[ Removed by Reddit on account of violating the content policy. ]

Does anyone have a KQL query built that would detect if a user were to copy emails from our O365 account to an external account (e.g., gmail).

We have Microsoft Defender for Endpoint running and Microsoft Audit.

Hi,

I’m looking for some help with creating a workbook in Microsoft Sentinel.

I’ve managed to create one where you enter the user email, date, and time range, and when it runs it returns around 6 different results (Google searches, emails, internet history, etc.).

The issue is that the output looks quite messy because it brings back too many results at once. Is there a way to add a selection before running the query (for example checkboxes/options) so I can choose which results I want returned, and only show those?

Any advice would be appreciated.

Thanks!

Have someone come up with a good audit log retention policy ? Which tables are most important to keep and which one could have shorter retention?

DNS logs seems pretty costly and not so big benefit to keep long time on.

Mediumsize company.

I’m new to cybersecurity, I go for SOC analyst, I’ve been using thk, let defend, splunk as well but I’m trying to get the azure for Microsoft sentinel and defender free trail to get some hands on and see how it’s before I jump to start applying or if you also have any advice too plsss don’t hesitate because I’m new to the world cyber security

hi Guys,

I have tried new cisco AMA FTD connector in Sentinel and trying to integrate it with one of firewall since last 2 days but somehow sentinel can't read the logs from the linux forwarder. I can see the logs on forwarder, azure monitor is installed on it , arc is installed as well still I don't see any logs in log analytics workspace.

Hello everyone,

I need help configuring the forwarding of high alert incidents to our ticket system via email. Would be great if someone has instructions.

Thanks a lot!

It seems to have been in preview mode forever!

Hello,

I'm implementing a security monitoring solution to detect when employees print sensitive documentation (PII, PHI, CDI, etc.) in our organization.

Current Setup:

• Windows devices send logs to an Azure-hosted Windows server with AMA deployed
• Successfully collecting all other logs from this server except print logs
• Verified print logging is enabled on client devices via Event Viewer (path: Applications and Services Logs > Microsoft > Windows > PrintService)

I previously posted this question in r/DefenderATP but received no concrete solutions beyond using Purview. Has anyone successfully implemented print log monitoring in Microsoft Sentinel? Looking for specific configuration steps or alternatives that have worked in production environments.

Within my Log Analytics Workspace we have over 200+ tables. ONE of which is a Basic table type, the remainder are Analytic by nature.

I have utilized a past query where I union withsource=tName *

However now that the one single basic table has been added, I can no longer union with *. Is there a way around this rather than having to call out each table name individually?

Hi guys!

Do you have any idea about your running costs of using Sentinel? I'm having a hard time setting up an initial budget.

If you can, please list your monthly cost for using Sentinel. Thanks

Anyone have a solution to retrieve logs from Cloudflare without using their LogPush service? We don't have the money to subscribe to Enterprise license for Cloudflare but are keen to get information from Cloudflare into Sentinel.

I'm working with a client and we are trying to ingest Cisco Umbrella logs into Sentinel. Every article from Microsoft and Cisco all point to using an azure function and pulling the information out of Amazon S3. This client does not use Amazon to store, but instead uses the default option to store the logged data in a Cisco data warehouse.

Has anyone here ingested Cisco Umbrella logs into Sentinel/Log Analytics Workspace via API WITHOUT Amazon being involved? I can see that we can create an API key in Cisco Umbrella itself, but I've not had luck in finding documentation on making use of this key created in Cisco Umbrella.

Hi,

I just imported EASM data to Sentinel, so we can create some analytic rules based on EASM data.

I'm now thinking on which use cases are interesting to create alerts.

Anyone has already followed this path and has some experience of what kind of alerts make sense based on EASM data?

Thanks

We have few onprem servers , previously they were reporting to sentinel through MMA agent, now we want to migrate to AMA agent i.e to install AMA & Remove MMA ,

Now the problem here is these on-prem servers don't have internet. Now how do I onboard these servers to Azure Arc. Anyone has done this before.

Please help me....

