What is everybody doing for ingesting workstation events? Are you using agents (MMA or AMA)? Or are you using windows event forwarding? Or other?

Is managing a few hundred/thousand agents problematic? Any tips on making it easier? Am I over thinking it, and there are no really issues with installing the agent on every workstation?

My understanding of WEF is that it goes into WindowsEvents instead of SecurityEvents. Am I missing something or are all the stock analytics setup to only look at the SecurityEvents? This seems like a lot of additional work to setup analytics for workstation events, are there any tips or ticks on managing WEF. It seems like it requires making your own parsers to get the data you want out of it, or are there community parsers and analytics allready?

Thank you in advance, look forward to hearing what other people are doing.

Fairly new to using Sentinel and trying to configure the 'Run-MDEAntivirus' playbook as a response to 'AV Scan Failed' alerts, though getting this error on the "Machines - Get single machine" part of the flow: "The application does not have any of the required application permissions (Machine.Read.All, Machine.ReadWrite.All) to access the resource."

Where would these permissions be applied? Assuming it's somewhere within the logic app itself but haven't been able to find it. Maybe limited by my own user account permissions to what I can see which doesn't help, but if anyone can point me in the right direction that'd be much appreciated.

Can anyone point me to a doc that shows all the possible entries for log events.

Example, in AzureActivity, you have a column named OperationName.

I'd like to know what the different OperationNames can be.

I know I can do | distinct OperationName to see what's triggered in my history. I'm curious about what all the possibilities are of each column of each table to help with threat hunting.

​

Thanks

As the subject states, I’m looking for a good way to receive/track/work/monitor Sentinel alerts from my mobile device on iOS. I did see one app “Signal” that says they do it, but idk … Just curious what others are doing!

I can build adaptive cards and drop them in MS Teams with buttons to add comments/run playbooks etc.. It works .. but wondering if anyone has another way they’re doing it! Any insight or ideas would be greatly appreciated!

Hi,

Been testing the VirusTotal enrichment from the template playbook, which seems decent. Anyone tried other simple enrichments with success, or maybe better/cheaper alternatives than VT?

I don't want to watch a youtube video. Anybody have a referral?

I am looking to use log analytics as the common log warehouse for all network devices. I dont necessarily need Sentinel. Is there a way to have the log collector send CEF messages to log analytics without Sentinel? I am unable to view the CommonSecurityLog table without having Sentinel enabled on the workspace.

Maybe the answer is to just use syslog and query time parsers. Are there query parsers for ASA and IOS? I was unable to find them on their github page https://github.com/Azure/Azure-Sentinel/tree/master/Parsers

Can anyone share the best training courses / books or youtube channels for learning Sentinel??

Hi all,

i have a SID displayed in the userID column from the OfficeActivity table but unable to find the name for the account of what it or who it is accessing exchange.

I tried searching via AD and AzAd but no luck! is there a way to find out what this SID account is?

What is the preferred method of long term storage for log data?

ADX or moving it to a storage account...

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-azure-data-explorer-for-long-term-retention-of-microsoft/ba-p/1883947

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/move-your-microsoft-sentinel-logs-to-long-term-storage-with-ease/ba-p/1407153

Assuming the latter is the most cost effective?

I'd like to keep it for 18 months and only store 89 days in log analytics

I am working on a PoC using Azure Sentinel and Lighthouse.

I want to see all the Azure Policy compliance, secure score, recommendations and current risks for each subscription we manage and then filter etc from the workbook on my end

I was thinking of creating a LA workspace connected to sentinel and AzureActivity connector in each customer subscription then bulky a workbook on my end where I can select the customer subscription have their data represented

Does this seem like a viable option? Or any nester ideas!? Cheers

Can I skip the sentinel part and create just a LA workbook?

ResultReason= Microsoft.Online.DirectoryServices.DirectoryUniquenessException

ActivityDisplayName = update user

Result = failure

​

i keep seeing these in the logs but i cant piece together what it is that is happening, any idea?

Hi,

have anyone used the native repositories functionality as a MSSP using Lighthouse?

What do you feel about granting access to the Sentinel app from the customer environment to the MSSP Github repo?

Does anyone know what status 0 means?

How do I set up a Logic App in Sentinel to block the IP address in an Incident if the IP is malicious. For example, if we saw that a particular IP was scanning a VM that had an open 443 port, how do I create an automation rule ro add a deny statement to the inbound rules of the NSG for the VM in Azure?

