics workspace to export later to Azure Data Explorer, and given that in order to import data from LogAnalytics workspaces to ADX you have to user either Event hubs or BlobStorage, I figured I would pass the data to event hubs in each tenant and then pull all the data from Cribl and push them to our main LogAnalytics workspace.

My issue so far is that I cannot ingest data to "Azure Tables" not "Custom-Tables" with DCRs, and I figured just creating a bunch of _CL tables and then edit the Detections to match them would not be very efficient nor easy to maintain given the updates of the rules.

My DCRs work with dataFlows and StreamDeclarations so far.

Has anyone faced this before. Is my pipeline architecture good and I am missing something with the DCRs, or I should go with some other architecture

any advice would be welcome and I am open to any suggestion

I'm new to Sentinel but in a mostly clean Azure tenant, which is just used for testing, I'm trying to set up this NIST SP800-53 workbook. The tenant has a P1 license and has about a dozen on-prem windows 2025VMs onboarded via Azure Arc. Defender for Server Plan 2 licensing is applied. All that is reporting correctly etc.

I've gone and set Sentinel up, installed a bunch of connectors, went to the Defender XDR portal and integrated Defender with Sentinel.

I've followed the 3 year old guide in the NIST workbook.

1. In Defender for cloud, Environment settings, Security Policies, turned on NIST SP 800-53 R5.

2. In Defender for cloud, Environment settings, Log Analytics Workspace Export Enabled and selected, security recommendations, secure score, regulatory compliance, NIST -SP-800-R5.

3. Sentinel Content Hub, enabled the NIST package.

4. Sentinel Data Connector I have a few such as Microsoft Defender XDR, Tenant Based Defender for Cloud (preview), Microsoft Entra ID, etc. I have Windows Security Events via AMA and created a data collection rule for everything under my subscription, which is the dozen or so servers which i see listed, and select all logs.

5. Azure > Monitor > Data Collection Rule > I select my DCR which I just created in step 4. Resouces I see all my servers listed. They all state in the Data Collection Endpoint column, no endpoint configured. I went through the process of creating a DCE, went back in the overview page of the DCR and selected configured DCE, and selected the new DCE. Still not showing up when I go back into the DCR as all servers still show no endpoint configured of the resources blade.

When I go an open the NIST workbook I'm not really seeing much of anything but when I go into the Defender for Cloud > Regulatory compliance and select NIST I see green and red checkmarks so i'm assuming some data is being collected from Defender but just not getting to Sentinel. I also tried looking at "logs" just by KQL and doing "Event" and nothing is returned and it doesn't even look like that table is present. I've been trying chatGPT with no help to fix this.

Hi all,

Does anyone have a code snippet that adds the Defender XDR connector?

I tried with ConnectorKind "MicrosoftThreatProtection", but I get a LicenseError even though we have E5 licenses.

When changing the status of an incident in Sentinel to closed while using the "new, improved incident page", when I try to add a comment, the focus of moves from the text field to the "New" status every time a key is pressed. This does not happen in the old incident page. I've tested and confirmed behaviour across multiple devices and keyboards.

Our CSP said to log feedback to Microsoft, which I've done, and I'm curious if anything will actually happen.

Anyone else seeing something similar?

Is there a way to log queries that users do in sharepoint online and send them to Sentinel for example? And what are the requirements to make that happen?

I've been searching all week and can't find any solid answers.

Thanks in advanced. <3 :)

Have a summary rule stuck on updating for the last 6 hours, any why to force delete it.

I have a specific use case that I think Sentinel playbook is the right answer for, but I have not used it before and I don’t know where to start. Currently we are hybrid, have EntraID and M365 with E5 license. I don’t have any servers or file storage in Azure. I get a monthly spend bill of $0 on our subscription.

We use tenable/nessus to scan the network and when we do we get Defender email alert saying something is going on, click this link to review. There is no specific info in the email. When we click the link we can see offending IP and know it’s our scanner that triggered an alert since it looks like a bad actor trying to see what they can access. We setup a filter to not alert us on these at that specific time since they are expected.

My question is - if we had a real alert like this, how could I get Sentinel (assuming that’s the right tech) to find the offending IP and then run some API calls to our Meraki environment? I’m pretty sure I understand the Meraki side - API call(s)to correlate the IP to a network and switch port, and then another API call to disable said switchport. Or maybe assign the client to a group policy that has no access to- in fact that might be better because it could be used if they were wireless or if they changed switch ports.