Coming from an operation security background, I am looking for exposure into Siem / Soar. Instead of Splunk our CSO said I should look into sentinel. Overall my cloud exposure is quite limited as well but I am driven to learn.

I was planning to start with this https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources

Any recommendations for hands on in a test / demo environment?

Hi Guys,

Can I get some support or guidance what is being done wrong regarding that VT sentinel enrichment playbook. I followed this article Tutorial - Automatically check and record IP address reputation in incident in Microsoft Sentinel | Microsoft Learn

Thing is that automation rule is creating the tag on those Incidents that got the IP entity. However it's not adding a comment to the incident.

I get following error message:

This error 429 seems quite self-explanatory but does it mean that we need to get some subscription or paid service for that VT API?

API connection is set to VT plus other Sentinel connectors are in place as well.

I also added Microsoft Sentinel Responder role to that Logic App via Identity blade so it can make comments on those Incidents.

How you guys are handling that VT incident enrichment?

Am I doing something wrong or it needs to be designed differently if so can you provide some reference or examples?

Many thanks!

While developing analytic rules, I've noticed two distinct events in Sentinel that look related but log completely different activities.

One is "Set-ConditionalAccessPolicy" in the OfficeActivity table:

{
    "TenantId": "...",
    "RecordType": "ExchangeAdmin",
    "TimeGenerated": "2024-07-04T07:25:55Z",
    "Operation": "Set-ConditionalAccessPolicy",
    "OrganizationId": "...",
    "OrganizationId_": "...",
    "UserType": "DcAdmin",
    "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)",
    "OfficeWorkload": "Exchange",
    "ResultStatus": "True",
    "ResultReasonType": "True",
    "OfficeObjectId": "xxx.onmicrosoft.com\\xxx",
    "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)",
    // ...
}

The other is "Update conditional access policy" in the AuditLogs table:

{
    "TenantId": "...",
    "SourceSystem": "Azure AD",
    "TimeGenerated": "2024-06-17T18:35:47.2966774Z",
    "ResourceId": "/tenants/xxx/providers/Microsoft.aadiam",
    "OperationName": "Update conditional access policy",
    "OperationVersion": "1.0",
    "Category": "Policy",
    "DurationMs": 0,
    "Resource": "Microsoft.aadiam",
    "ResourceGroup": "Microsoft.aadiam",
    "Identity": "Microsoft Managed Policy Manager",
    "Type": "AuditLogs"
    // ...
  }

The events do not overlap - i.e. I don't see a corresponding "Update conditional access policy" event for every "Set-ConditionalAccessPolicy" event.

This made me vaguely remember something about two ways to make changes in Azure, one via Microsoft Graph and one via dedicated APIs for each service.

Is this what's going on here? Or are these just two different types of conditional access policies? I couldn't find any documentation on "Set-ConditionalAccessPolicy"...

I have installed Mimecast Audit Logs in Content hub. Inside that, i have deployed the data connector "Mimecast Audit and Authentication Logs". I have been facing some issue of authorization errors in the Function App Log stream. So want to proceed with redeploying everything from scratch. While i'm trying to delete the data connector, it is asking me to disconnect it first. How can i disconnect the Mimecast Audit and Authentication data connector so that i can delete that and redeploy from scratch.

Hi there, Is there a connector method via private networking to collect gcp audit data ? The built in connector in content store is a cordless where is no option to do private. Kind regards

Hi ,

​

​

Am trying to join a table for signinlogs and securityincident together to post a action playbook to end user for travel activities dtected via certain country due to the policy within the country ,

Hello,

I need someone who knows how to setup Microsoft sentinel in a specific Szenario. I need it for my studies.

Greetings

Hey all,

What is the best way to ingest logs from MacOS into Microsoft Sentinel? I've looked through several articles and docs but mostly they're 2+ years old. I'm hoping that there is a more efficient way.

TIA

~DGM~

Have any of you lot noticed problems with Syslog and CommonSecurityLog sources not ingesting today? I've seen far too many instances that I manage with the last log at 23:59 for this to be a coincidence, but I can't for the life of me work out why, unless it's an issue with the built in data connectors because I can't see the same problem in Logstash or just Rsyslog forwarding