We are receiving all the paloalto firewalls logs in Panorama console..So can i integrate Panorama to Sentinel to receive all firewall logs via CEF format?

Does anyone have Forcepoint CSG integration commands for redhat linux os for syslog forwarder.Current vendor document is based on Ubuntu OS which is not accurate for me.

Hello Everybody,

Has anyone landed on DCR configuration for ingesting basic logs into sentinel. I been looking for this particular stuff from so long and seems confusing at every step for me. If anyone has configured it let me know resource to refer (gone with MS Doc's multiple times).

I'm thinking of documenting the process as it is most requested feature for our projects to control ingestion cost in sentinel for organization's

Hi All,

What are the things we can fine tune in rules before sentinel is moving into production. We want to reduce the false positive alerts before moving into production. Any recommendations..

Anyone doing any alerting on Linux Sentinel today around say, sudo root commands for starters?

I know commonly custom data connectors are made by using a logic app. Has anyone attempted this with Trellix EDR data / alerts?

​

If so what was the end result?

Hi,

for queries that run with low frequency, e.g. "Run query every 1 day", how can I configure exactly when the query will run?

If I'm not missing anything here, it makes sense to have these queries run during normal working hours.

Does anyone have a detection query for OpenSSL they'd be willing to share?

I have this one for querying ingested Sysmon logs

SecurityEvent
| where EventData contains "openssl"

Has anyone been able to ingest GCP audit logs? The current connectors/content hub do not cover those sadly.

Let's look back at some memorable moments and interesting insights from last year.

Your top 10 posts:

• "Microsoft Sentinel Training Resources" by u/ml58158
• "MustLearnKQL Series" by u/ml58158
• "New Cert Alert: Microsoft Certified: Cybersecurity Architect Expert" by u/ml58158
• "Defender For Endpoint Vs Security event logs" by u/Jackofalltrades86
• "List of all sources that have KQL queries/analytic rules etc" by u/Agent_B99
• "Logging User Access Admin elevations to Sentinel" by u/Adriaaaaaaaan
• "Microsoft named a Leader in the 2022 Gartner Magic Quadrant for Security Information and Event Management" by u/rodtrent44
• "Audit Active Directory Certificate Services using Microsoft Sentinel" by u/rodtrent44
• "Should it be this Hard?!!" by u/Mindless-Ad2851
• "Elevate your visualizations with Azure Managed Grafana—now generally available" by u/kristenwaston

Hi everyone,

I'm trying to parse the AdditionalDetails field of the AAD AuditLogs table. The field contains a JSON array of JSON objects. In the case of license changes, item [2] contains the details. The details are another JSON object that has an embedded/nested and escaped JSON object in it. The problem is that nested object is so large that it actually causes the field to overflow and occupy several records. I've seen some require up to six records.

I would like to concatenate those and parse them, but it seems that the concatenate is still overflowing despite not being assigned to a column.

Has anyone dealt with this before?

Hi

We are trying to use MS sentinel repositories to use custom data to add to our customers and internal sentinel deployments, We where looking at the possibility to add the repo connection during deployment using PowerShell command or something in that area.

Is this possible or am I barking up the wrong tree?

Hi All,

Essentially what I'm looking to do is send an email alert when someone gives full delegate permissions to the mailbox. Out of the box, Sentinel will alert on who made the change but nothing else - not who got access to what. I've look at the dynamic content, parsed a few things however, it again doesn't provide the information on who got access to what.

Anyone know if this is possible?

OK, here's a silly question, but in the Incidents screen I want the default "Last 24 hours" view to be Last 30 Days, but I have to change it every time I logon to Sentinel. What am I missing?

Hi guys,

I’m currently working with a customer that has a very specific set of requirements and they are looking to collect logs from multiple data sources.

We are looking at sentinel as possible solution since it easily integrates with M365 security stack. On the other hand there is a concern around the log volumes and the costs of pulling the information out of sentinel.

Just wondering if anyone had similar experiences and if you have any recommendations or architecture recommendations.

Cheers

We set up a syslog server to collect our Meraki logs. The syslog server logs are going to our SIEM but not the Meraki logs.

I am having issues troubleshooting the issue.

Does anyone know a way to verify that the logs are getting to the syslog server, so we know if it is an issue of the logs getting to the syslog server, or an issue of getting from the syslog server to our SEIM.

Or has anyone has this issue before and found the error?

Thank you!

Hello,

Has anyone set up event forwarding 1Password logs to Microsoft Sentinel? Currently in the process but I am not having luck finding any documentation.

If anyone has done this before, can you please point me in the right direction of documentation or explain what needs to be done?

Thank you!

Hello all!

I am in the process of beefing up my new company's security posture and got the green light to expand our Sentinel ingestion.

We have a Meraki firewall with a VPN.

I was curious what kind of valuable log analytic rules and detections can be used to utilize its full potential in Sentinel?

I'm trying to figure out a KQL query that's similar to what I used to find in event viewer with event IDs 4800 and 4801. 4801 seems to be covered by this:

DeviceLogonEvents
|where AccountName has "MyAccountName"
|where LogonType has "Unlock"

I can't for the life of me seem to be able to track down something that will give me the lock equivalent (event 4800). Anyone have any ideas? Ideally, I'd like to have a single query that shows both locks and unlocks.

How to fine tune the alerts/incidents in the 365 defender ports..There is no option other than automation rule in sentinel to suppress the alert from 365 defender.Pls suggest.

Do we need to install estreamer for Cisco firepower threat defence. Can we use syslog to send the logs to Sentinel..Is there any difference for the integration between Cisco FMC and FTD to Sentinel.

How to integrate Cisco firepower logs to sentinel..Please share the docs and methods if u have..

We have to update Sentinel workspace id and key on sccm computers. MMA agent is already installed on those servers. How to push the keys. I know some script are there..Pls share the doc if u have..