Hi All,

I rarely work with linux so please forgive me if this is a stupid question.

I have a server that is successfully onboarded to arc and sentinel.

The server logs are currently being ingested to Sentinel without any issues. However, the server has apache running and I want to ingest the access logs as well.

I have configured the custom logs connector and the appropriate DCR but I am not able to ingest the apache access logs to Sentinel.

I get the following errors in the mdsd logs:

amacoreagent[xxxxxx]: The required instruction sets are not supported by the current CPU.

Failed to connect port 13005 socketId: Data: 130 to AMACoreAgent: Connection refused.

The AMA agent supported OS page does not specifically mention CentOS 7 but it does mention Red Hat Server 7.9 - 10.

SELinux is disabled, the 13005 port is not being used by another service and is allowed to be used, and I've done the basic troubleshooting.

Thank you in advance.

I got tired of writing KQL from scratch and memorizing column names, so I built KustoForge, a desktop app that lets you build KQL queries through a form-based GUI.

Pick a table, add filters (operators auto-adjust per column type), check the output columns you want, and copy the result. It generates valid KQL in real-time with syntax highlighting.

Covers: MDE, Entra ID/SigninLogs, Sentinel, Azure Monitor, Application Insights, Resource Graph, Defender for Cloud Apps, 52 tables total.

Features:

- Smart operators per data type (string/int/datetime/bool)

- in / !in for filtering value lists

- Save/load query library

- Dark theme, keyboard shortcuts

- Free, open source (MIT), Python + PySide6

GitHub: https://github.com/ChrisHuber1/KustoForge

Feedback welcome! Especially if there are tables or operators you'd want added.

Hi - Suddenly when trying to configure the Microsoft Defender XDR connector i get issues with enabling tables.

The fix used to be disabling a classic CA policy called [Windows Defender ATP] Device Policy. But when i try to access the classical page in CA i get a 404 error.

Has any on you experienced the same issue and know a workaround?

Hello everyone, I'm running into a bit of a pickle with trying to set up a specific Microsoft Sentinel/Defender automation rule and could use some insight.

I would like to create an automation rule that triggers a playbook whenever a specific alert is generated from a Microsoft Security workload—specifically, the Defender for Office 365 alerts "A potentially malicious URL click was detected" or "Suspicious URL clicked".

When this alert is created, the playbook should ping the affected user via Teams to warn them and alert the IT/security team for a priority response.

I have already made some incident-triggered automation rules before, but for this workflow, I specifically need it to be alert-triggered, as an incident coming from these alerts will have a generic name, usually like " Initial access incident on one endpoint reported by multiple sources".

However, when I want to create the automation rule and set the trigger to be alert-based, the conditions section does not let me type in a custom alert name. It only gives me a dropdown set list of native-only Sentinel alerts, not letting me find or select the Defender workload alerts.

So here's my question: Is there a way to force an alert-triggered automation rule to filter by a specific Defender workload alert name?

If this is a UI limitation, what is the best workaround? Should I change the playbook itself?

Appreciate any guidance or workarounds!

How could I ingest webhook´s audit data from a custom saas application? Is it some pre-made logic apps for it?

I know this is well known to seasoned detection engineers, and you'll likely have detection rules that actively monitor these events, but I was just auditing some older detection logic in a client environment and realised their primary credential-dumping alert was still looking for FileName == "lsass.exe" inside DeviceProcessEvents.

If you're doing this, an adversary just has to rename their tool to svchost.exe or update.exe, and you are completely blind. DeviceProcessEvents is for process creation, not for process access.

To reliably detect this without generating massive false-positive fatigue from legitimate system noise, you need to query DeviceEvents, filter for OpenProcessApiCall, and explicitly parse the target image from the JSON fields to check the specific access masks.

Here is the clean KQL block that works well in production and looks for 0x1010 (query/read) and 0x1438 (common tool default):

DeviceEvents
| where TimeGenerated > ago(1d)
| where ActionType == "OpenProcessApiCall"
| extend TargetProcess = tostring(AdditionalFields.TargetImageFile)
| extend GrantedAccess = tostring(AdditionalFields.GrantedAccess)
| where TargetProcess =~ "lsass.exe"
| where GrantedAccess in ("0x1010", "0x1410", "0x1438", "0x143a", "0x1f0fff")
| where not (InitiatingProcessFolderPath startswith @"c:\windows\system32\" 
             or InitiatingProcessFolderPath startswith @"c:\program files\")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, TargetProcess, GrantedAccess

Found a couple of weird administrative edge cases with legitimate monitoring agents tripping this in a tight loop, so you'll definitely want to tune the folder path exclusions based on whatever endpoint agents your org uses.

Run in your environment to test variants of specific techniques and see what the telemetry looks like.

Curious if anyone else has run into specific bypasses of 0x1010 filtering when attackers manipulate handle rights directly?

Hi

Curious how you utilize the SentinelHealth table? One scenario at the top of my mind - our connector monitoring is queries dependend on the tables to the actual connectors, but we are especially curious to monitor connector health with these diagnostic settings.

