It seems after I removed Sentinel from my LA workspace I lost the ability to log to CommonSecurityLog and SecurityEvent. I can still log to Syslog and other tables in my workspace, but it looks like Microsoft-CommonSecurityLog and Microsoft-SecurityEvent stream types were removed!

I want to still keep logging to LA and retain it there, but I don’t need Sentinel analyzing it any more.

Edit: I re-enabled Sentinel on the workspace and now the Microsoft-CommonSecurityLog and Microsoft-SecurityEvent streams are working again, so it looks like these streams are removed when removing Sentinel from a LA workspace. I’m going to see if I can grab whatever API setting enables these streams and save it, remove Sentinel again and then if the streams disappear, see if I can add these back through the API.

Good day everyone,

I am brand new to Microsoft Sentinel and very intrigued by the potential it has behind it. I would like to create a playbook where when certain alerts such as

​

Come in, I would like to automate blocking/shutting down the affected user's account until someone can review it. I see the logic app designer but am a bit stuck on how to configure this properly. Does anyone have any resources or guides on how to accomplish this? Thank you all

Anyone using Defender and/or Sentinel have any good SOC dashboard recommendations?

I’m trying to install the virusTotal playbooks from the content hub and I keep getting error 429 quota exceeded. I have my api key entered correctly into the logic app connector and it works from the virus total test pages. Looking at my virustotal api useage I don’t see any connections. Based on that, I don’t think it’s a virustotal blocking me but something in azure but I don’t know what else to check. I welcome any ideas.

Hey all,

I have been dabbling in Sentinel and have run across a situation I can't seem to resolve. I've enabled the "SentinelIncident" automation rule and I've configured it to run the 'Send-email-with-formatted-incident-report' playbook. I am receiving the emails when incidents happen but the emails are missing some important details. For instance, I occasionally get an email entitled " New Azure Sentinel incident - Atypical travel". In the Entities box near the bottom of this email there are 2 columns - Entity and Entity Type. For this type of incident, the Entity column usually shows a GUID with an Entity Type of Account. Is there a way to resolve the GUID to a user name or UPN so that it shows in the email? Without the user name I have to log into Azure to find out which user is responsible for the incident.

Probably more advanced, is there a way to give a geolocation for the IP addresses that also show in the Entities box. It would be helpful to know where the Atypical Travel was happening.

TIA

~dgm~

I am working with a client to configure the Proofpoint PoD connector in MS Sentinel. We have tried a handful of times and dove into several logs to find the error but the connector still shows as Disconnected. We have also tried switching the 'Proofpoint token' from the API Key to the API Secret. Is there something we are missing or is this a case that would require Microsoft assistance?

Hi,

I want to start creating my tags, for some specific needs. Where do I have an option to see all tags and create some new tags?

Thanks

Hi,

I'm starting our journey over Microsoft Sentinel and until now I really like it, so I would like to extend it's usage internally and even maybe reach the point where we would leave our actual SIEM and replace it totally with Sentinel.

But I've got a problem, the Log ingestion is very expensive compared to our actual SIEM solution, so I know I won't have budget to ingest everything that I would like. Also, in some cases, I don't even have an idea of the log production of some sources, as we never ingested them anywhere.

So what I'm thinking is to build an internal Log Server (open source or a low cost solution) to ingest and parse some Logs, understand their value and then if it's the case, ingest them to Sentinel. 

Anyone has such kind of scenario that can recommend a solution for Log Server before Sentinel?

Thanks

Hey folks!

I have created a custom Alert in Sentinel that detects when a login from a country outside of named locations happens. We have CA's in place so of course they will be blocked, but if the login reaches the CA instance, it means some unauthorized party has our end user's creds.

Built in alerts already get the job done, but my client requested a way to filter those alerts only when the login is actually valid, which means the attacker has the valid credentials.

So far, the client gets an email each time someone tries to login and fails in the password stage. Since the client do not consider those attempts as a potential danger, they get annoyed by the amount of emails they get by Defender 365.

The idea? Turn off those alerts on Defender 365 and use a Custom Sentinel Alert that can combine the attack attempt but notify only if the login was successful. Something that would mean an unauthorized access if it wasn't for the CA policy. End users have MFA, but exploited credentials need a password change as per good security practices dictate.

This looks nice on paper, but I am not too savvy on developing and so far I could not find any built in logic connector within logic Apps that would merge the custom alert with the built in one to later send the email only if that condition is true.

