980 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
0 answers

How to add a function app for azure workbook and sentinel solution

Hi, I am working on contributing to an azure sentinel solution in github, My solution contains data connector and workbooks. Now, I want to add a workbook that talks to a custom endpoint. In this case, the custom endpoint is a function app http…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-30T07:54:16.0666667+00:00
Ashwin Venkatesha 105 Reputation points
edited a comment 2024-05-01T06:35:34.3566667+00:00
AnuragSingh-MSFT 20,016 Reputation points
1 answer

The query behind the Sentinel Open | New | Active incident widget

Hi, We are trying to figure out what query produces the following numbers in Sentinel We've been trying to produce the same numbers using the SecurityIncident and SecurityAlert table, but the number of incidents are much less than showed here. I'm…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-22T11:45:44.6766667+00:00
Laszlo Pal 20 Reputation points
edited a comment 2024-04-30T12:53:58.9766667+00:00
Andrew Blumhardt 9,496 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

30 day challenge for security operations analyst cert module numbers inconsistent

I am doing the 30 day challenge for sc-200 Security Operations Analyst. I have done the 53 modules stated in the challenge, however, my status says 53 of 54 modules completed. I have no info how to get to the 54th module if it exists! URL:…

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
3,813 questions
Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
936 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint: A Microsoft unified security platform for preventative protection, postbreach detection, and automated investigation and response. Previously known as Microsoft Defender Advanced Threat Protection.Training: Instruction to develop new skills.
11 questions
asked 2024-04-22T15:11:45.55+00:00
Jose Niguidula Enriquez 25 Reputation points
edited a comment 2024-04-30T09:11:04.9966667+00:00
Henry Jackson 0 Reputation points
1 answer One of the answers was accepted by the question author.

Error Whille setting up SMTP Email V3 connection

Hi Team, I am configuring SMTP connection and getting below error Failed to create connection: { "error": { "code": 502, "source": "logic-apis-easteurope.azure-apim.net", "clientRequestId": "",…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-05T11:33:16.4333333+00:00
Disha Bodade 65 Reputation points
accepted 2024-04-30T05:59:05.1333333+00:00
Disha Bodade 65 Reputation points
3 answers

How to audit the creator of an Enterprise Application in Azure

Hy I'm trying to get the creator of an "Enterprise Application", as soon as someone is creating one by query below. AuditLogs | where Category =~ "ApplicationManagement" | where OperationName =~ "Add application" | mv-expand…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,521 questions
asked 2024-02-07T16:11:00.8033333+00:00
Stalder Jonas 0 Reputation points
commented 2024-04-29T18:39:24.7033333+00:00
Olivier López Chaverri 0 Reputation points
1 answer

Retention and archiving cost of non-billable tables

Hey folks I see MS updated this page a few months ago: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-archive?tabs=portal-3%2Cportal-1%2Cportal-2#pricing-model This part has been added to the documentation:  "Log data…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,804 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-29T06:09:12.3466667+00:00
Sándor Tőkési 161 Reputation points
commented 2024-04-29T15:52:31.59+00:00
Sándor Tőkési 161 Reputation points
1 answer One of the answers was accepted by the question author.

Missing permission 'Microsoft.OperationsManagement/register/action' on scope '/subscriptions/8c507d2e-37ef-4ae1-864f-fd05f45b3cdb' is required to add Microsoft Sentinel to the selected workspace

Hi I'm facing problem when I tried to subscribe to Microsoft Sentinel. When I tried to add Microsoft Sentinel to my desire workspace , this notification pops up. I do have the Owner and Security Administrator permission. Can someone please enlighten me…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2023-03-16T09:02:09.1466667+00:00
Muhammad Zariq Razali 20 Reputation points
commented 2024-04-29T15:31:47.4366667+00:00
John Munro 0 Reputation points
2 answers

How to optimize amount of data sent via LogsIngestionClient.upload operation

Hi, I am using logs ingestion client in python to upload data. My usecase is to read messages off of aws sqs and build payloads that can be sent via LogsIngestionClient client. I built a simple timer trigger function app that reads aws sqs for new…

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,285 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-03-26T01:19:20.7733333+00:00
Ashwin Venkatesha 105 Reputation points
answered 2024-04-29T09:37:43.6133333+00:00
Pinaki Ghatak 2,395 Reputation points Microsoft Employee
0 answers

How are github links created/referenced in function app

I am finding it difficult to understand how are these links generated. https://aka.ms/sentinel-ApigeeXDataConnector-azuredeploy https://aka.ms/sentinel-ApigeeXDataConnector-functionapp I am building a similar function app json for my solution, and I…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-27T00:50:47.2866667+00:00
Ashwin Venkatesha 105 Reputation points
edited a comment 2024-04-29T06:00:05.61+00:00
Givary-MSFT 28,061 Reputation points Microsoft Employee
1 answer

Can I create a playbook in Microsoft Sentinel that is able to disable a compromised hybrid user account whose authentication authority is an on-premises Active Directory Domain controller?

