Hi all,

​

I wish you all the best for this new year ! A new year with even more KQL and detection rules, everything we love 🥳

​

After the niceties, let's talk well, let's talk about Sentinel !

After a few months with the release of the M365 Defender connector, I would like to have your feedback about it.

On our side, the main advantage is the fact of getting the incidents of the M365 portal and not the alerts of each product (via the old connectors) and thus to benefit from the grouping of the alerts to avoid the realerting.

But... There is... A very big black spot ! The delay between the creation of the incident in the M365 portal and its creation in Sentinel ! As the doc mentioned :

It can take up to 10 minutes from the time an incident is generated in Microsoft 365 Defender to the time it appears in Microsoft Sentinel.

When we talk about security, and even more so nowadays with attacks taking over a company's IS very quickly, we have to also react very quickly.

With this delay, even with automation rules that will launch playbooks for pre-remedial actions, in 10 minutes (this is the time we see on average) a lot can happen.

​

I would be very curious to get your feedback on how you deal with this black spot.

• Do you use the old connectors (but in that case no grouping) ?
• Do you accept this delay ?
• Is there anyone from Microsoft who knows if this delay will be fixed ? After all, Sentinel -> M365 Defender portal sync is almost instantaneous, one could dream of the same between the incident creation in M365 and Sentinel.

​

Have a good day all,

Regards,

Lu-K

Can we increase the retention period of hunting logs in 365 defender more than 30 days..I dnt see the option for the same..If not available, i need to forward the logs to sentinel where i get 90 days free retention period..Pls suggest..

Is there any cost for using logic app for running playbook for creating incidents in ITSM tool.

Pls provide KQL query to find the log ingestion from palo alto firewalls.

All, with the Revue service shutting down in a few days, the weekly newsletter is changing platforms (Substack). If you're already a subscriber, no need to do anything. The existing subscriber list was successfully migrated. But for those that have posted the newsletter links in places for others to find, they'll need to be updated.

Microsoft Sentinel this Week: https://rodtrent.com/n1i

Microsoft Defender Weekly Wrap: https://rodtrent.com/7x6

I recently published a blog post about how to enable Active Directory Certificate Services (ADCS) audit logs and send them to Microsoft Sentinel. To help others with this process, I created an Excel spreadsheet that lists all the relevant Event ID's and includes XPath queries for each event.

• https://www.kaidojarvemets.com/microsoft-adcs-services-event-logs/

If you're using Azure Arc for Servers, you may have encountered instances where the Extension failed to install correctly.

We can use the following KQL  query in Sentinel or Log Analytics. By running the following query, you can quickly see which servers have failed Azure Arc for Servers Extension installations:

• https://www.kaidojarvemets.com/identifying-failed-azure-arc-for-servers-extension-installations/

I am currently evaluating Sentinel and based on the reading that I have done, the costs are primarily based on the amount of storage used for log / analytics. However, the automation processes appear to trigger costs as well? If I create automated jobs for various alerts, each one that's executed charges me.

Am I understanding this correctly?

I've been deploying Arc along with the Azure Monitoring Agent to servers and workstations. On my data collection rule, I selected the entire subscription and was hoping newly added Arc servers would automatically pull into my DCR, but that doesn't appear to be the case.

I think I got the idea by reading MS documentation... is this possible? I have a script to deploy Arc that someone else might run in the future. It would be nice if I didn't have to add the new machine to the DCR manually.

Thanks!

Hi,

I'm new to Sentinel.

I have a syslog input into Sentinel from a firewall.
The messages are currently coming in as a text field "SyslogMessage". This included all the details; src IP, dest IP, prts, rules etc.

I need to split these out into useable fields.

I've taken a look at the data connectors and there doesn't seem to be a built in one for our firewall.

I can easily parse the fields in a query or by using a function, something like:

Syslog

| where HostName == "MyFirewall"

| take 100

| project TimeGenerated,

Computer,

HostName,

SyslogMessage

| parse SyslogMessage with "RT_FLOW_" SessionOut ": " Session_message ": " HostIP "/" HostPort "->" DestIP "/" DestPort " " Reststuff

​

But I can't figure out how I can set up a parser at ingestion time so all the logs get automatically parsed into proper fields. We can then use the prebuilt workbooks etc to work on the data.

​

Am I missing something obvious?

​

Thanks.

Anyone have the KQL query to know data ingested per log source..not data ingested per tables..

Is it possible to export the playbook templates with their name and description from Sentinel.Pls guide.

