339 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
1 answer One of the answers was accepted by the question author.

Testing Microsoft Defender XDR with Azure Sentinel in a CDX-like Environment

I'm looking to try out Microsoft Defender XDR with Azure Sentinel, but my current setup—a CDX tenant under an E5 subscription—doesn't have an active Azure subscription. Any suggestions for workarounds or similar environments where I can test Microsoft…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-05-14T06:07:28.7433333+00:00
Avishka Bandarathilaka 20 Reputation points
commented 2024-05-17T10:03:46.94+00:00
Avishka Bandarathilaka 20 Reputation points
1 answer One of the answers was accepted by the question author.

Sentinel Kusto Query todatetime function does not work with dynamic values.

I have a kusto query to calculate MTTR by client. When an incident is resolved, an analyst comments the resolution time in the format R: time where time is when the incident was resolved and R is to make the comment unique. Example R: Friday, May 10,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-05-10T11:24:54.8433333+00:00
Julius Ekane 20 Reputation points
accepted 2024-05-14T12:38:04.1866667+00:00
Julius Ekane 20 Reputation points
1 answer One of the answers was accepted by the question author.

Sentinel bicep deployment : InvalidParameter - Solution product cannot start with 'OMSGallery/' as it is reserved for Microsoft first party solutions.

Hello, i am learning how to script and i wish to deploy Sentinel with bicep. I have created a script from Microsoft templates and have added variables as well as a jsonc parameters file. I use VSC with the bicep extension in order to "easily"…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,858 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2023-01-17T16:00:00.0266667+00:00
Dunvael LE ROUX 40 Reputation points
commented 2024-05-14T05:58:23.0133333+00:00
Stanislav Zhelyazkov 21,506 Reputation points MVP
1 answer One of the answers was accepted by the question author.

How are github links created/referenced in function app

I am finding it difficult to understand how are these links generated. https://aka.ms/sentinel-ApigeeXDataConnector-azuredeploy https://aka.ms/sentinel-ApigeeXDataConnector-functionapp I am building a similar function app json for my solution, and I…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-27T00:50:47.2866667+00:00
Ashwin Venkatesha 165 Reputation points
accepted 2024-05-09T04:49:56.79+00:00
Ashwin Venkatesha 165 Reputation points
1 answer One of the answers was accepted by the question author.

Inquiry Regarding Multiple 4624 Event ID Logs for Single User Login

Hello Team, I am reaching out to inquire about a matter related to our Windows Security logs. Specifically, we have observed multiple instances of Event ID 4624 being logged for a single user login event in the Security Events table. As part of our…

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,974 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-05-01T18:05:09.7033333+00:00
Srisaiteja Palle 20 Reputation points
accepted 2024-05-08T16:56:42.5566667+00:00
Srisaiteja Palle 20 Reputation points
1 answer One of the answers was accepted by the question author.

Respond to incidents across multiple tenants deploying Defender XDR from One Centralized Ms Sentinel

Hello, I have a customer having 3 tenant A,B and C. Tenant A and C each are using Microsoft Defender XDR. MS Sentinel is configured on Tenant B. He want to centralize all events and logs on Sentinel and want to configure responses if any incident is…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-05-02T13:05:38.2+00:00
Farah MHAMDI 20 Reputation points
commented 2024-05-08T14:54:53.59+00:00
Farah MHAMDI 20 Reputation points
1 answer One of the answers was accepted by the question author.

How to add a function app for azure workbook and sentinel solution

Hi, I am working on contributing to an azure sentinel solution in github, My solution contains data connector and workbooks. Now, I want to add a workbook that talks to a custom endpoint. In this case, the custom endpoint is a function app http…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-30T07:54:16.0666667+00:00
Ashwin Venkatesha 165 Reputation points
accepted 2024-05-07T22:24:11.4133333+00:00
Ashwin Venkatesha 165 Reputation points
1 answer One of the answers was accepted by the question author.

KQL validation is failing locally

I ran dotnet test as per https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally [xUnit.net 00:00:00.41] Exception discovering tests from Kqlvalidations.Tests: System.BadImageFormatException: Could not load file or assembly…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-26T06:17:29.5366667+00:00
Ashwin Venkatesha 165 Reputation points
accepted 2024-05-07T22:01:16.9833333+00:00
Ashwin Venkatesha 165 Reputation points
1 answer One of the answers was accepted by the question author.

Failed to save analytics rule query.

I can create any active analytics rule query in Microsoft Sentinel. While trying to create a new one a error occurs: "Failed to save the analytics rule query. Log Analytics workspace 'xxx' could not be found." It started when the previous…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-05-03T04:18:08.0833333+00:00
3PI 20 Reputation points
accepted 2024-05-07T16:05:25.52+00:00
3PI 20 Reputation points
1 answer One of the answers was accepted by the question author.

Can I create a playbook in Microsoft Sentinel that is able to disable a compromised hybrid user account whose authentication authority is an on-premises Active Directory Domain controller?

I would like to create a playbook that disables a compromised account. The account is synchronised from an on-premises Active Directory Domain Controller. Synchronisation to Microsoft Entra ID is through Microsoft Entra Connect Sync. Password hash…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-27T10:12:42.72+00:00
Anthony K. Simukonda 20 Reputation points
accepted 2024-05-05T09:34:01.37+00:00
Anthony K. Simukonda 20 Reputation points
1 answer One of the answers was accepted by the question author.

