1,051 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
2 answers One of the answers was accepted by the question author.

Microsoft Defender Threat Intelligence honeypot

Hi, I've added the Microsoft Defender Threat Intelligence Data Connector to Sentinel and I get thousands of honeypot alerts in the Threat Intelligence page, how can I filter these notifications?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-23T14:29:55.2966667+00:00
Romar 106 Reputation points
commented 2024-06-28T05:43:05.37+00:00
Romar 106 Reputation points
1 answer One of the answers was accepted by the question author.

how can I validate my Sentinel Content before PR ？

Hello MS Team, I am currently engaged in validating/testing solutions (a CCP dataConnector) with Sentinel and have a few questions regarding the process. Q1: I am following the Sentinel-DataConnector readme guidance…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-27T01:39:27.0266667+00:00
LXF 180 Reputation points
accepted 2024-06-28T01:06:53.0566667+00:00
LXF 180 Reputation points
2 answers One of the answers was accepted by the question author.

About "u.dataTypes is undefined" when importing DataConnector json

Hello， I encountered an error "u.dataTypes is undefined" when importing a CPP on Sentinel. I am pretty sure that the table name is correct within my current workspace. Can some one explain this error please? Thanks in advance.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-26T07:01:40.3166667+00:00
LXF 180 Reputation points
accepted 2024-06-28T01:04:56.9433333+00:00
LXF 180 Reputation points
1 answer

Whenever I try to create microsoft sentinel it shows error

Failed to add Microsoft Sentinel Failed to add Microsoft Sentinel to workspace 'SentinelRG'. The gateway did not receive a response from 'Microsoft.SecurityInsights' within the specified time period.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-27T05:17:35.7+00:00
Zawar Khan 0 Reputation points
answered 2024-06-27T09:07:33.15+00:00
Givary-MSFT 30,521 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

Azure Activity Data connector configuration

Hi, I am trying to configure the Azure Activity data connector in my tenant. I have installed the connector and configured the azure policy scoped at my subscription where i have sentinel deployed. In the parameter section I have set my sentinel…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-24T07:30:46.6266667+00:00
Herman 20 Reputation points
commented 2024-06-26T07:33:10.7433333+00:00
Herman 20 Reputation points
0 answers

Syslog through AMA (CEF) Connector

Hi, Follwing up on my last question: https://learn.microsoft.com/en-us/answers/questions/1690671/syslog-through-ama-connector-not-showing-in-the-co I have now installed Arc, and the machine is showing up on Azure Arc. The AMA is installed and is…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,992 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-11T10:30:54.9766667+00:00
Bl()e 25 Reputation points
edited a comment 2024-06-25T18:06:41.0866667+00:00
Dmitry Nikolaenya 0 Reputation points
1 answer One of the answers was accepted by the question author.

how to Deploy Sysmon To Receive Logs In Azure Sentinel?

how to Deploy Sysmon To Receive Logs In Azure Sentinel?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2022-01-05T05:28:24.213+00:00
Shital Khatri - AzureAdmin 101 Reputation points
commented 2024-06-25T12:39:46.2033333+00:00
useR 0 Reputation points
0 answers

Deploy estreamer connector using load balancer

Hi all, I wanted to deploy solution like this. An azure vm, azure sentinel, azure load balancer and Cisco estreamer connector How do I configure the estreamer to point directly to azure load balancer instead of azure vm agent

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-24T03:53:18.3733333+00:00
TAH 0 Reputation points
commented 2024-06-25T07:46:48.5933333+00:00
Givary-MSFT 30,521 Reputation points Microsoft Employee
0 answers

How to write a kql comparing 2 different tables(signins, threatintelligence) to create alert if the sign in ip matches with the ip reported by threatintelligence.

I tried multiple ways to join the tables but ended up getting multiple errors, and I am not able to call the table that I referred into a variable using the let operator after I refer other table after it. As I was not able to use the first defined…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-23T20:18:15.57+00:00
Harish Menti 0 Reputation points
commented 2024-06-24T05:11:58.0033333+00:00
Givary-MSFT 30,521 Reputation points Microsoft Employee
3 answers One of the answers was accepted by the question author.

MS Sentinel - Data Connectors update

Question MS Sentinel in Azure - Data Conenctors In Data Conenctors I have 21 onboarded connectos, 17 connected , 0 updates When I go to "More content at content hub" I can see 17 installed and 3 updates. QS1: Why these 3 updates are not shown…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-18T01:44:18.1766667+00:00
Lutz Rahe 20 Reputation points
accepted 2024-06-24T00:42:51.4966667+00:00
Lutz Rahe 20 Reputation points
1 answer One of the answers was accepted by the question author.