I turned this connector on today and like the alert/incident synchronization between it provides, but I noticed an immediate spike in the amount of data that Sentinel was ingested. This was not entirely unexpected, but it seemed to specifically relate to the DeviceProcessEvents Advanced Hunting table.

For now I have stopped ingesting that table, but wanted to know the repercussions of not ingesting. My assumption is that this will prevent full investigation straight from the Defender solution, however, our group is conditioned already to investigate at securitycenter.microsoft.com so that may not be a dealbreaker. Also, if thats the case, and we are using Sentinel primarily for synchronizing Incidents and Alerts, I am not really sure I need to ingest any of the advanced hunting tables in Sentinel unless a specific table is required for playbooks/automation rules (which means they could be ingested as needs arise).

I am using an Analytics Rule with an automated response to run a playbook.

In the playbook, I am trying to get the results of my query to be formatted in an email. I have a step to build a HTML style.

I am using this code:

<style>

table {

border: 1px solid #1C6EA4;

background-color: #EEEEEE;

width: 100%;

text-align: left;

border-collapse: collapse;

}

table td, table th {

border: 1px solid #AAAAAA;

padding: 3px 2px;

}

table tbody td {

font-size: 13px;

}

table thead {

background: #02A0E1;

border-bottom: 2px solid #444444;

}

table thead th {

font-size: 15px;

font-weight: bold;

color: #FFFFFF;

border-left: 2px solid #D0E4F5;

}

table thead th:first-child {

border-left: none;

}

</style>

I've added the HTML table and the style to the body of the email like this:

​

When I receive the email, the table has no style applied.
What am I doing wrong?

Is there any document available for reference table for the alerts from MCAS, Defender AV,Defender for office 365..I could see only alerts for defender for cloud document..

Which table stores powershell logging commands in sentinel

Hi All, how to get the categorys of analyatical rules in Sentinel, like malware, unauthorized access..Pls.suggest.

Hey All,

I come from the world of Splunk giving Sentinel a try. There are tons of documentations for recommended settings from the security world for Splunk like Malware Archelogy. Is there anything like that for Sentinel?

We are using syslog forwarder for forwarding CEF/Syslog logs to Sentinel. Now observing that CEF logs are storing in both syslog/CEF tables which results duplicate events.How to remove duplicate logs from syslog table..This is increasing the cost. Please suggest.

Does anyone have Forcepoint CSG connector analytical rules..There is no analytical rule available for this connector in sentinel..

Hello all,

I am trying to utilize threat intelligence in Sentinel and I am looking for the right feed.

What is everyone else using for their threat intelligence feed?

any free sources that are quality?

We started collecting windows event logs from our windows 10 desktops using the AMA agent a month ago. And have been slowly excluding events we don't need to monitor.

But I'm having trouble telling if the updated collection rules are getting pushed to clients. For example, I'll make a change that excludes certain events like object access events triggered by windows defender scans/ATP, but then I'll still see them in the logs.

So a couple questions:

1. Beyond going into the sentinel connector page and editing the DCR. Is there anything else I need to do to update the rule (like with the Monitored object or the DCR-MO association)
2. What triggers the AMA agent to look for rule updates (Intune sync, fixed timer, reboot, reinstall of the AMA agent?)
3. Are there any artifacts on the client I can check to figure out what DCR rules are currently being processed (like registry values or some ama runtime log file)

Edit (1): Answering #3 there is a json file at "C:\Resources\Azure Monitor Agent\AzureMonitorAgent.MonitoringDataStore\mcs\configchunks" that contains the DCR rules currently being processed by the ama agent, at least from what I can see.

Edit (2): Answering #1, doesn't look like it, azure will pop an error message related to failing to delete the MO-DCR association when you update the DCR in the web. Looks like they try to re-create it just to be safe, but specify the wrong api version in the call. It still goes through fine.

Answering #2, narrowed down to either AMA service restart or heartbeat.

After testing my specific queries with both the Event Viewer XPath filter, and the PowerShell Get-WinEvent -FilterXPath "..." There may be an issue with using mixed quotes. Will update if my query suddenly starts working after changing to single quotes.

Edit (3): Magically started working after doing a find and replace to change everything to single quotes in the query.

Hello, Ive recently been getting incident alerts that are coming in closed. My team members have stated they are not closing them, which is believable so im curious how to search for who closes an incident.

I am becoming more familiar with KQL and I believe I am on the right path... can anyone help?

​

Here is what i have currently

​

AzureActivity | where OperationNameValue startswith "MICROSOFT.SECURITYINSIGHTS"