30 day challenge for security operations analyst cert module numbers inconsistent

I am doing the 30 day challenge for sc-200 Security Operations Analyst. I have done the 53 modules stated in the challenge, however, my status says 53 of 54 modules completed. I have no info how to get to the 54th module if it exists! URL:…

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
3,932 questions
Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
960 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint: A Microsoft unified security platform for preventative protection, postbreach detection, and automated investigation and response. Previously known as Microsoft Defender Advanced Threat Protection.Training: Instruction to develop new skills.
18 questions
asked 2024-04-22T15:11:45.55+00:00
Jose Niguidula Enriquez 25 Reputation points
commented 2024-05-03T13:19:58.8166667+00:00
Jose Niguidula Enriquez 25 Reputation points
1 answer One of the answers was accepted by the question author.

Error Whille setting up SMTP Email V3 connection

Hi Team, I am configuring SMTP connection and getting below error Failed to create connection: { "error": { "code": 502, "source": "logic-apis-easteurope.azure-apim.net", "clientRequestId": "",…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-05T11:33:16.4333333+00:00
Disha Bodade 65 Reputation points
accepted 2024-04-30T05:59:05.1333333+00:00
Disha Bodade 65 Reputation points
1 answer One of the answers was accepted by the question author.

Missing permission 'Microsoft.OperationsManagement/register/action' on scope '/subscriptions/8c507d2e-37ef-4ae1-864f-fd05f45b3cdb' is required to add Microsoft Sentinel to the selected workspace

Hi I'm facing problem when I tried to subscribe to Microsoft Sentinel. When I tried to add Microsoft Sentinel to my desire workspace , this notification pops up. I do have the Owner and Security Administrator permission. Can someone please enlighten me…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2023-03-16T09:02:09.1466667+00:00
Muhammad Zariq Razali 20 Reputation points
commented 2024-04-29T15:31:47.4366667+00:00
John Munro 0 Reputation points
1 answer One of the answers was accepted by the question author.

This offer is not available for subscriptions from Microsoft Azure Cloud Solution Providers

Hello There, In the latest sentinel news, a new solution has appeared, which is in preview, I would like to ask a question regarding the deployment of this solution, in sentinel there is a new option below the Content Management called Content Hub, and…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2021-11-11T15:36:23.22+00:00
Daniel Candela 21 Reputation points
commented 2024-04-18T01:29:23.1066667+00:00
Matthew McKenzie 0 Reputation points
1 answer One of the answers was accepted by the question author.

Unable to take Applied Skills Assessments

This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix. - Configure SIEM security operations using Microsoft Sentinel

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-03-24T05:29:15.59+00:00
Rath, Sibananda 25 Reputation points
commented 2024-04-15T17:58:16.1766667+00:00
Edward Hurtado 0 Reputation points
1 answer One of the answers was accepted by the question author.

The Address you provided is invalid, please provide a valid address and try again!!!

Hi, While I was trying to schedule the SC-200 Exam, I got the error message that the billing address isn't valid. How can I fix this issue. Thanks! Best Regards, Jasmina Jakob

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,215 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
160 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
107 questions
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint: A Microsoft unified security platform for preventative protection, postbreach detection, and automated investigation and response. Previously known as Microsoft Defender Advanced Threat Protection.Training: Instruction to develop new skills.
18 questions
asked 2024-04-12T19:23:56.8333333+00:00
Anonymous
accepted 2024-04-13T12:24:56.7366667+00:00
Anonymous
1 answer One of the answers was accepted by the question author.

Azure Activity - data connector prerequisites

Hi all, When trying to enable the azure Acitvity connector in sentinal it says: I am am owner of the subscription already?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-08T12:52:17.6133333+00:00
Aran Billen 681 Reputation points
accepted 2024-04-12T10:17:28.0666667+00:00
Aran Billen 681 Reputation points
1 answer One of the answers was accepted by the question author.

Mismatch in amount of data received in logs analytics workspace and DCR metrics

I have defined a data collection rule and am using logs ingestion api to send data to 2 custom tables. I have defined diagnostic settings for the DCR such that error logs are sent to logs analytics workspace. For about an hour, I have events ingested…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,858 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-03-28T07:47:47.7+00:00
Ashwin Venkatesha 165 Reputation points
commented 2024-04-12T05:52:27.4566667+00:00
Ashwin Venkatesha 165 Reputation points
1 answer One of the answers was accepted by the question author.

Azure Workbook merge query visualization

I have created an Azure Workbook with a merge query that combines two table sources. This produces a nice table of resources (in this case, a list of VM's). Now all I want to do is somehow summarize this merged table and get the total number of VM's…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,858 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2022-02-09T10:58:43.327+00:00
René 26 Reputation points
commented 2024-04-11T09:37:50.3566667+00:00
Moritz von Witzleben 0 Reputation points
1 answer One of the answers was accepted by the question author.

How can I integrate GuardDuty findings with Microsoft Sentinel?

GuardDuty - Sentinel Integration

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
asked 2024-04-08T13:05:13.9266667+00:00
Johnstone Oloo 20 Reputation points
edited a comment 2024-04-10T19:13:07.72+00:00
Johnstone Oloo 20 Reputation points