Shannon Entropy evaluation for domains?

Question

Hi,

I've found the Entropy calculation for processes running on a device and I've noticed the previously posted questions similar to what I'm asking a few years ago but couldn't find a definitive answer.

Just wondering if there is a way of calculating the shannon entropy of a domain name to use for detections? Or is the functionality not in Sentinel at all? I know it is in Splunk.

Answer 1

Hi @Holmes, Sam ,

I reached out to a colleague on the Sentinel team to see if this is available, but as far as I am aware there nothing out-of-the-box for it. We have one example from our expert for process name entropy here: https://techcommunity.microsoft.com/t5/azure-sentinel/identifying-threat-hunting-opportunities-in-your-data/ba-p/915721

I'll update this post if my Sentinel colleague is able to provide additional resources.