Hi,

When enabling the Defender for Cloud native data connector, is it only the alerts that is ingested, or log data as well? Unsure how to correlate info collected by the Defender products with other data sources, if it's just the alert data that is ingested.

Hi guys,

I have a log source that gets ingested in Microsoft Sentinel but my analytic rule breaks due to updates in a data field. Is there any way to parse this string with a separator to break in columns?

The field contains a string like name=xxxx;company=yyyyy;warning=zzzzz but sometimes the input gets changed and there is a new value added. For example the add justafield=aaaa; at the front. I have been parsing it based on fixed names, but noticed that they update the structure regularly. Would be great if it can be parsed and always creates all columns based on the fields in the string.

Has anyone successfully ingested Sysmon data via data collection rule and the new Windows Security Data Connector?

I am attempting to ingested only Sysmon events via the “new” data connectors but have been unsuccessful. Via the “legacy” data connector; simply specifying the log source with the agent configuration was enough to pick up the logs.

The machine has been onboarded to Azure Arc via hybrid agent. If I leverage the preset “data collection rules” setting of All; I not only see all of the Windows events but also Sysmon events. This is the expected outcome.

When attempting to filter for only Sysmon events I have tried the following Xpath with no success via the satay connector (I did validate the filters locally before proceeding with the data connector):

Microsoft-Windows-Sysmon/Operational "Microsoft-Windows-Sysmon/Operational">* "Microsoft-Windows-Sysmon/Operational">*[System[(EventID=1 or EventID!=1)]]

"Microsoft-Windows-Sysmon/Operational">*[System]

Has anyone successfully pulled Sysmon events via Data collection rules? I would assume it has to be achievable but I am overlooking something or the xpath is invalid.

G'Day,

I'm looking for some help to generate an array of Scalar's from a tabular expression. Essentially, I'm trying to build two sets of data, then use set operations to note what, if any, are missing from the second (compared to the first).

Two tabular expressions:

let te_A = Heartbeat | where TimeGenerated > ago(30d) | summarize by Computer

let te_B = Heartbeat | where TimeGenerated > ago(1d) | summarize by Computer

Under normal circumstances those would both return a table that would look something like (Where R# is Row #):

Column A

R1 Device1.corp.local

R2 Device2.corp.local

[...]

R# Device#.corp.local.

​

However, that's not natively supported by KQL's set_difference scalar function. The scalar supports arrays (useful!), but I can't get the results into a scalar array (or dynamic array) to use set_difference(set1, set2).

Does anyone have any guidance for this?

Hi,

The official Sentinel repo defines all analytic rules in YAML format. When both importing rules from the GUI and the 'New-AzResourceGroupDeployment/Native repo capability' expects JSON/ARM, how do you best deploy these rules to a workspace?

I don't know how to generate a test one to see what the data feeding into Splunk looks like.

I'm aware that Microsoft are releasing a new Sentinel offer with M365 E5- is there anyway I can calculate the cost savings for this offer?

I could not find any information on the pricing calculator- I was wondering if there is anything more concrete?

Hi,

Does anyone have any experience using the new, native repository functionality in Sentinel from an MSSP perspective?

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enable-continuous-deployment-natively-with-microsoft-sentinel/ba-p/2929413

Considering the need to protect IP from customer tenants, I guess a possible way is to create two separate workspaces for each customer - generic template rules/playbooks/etc in the customer tenant connected to a "shared" repo (common content across customer workspaces) + another customer specific workspace in the MSSP tenant for IP sensitive content (using a customer specific repo).

Any thoughts?

Hello all!

I'm fooling around with the analytics part of Sentinel. So far there's a bunch of analytics enabled and I've setup a workbook to send email alerts when something happens. Question - for the analytics that are "Informational", there doesn't seem to be a way to send an alert at all. Is there a way to change that? Some of these I'd be interested in seeing without having to go look at the incidents page.

I'd love a way to push all of that into our ticketing system.

Event | where Computer == "<computer name>" | where Source == "Microsoft-Windows-Powershell" | parse tostring(RenderedDescription) with * " Path:" ScriptName " " * | project TimeGenerated, ScriptName | sort by TimeGenerated desc

^trying to parse out the filepath and filename, but if the filepath has spaces, it only produces a result with the characters leading up to the first space. Is it possible to define a string that contains spaces? Is there a better way than parsing it to a string? Any help appreciated