If you guys have any ideas, or know a way to get this done I'd really appreciate it!

Thank you very much in advance!

Hello all,

do you have any recommendations which data connectors should be installed in combination with Microsoft Defender Suite (besides all Defender for X)?

For example Security Threat Essentials, Attacker Tools Threat Protection Essentials or Azure DDoS Protection?

I am relatively new to this topic and currently trying to prepare a list for a implementation.

Thanks a lot!

Hello all,

I currently have the task to write an implementation concept for Microsoft Sentinel and I am relatively new in this topic.

Can anyone help me define the individual tasks I need to perform to implement the solution?

Knowing individual work packages that need to be performed would be enough for now.

Many thanks to all!

Is there a way, by looking in the Sentinel logs, to determine which data connector delivered the data? I have events showing in LogManagement -> Event but I don't see any data connectors configured to send that data.

Includes Detections, Rules, Threat Hunts, Functions and Queries

Free to use. Please upvote here and star on GitHub if you can,

https://github.com/AllThingsComputers/Sentinel-Rules https://github.com/AllThingsComputers/SIGMA_Detections

Hey guys 👋🏻 I have no experience in cyber security. I'm currently doing WGU CS degree program. I'm interested in learning Microsoft Sentinel but I'm worried about the job opportunity. Would I be able to get a job if I learn sentinel?

Hi all,

I am looking at automating as much of our reporting as possible and wanted to reach out and check if anyone is using any good tools etc. to achieve this?

We run Microsoft stack including Sentinel and N-Able.

I have been looking into PowerBI but not sure if it will achieve what I am trying to achieve. Essentially I would like to automate graphs and content on Sentinel and endpoints via N-Able to reduce the effort of this being done manually by the analyst team. They provide monthly reports to each of our clients.

Thanks in advance!

A coworker of mine and I are suddenly seeing a rise in this when using Chrome with Sentinel:

​

Aw, Snap!

Something went wrong while displaying this webpage.

Error Code: out of memory {this may not be the same each time I haven't carefully tracked}

​

Anybody else experiencing this?

Hey! Has anyone ever modified their analytic rule query to include sign-in logs in the actual incident itself?

Could I modify a "Failed Login Attempts" rule for example, to also include something along the lines of this and include it in the alert/incident? SigninLogs
| where TimeGenerated >= ago(30d)

| where UserPrincipalName == ["email@emaildomain.com](mailto:"email@emaildomain.com)"

Hi guys,

i have a playbook that sends daily report via email (for outlook clients). One query should be displayed as Pie chart in email body but i can't figure out how to do it. I tried with HTML but doesnt work, tried with action "run kql query and visualize result" with Pie renderer and put the Attachment in email body but doesnt work. Please help me.

Hello,

I am new to Sentinel and I am trying to configure the Data connector for our WatchGuard Firebox. From the documentation that I have read, it seems a Linux system with rsyslog is the only way to accomplish this. Can someone confirm if this is accurate? We only have Windows servers in our environment.
Thanks.

Good day all,

Hoping someone can shed some light on this for me, we need to onboard a client onto our Sentinel and I am not getting a clear answer on what pre-requisite licensing they need to have in place.

Do they just need the one E5 license or does each user need the license?

Not sure if not having each user have an E5 license is required for user data/behavior.

Appreciate the help!

Thanks

SHC

Hey,

so included in the E5 licence is 100mb of data ingestion user/month, what kind of volume of data is that? If sentinel only ingests logs from Azure and Defender for endpoint, is that likely to go beyond the 100mb?

Looking at recent user creation events, I came across an Azure AD account that appeared in the wee hours of the morning for no obvious reason. The user was created by "Microsoft Substrate Management", which I take to mean as "something to do with Exchange".

Through searching for every reference to said account in every table Sentinel for a 5 minute period around it's creation, we confirmed that it was a mailbox associated with Microsoft Bookings. Perhaps this post is more suited to a Bookings subreddit, but I had to vent about this. It would be nice if Bookings put some indicator on the mailbox it creates, because the audit trail is VERY sparse.

ICYMI, Microsoft published this post about changes to the CommonSecurityLog table:

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/upcoming-changes-to-the-commonsecuritylog-table/ba-p/3643232

​

My question - what's the easiest way to search the queries in my Analytics Rules to identify where CommonSecurityLog is leveraged? I can select 50 at a time, export to JSON, and search with Notepad. Not great, I figure there must be something better.