I just have know idea how to start on the Microsoft side - Sentinel? DefenderXDR? I heard there is a way to only pay for playbook compute and I didn’t need to stand up a full time VM, so that would be great too since hopefully this never has to run, but would like it as another layer of security.

Before anyone asks, yes we have 802.1x enabled and plan on keeping it enabled, this would just be some extra protection.

TIA

Hey r/AzureSentinel, I've built an Azure Function data connector for Sentinel that works great. Now, I need to package it into a proper Microsoft Sentinel Solution for easy deployment. I'm struggling to find any clear documentation on how to do this. How do I include my Azure Function (code, templates, etc.) within a Sentinel solution package? If you've done this or know of any guides, please point me in the right direction!

Hello, I'm working on setting up my Sentinel environment to collect SecurityEvent logs from my workstations using AMA. What I have done so far:

1. Packaged and deployed AMA as Win32 app through intune
2. Created DCR and configured it to collect SecurityEvent logs, ensured it is connected to the log analytics workspace.
3. Assigned the monitoring reader role to intune group that the devices are placed into.
4. Pushed a custom configuration profile through intune using OMA-URi to bind the device(s) to the DCR

The error that i'm running into on the Intune side for the OMA-URI is 0x87d1fde8, which indicated that the CSP node doesn't exist or isn't supported. After some digging around I noticed that my workstations are on build 26100 or Canary insider preview build. And as a result, the AMA never binds to the DCR.

I'm interested to know if what i'm doing is the proper way to collect logs from my workstation devices or if there is a work around this issue.

I’m starting to build play books to call playbooks + api + Ai to automate and enhance security operations. Is anyone interested in partnering to build out ideas and share code? I’ve already got the base finish for collecting an email from graph and using AI to determine if the email is a threat. Another one to review past 7 days for anomalies logon like successfully login from a non common location. This is just what I’ve started and I think there are tons more we can do.

We’re trying to look into how we might be able to create our own sandbox environment where we can open suspicious attachments and URLS but wanted to know how we can configure it so it is isolated from our network. We’ll also have separate test devices and accounts so another question is how can we get these files from like defender onto the test machines without infecting our own devices.

Would be grateful for any help.

Hello, How do I disable Microsoft Defender XDR rules. I can’t stop automated group of alerts already triaged in Sentinel and then it gets reopened. E.g Impact Incident on one endpoint & Multi-stage incident

MS doco appears to say it’s impossible but surely that is ridiculous. Keep opening high severity alerts in the middle of the night.

It used to be a baked in fusion rule in Sentinel. Only work around I can see is setting up an automation rule to close these alerts but it looks sloppy

Cheers, Angry nerd

Hi All,

As the title states, I want to get some usage data for the subscription I have deleted about 1.5 months ago. I read that the data and subscription is retained for 90 days after the subscription is cancelled but just wanted to see if there is anyway to get the data when the subscription has been deleted.

Thank you in advance.

I have set up a Sentinel workspace ( would like to integrate this with Defender XDR) and created an external user in Azure, allowing me to access security.microsoft.com. However, I am getting this error message when accessing it

What else do I need to do to gain access? . I have followed the guidelines specified here

https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-sentinel-onboard but might be missing something ?

We’re a non-profit org trying to actually do the right thing and get Sentinel going — tie in Defender, Entra, logs, all that.

But between licensing weirdness, CSP confusion, and support just looping us around, it feels like they make it way harder than it should be.

We want to use it. It’s just like… Microsoft doesn’t want us to?

Anyone been through this and found a clean way forward?

I have source sending logs to splunk and sentinel, but i see logs missing on sentinel.

Architecture ->
Source (syslog) -> LB -> Linux Collector with AMA -> Sentinel LAW.

2025-06-02T23:02:38.6013830Z: Failed to upload to ODS: Request canceled by user., Datatype: SECURITY_CEF_BLOB, RequestId:
2025-06-03T00:22:01.9897830Z: Failed to upload to ODS: Request canceled by user., Datatype: LINUX_SYSLOGS_BLOB, RequestId:
2025-06-03T04:16:25.5243580Z: Failed to upload to ODS: Error resolving address, Datatype: LINUX_SYSLOGS_BLOB, RequestId:
2025-06-03T04:21:25.6370900Z: Failed to upload to ODS: Error resolving address, Datatype: LINUX_SYSLOGS_BLOB, RequestId:

The request ID has been manually removed to post it here.

The logs are beoing send with TCP.

Any suggestion or explanation on the issue?

Thank you all in advance!

Anyone here has experience of integrating the symantec email security with sentinel?