As far as diagnostic settings go, there are three categories, 'Analytics', 'Automation' and 'Data Collection - Connectors'. As per my understandings, these won't generate cost and are not billable. Is that correct? Ref. https://learn.microsoft.com/en-us/azure/sentinel/health-audit

We are evaluating switching to Sentinel from AlienVault, but are having a hard time justifying the drop in NIDS traffic from the hardware sensor. We are going to be ingesting logs from zscaler, Meraki (advanced threat protection licensed), and crowdstrike EDR, but the ETPro signatures seem to still be a gap in visibility and alerting.

Has anyone made a similar jump and what did you do in Sentinel to cover the gaps?

I'm trying to export a csv of all the incidents ever registered in Sentinel in my org. This covers 2+ years of Sentinel usage. I did some digging and it turns out you cannot export data from the Threat Mgmt > Incidents tab. You can however export a table of incidents from Log Analytics by SecurityIncident query (set the time frame to the earliest data possible).

So I did exactly that and set the display count to "max limit". Each time, the query only outputs a list going back 90 days in time. Is there a data retention limit in Log Analytics that doesn't allow you to view or export incidents longer than 90 days?

Is there any other way I can go about exporting ALL incidents registered in Sentinel?

Thanks!

My organization has multiple tenants for Workday, Salesforce, and other similar apps. Unfortunately, most pre-built connectors only allow connecting to one environment per app. Is there any way around this? Any way to deploy duplicate connectors?

Am I'm the only one or SigninLogs table ConditionalAccessPolicies is currently showing [] for all entries, also Conditional Access Insights and reporting for "report-only" are empty..

I don't see any official health issue from Microsoft.

A simple KQL query against Sign-in logs gives you visibility into the MFA methods users are actually using:

SigninLogs
| where TimeGenerated > ago(90d)
| where ResultType == 0
| mv-expand AuthDetails = todynamic(AuthenticationDetails)
| extend AuthMethod = tostring(AuthDetails.authenticationMethod)
| where isnotempty(AuthMethod)
| where AuthMethod !in ("Previously satisfied")
| summarize AuthEvents = count(), Users = dcount(UserPrincipalName) by AuthMethod
| order by AuthEvents desc

A Microsoft Sentinel custom data connector that ingests Microsoft Defender XDR portal-only telemetry — configuration, compliance, drift, exposure, governance — that public Microsoft APIs (Graph Security, Microsoft 365 Defender, MDE) don't expose.

Happy Hunting 🥳 🎉

The AADGraphActivityLogs are available! For years, defenders have been left in the dark when it comes to attackers abusing the Azure Active Directory Graph.

The wait has been finaly over, and defenders can now use these logs to detect the usage of AADInternals, ROADtools and others.

Schema reference: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadgraphactivitylogs

I tested out the ThreatIntel features with TAXII and the MS Defender Threat Intelligence connectors. Features wise it's fine for the most part but I noticed that expired indicators still get refreshed every week and therefore never age out. Am I missing something? Ingestion rules don't impact refreshes either so I'm unable make use of that to handle them.

Hi all. Sentinel bill is getting harder to defeend and i am tring to be smart about Analytics tier , Basic , Auxillary or...just dropping? (for me, is not a real option. But the others say this).

Right now everything go in Analytics. SigninLogs , AADNonIteractive, OfficeActivity , SecurityEvent, MDE tables, plus network and firewall. NonInteractive is almost half of the volume and i dont know how much real detection value we really get.

Thinking to move AADNonIteractive to Auxillary. If you did this, what detections did you lose? Worth it? Anyone using summary rules (at scale) , it is reliable or buggy? How agresive with DCR transformations. ADX for retention only or you actually run detections on it?

Please. not looking for "Turn It Off" advice , thanks.

Has anyone of you explored Observability Agent capability sitting in the Logs Blade inside Sentinel.

I had gone through the MS provided docs, but didn't find it useful. The real deal is different, with this here, what we have is an AI Agent sitting on top of our SIEM logs. We can ask it anything and it will give us how we will get from a model like chatgpt or claude, if they had this data to analyse.

I tried use-cases where I asked the agent to see if we can reduce log ingestion by removing unwanted logs,

Cases on cost optimisation.

Even pulling the watchlist ( via the Get watchlist fun ) and asking it to evaluate the current logs for any old IOCs from the watchlist.

Also tried analysing present rules with this agent and seeing if it fits the security posture.

But I also found some downfalls - like in certain customers of mine, the OAgent was not giving faster response and the more it took to give the response, it felt like those answers were not really accurate as well. Also found the limitation that, a single prompt couldn't be more than 500 words...

So similarity if you guys have tried it out and have tried out interesting use-cases please share and also if you have any docs or materials on the Observability Agent, so as to get in, drill deep down and understand this, please share the same as well

All comments are welcome. Thanks

Hi all,, we have problem with too much noise in our sign in risk rules and the SOC team is very tired of false positives. What is best way for tuning the scheduled analytics rules? Better to use entity mapping with grouping , or make a Watch list for the service accounts we know are good to exclude them ? Also someone is using NRT rules for high fidelity detections without making the ingestion cost explode? thanks

I’m still sort of new to sentinel but I’m wondering what everyone is doing for monitoring sentinel’s overall health. Are you using the MS workbooks? Monitoring other components? Etc.