Automated email sending when running a KQL query

Hello, First of all, I'm quite new in Sentinel/KQL related stuff. I have this very basic KQL query to find sign-ins from countries not included in the "LocationDetails" argument. I'd like to automate this query and, if any results found, send…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-03-04T13:22:29.6466667+00:00
Josep Marzo 20 Reputation points
edited a comment 2024-06-22T22:00:02.59+00:00
Cory Vickstrom 0 Reputation points
3 answers One of the answers was accepted by the question author.

AMA+DCR for Syslog & CEF logs. CEF logs in CommonSecurityLog not parsing .

Referring to this article: https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog I trying to solution the following scenario: Using a single Linux log collector to forward both Syslog and CEF events to your Microsoft Sentinel workspaces…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2023-09-08T07:11:58.8+00:00
Hann, Yap Sheu 20 Reputation points
answered 2024-06-21T23:50:24.67+00:00
Perry Thompson 0 Reputation points
1 answer

Shannon Entropy evaluation for domains?

Hi, I've found the Entropy calculation for processes running on a device and I've noticed the previously posted questions similar to what I'm asking a few years ago but couldn't find a definitive answer. Just wondering if there is a way of calculating…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-20T08:10:55.9133333+00:00
Sam Holmes 5 Reputation points
answered 2024-06-21T21:45:10.7766667+00:00
Marilee Turscak-MSFT 36,246 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

How to agentlessly upload logs to a default table in a log analytics workspace?

I have built a system that creates a log analytics workspace and uploads logs to a custom table by following these Microsoft tutorials: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-api?tabs=dcr …

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,992 questions
Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,064 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-19T11:49:57.39+00:00
42726446 60 Reputation points
accepted 2024-06-20T10:12:35.3+00:00
42726446 60 Reputation points
1 answer

Set total retention period for one or more tables

Hi, I am trying to set the total retention time for one or more log tables using the command az monitor log-analytics workspace table update --subscription <subscription id> --resource-group sentinel --workspace-name <name> --name…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-18T18:39:12.59+00:00
Nikhil Padma 0 Reputation points
commented 2024-06-19T00:42:28.02+00:00
Nikhil Padma 0 Reputation points
2 answers

Syslog through AMA connector not showing in the content hub list.

Hi, Trying to set up a syslog ingestion into Sentinel for testing. The setup consists of AMA on a on-prem syslog server. The legacy agent is soon not supported, and the requirement of AMA on-prem is according to Microsoft guides to have the following…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-03T09:40:15.5033333+00:00
Bl()e 25 Reputation points
edited a comment 2024-06-18T12:34:48.98+00:00
Andrew Blumhardt 9,841 Reputation points Microsoft Employee
0 answers

Azure Monitor Agent Fluent Bit CVE-2024-4323.

Hello, two questions about Azure Monitor Agent Fluent Bit exe in regards to CVE-2024-4323. AMA agent installation is using fluent-bit.exe in version 2.0.9 (location C:\Program Files\Azure Monitor Agent\Monitoring\Agent\fluent-bit.exe) I would like…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,992 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-17T09:51:44.58+00:00
B T 0 Reputation points
edited the question 2024-06-18T03:55:38.18+00:00
PRADEEPCHEEKATLA-MSFT 85,026 Reputation points Microsoft Employee
1 answer

I and others in my organization are members of "Microsoft Sentinel Contributor" but sometimes we cannot close Sentinel Incidents

I and others in my organization are members of "Microsoft Sentinel Contributor" We can usually close the incidents but sometimes we cannot close them. I have verified my role assignments and since I have the role of "Microsoft Sentinel…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-05T18:54:35.8733333+00:00
JCrockett 0 Reputation points
commented 2024-06-17T15:53:46.1266667+00:00
JCrockett 0 Reputation points
1 answer One of the answers was accepted by the question author.

Migrating Sentinel DNS event connector from legacy agent to AMA

Hi I am in the process of migrating the Sentinel Windows security and DNS data connectors from the legacy agent to AMA. We use the DNS audit log 519 events to resolve device names from ip addresses where the device name is not returned in a lookup query.…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
asked 2024-06-05T10:08:43.27+00:00
Louise Atyeo 25 Reputation points
accepted 2024-06-17T13:04:29.7+00:00
Louise Atyeo 25 Reputation points
3 answers

How to audit the creator of an Enterprise Application in Azure

Hy I'm trying to get the creator of an "Enterprise Application", as soon as someone is creating one by query below. AuditLogs | where Category =~ "ApplicationManagement" | where OperationName =~ "Add application" | mv-expand…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,051 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,486 questions
asked 2024-02-07T16:11:00.8033333+00:00
Stalder Jonas 0 Reputation points
commented 2024-06-12T19:26:17.6533333+00:00
Olivier López Chaverri 0 Reputation points