I would like to create a playbook that disables a compromised account. The account is synchronised from an on-premises Active Directory Domain Controller. Synchronisation to Microsoft Entra ID is through Microsoft Entra Connect Sync. Password hash…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-27T10:12:42.72+00:00
Anthony K. Simukonda 0 Reputation points
answered 2024-04-27T21:00:24.1333333+00:00
Olufunso Adewumi 230 Reputation points Microsoft Employee
0 answers

KQL validation is failing locally

I ran dotnet test as per https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally [xUnit.net 00:00:00.41] Exception discovering tests from Kqlvalidations.Tests: System.BadImageFormatException: Could not load file or assembly…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-26T06:17:29.5366667+00:00
Ashwin Venkatesha 105 Reputation points
commented 2024-04-26T19:46:30.3833333+00:00
James Hamil 21,776 Reputation points Microsoft Employee
1 answer

Sentinel Smart Deployment cannot push csv file to Azure DevOps

When I deploy content to sentinel using Azure DevOps, the content deploys successfully but when smart deployment enabled, it cannot push csv tracking file to Azure Repo with error [Warning] API call failed:…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-05T06:33:36.0033333+00:00
Ha Nguyen 0 Reputation points
commented 2024-04-25T09:59:08.7433333+00:00
Ha Nguyen 0 Reputation points
1 answer

Is there any oracle logs parser for azure sentinel we are not using oracle unified agent

Is there any oracle logs parser for azure sentinel we are not using oracle unified agent

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-24T15:01:07.1466667+00:00
Kumar, Deepak 16 Reputation points
commented 2024-04-25T06:37:16.0266667+00:00
Givary-MSFT 28,061 Reputation points Microsoft Employee
1 answer

Threat Intelligence Sharing

Hi all, Is it possible to use threat intelligence from a third party solution with Microsoft sentinel? And if possible, how would you connect them? Custom connectors? regard,

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-23T14:43:59.2633333+00:00
横田　大和 0 Reputation points
answered 2024-04-25T06:18:36.87+00:00
Clive Watson 5,716 Reputation points MVP
1 answer

Closure Comments getting wiped out from Sentinel Incidents

Hi, We have observed that closure comments updated on sentinel incidents are getting wiped out after some time. This issue is observed for some of the alerts detected by Microsoft Defender. Only the closure classification remain in the incident activity…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-16T15:23:45.8633333+00:00
Shivthare, Tejaswi 0 Reputation points
edited an answer 2024-04-22T13:09:55.23+00:00
Andrew Blumhardt 9,496 Reputation points Microsoft Employee
1 answer

This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix.

Applied skills Name: Deploy containers by using Azure Kubernetes Service Issue: This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-03-24T11:56:12.4166667+00:00
pritam bhor 25 Reputation points
edited a comment 2024-04-21T06:19:09.2633333+00:00
Philipp Moser 5 Reputation points
4 answers

Azure Active Directory data connector missing

Hello all, Something that I've done on the regular has stopped working. Before reaching out to support, wondering if settings have just moved somewhere.. Basically trying to add the Azure Active Directory data connector to a Sentinel instance. Usually…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,521 questions
asked 2023-10-31T05:14:42.8466667+00:00
Courtney Cowling - ParaFlare 0 Reputation points
commented 2024-04-18T11:12:20.9166667+00:00
Michael Kirst-Neshva 0 Reputation points
1 answer One of the answers was accepted by the question author.

This offer is not available for subscriptions from Microsoft Azure Cloud Solution Providers

Hello There, In the latest sentinel news, a new solution has appeared, which is in preview, I would like to ask a question regarding the deployment of this solution, in sentinel there is a new option below the Content Management called Content Hub, and…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2021-11-11T15:36:23.22+00:00
Daniel Candela 21 Reputation points
commented 2024-04-18T01:29:23.1066667+00:00
Matthew McKenzie 0 Reputation points
1 answer

azure sentinel for aws log

I'm having issues importing AWS logs into Azure Sentinel. There are no issues importing data using data connectors, but I want to manually import tables that are not supported by data connectors in JSON format. I tried using Custom Log Data Collection…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-17T10:25:33.4666667+00:00
홍원종 Azure SA 0 Reputation points
answered 2024-04-17T20:32:31.13+00:00
Marilee Turscak-MSFT 33,951 Reputation points Microsoft Employee
1 answer

Analytic Rule -Which time prevails, Lookup data from the last or set in query?

I have a question regarding the search times when configuring a new alert and I don't know which time predominates, the one that is put in the query or the one that is set at the level of the alert configuration. Let's take the following query as an…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
980 questions
asked 2024-04-11T11:15:46.35+00:00
Eduardo Vilar 0 Reputation points
commented 2024-04-16T13:23:24.5933333+00:00
Givary-MSFT 28,061 Reputation points Microsoft Employee