1,042 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
1 answer

Sentinel as IaC with Terraform

Hi, Trying to instantiate Sentinel using Terraform. Should be straightforward, create a resource group (azurerm_resource_group), log analytics workspace (azurerm_log_analytics_workspace), onboarding Sentinel…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2023-08-23T05:55:02.6333333+00:00
AdamBudzinskiAZA-0329 91 Reputation points
answered 2024-07-09T12:49:59.4766667+00:00
Eduardo Perez 0 Reputation points
1 answer

Due to the scoring of MDCA being discontinued, if we need to retain the TOP 10 users using UEBA, what methods can we use?

Due to the scoring of MDCA being discontinued, if we need to retain the TOP 10 users using UEBA, what methods can we use? 'Investigation priority score' feature and 'Investigation priority score increase policy' will be phased out in the coming weeks,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
118 questions
asked 2024-06-20T09:25:17.94+00:00
Koonnamchok Klongkaew 140 Reputation points
commented 2024-07-09T02:21:53.6533333+00:00
Koonnamchok Klongkaew 140 Reputation points
1 answer

Minimum hardware requirements for installation of AMA via ARC on Servers

Hello Community. Having a bit of a hard time trying to find the minimum hardware requirements for Windows and Linux Servers for the installation of AMA via ARC. I'm looking for something similar that I found with MDE like this. MDE Minimum…

Azure Arc
Azure Arc
A Microsoft cloud service that enables deployment of Azure services across hybrid and multicloud environments.
371 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-07-08T19:38:00.3166667+00:00
Chris 0 Reputation points
answered 2024-07-08T21:58:34.15+00:00
Marcin Policht 17,040 Reputation points MVP
1 answer

Sentniel free data sources

Hi, quoting from https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=commitment-tier#free-data-sources "The following data sources are free with Microsoft Sentinel: Azure Activity Logs. Office 365 Audit Logs, including all…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2022-09-13T13:01:19.587+00:00
AdamBudziski-8216 16 Reputation points
commented 2024-07-08T15:23:36.51+00:00
Rafał Fitt 6 Reputation points
1 answer

Segregating and Identifying Alerts in Sentinel Workspace

I am seeking a method to segregate alerts in a Sentinel workspace to facilitate easier identification and prioritization. For instance, if we have multiple clients' logs in a single workspace, we need a way to identify and segregate alerts based on the…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-07-03T04:32:08.67+00:00
Someiah C S 80 Reputation points
commented 2024-07-08T07:44:54.29+00:00
Givary-MSFT 30,251 Reputation points Microsoft Employee
3 answers One of the answers was accepted by the question author.

Ingesting Cisco ASA logs into Sentinel using the AMA agent

Hi there, We are looking to onboard Cisco ASA logs into Microsoft Sentinel. Currently the Cisco ASA integration guide (linked below) on Microsoft Docs is referencing using the old MMA agent to get these logs onboarded. As this agent is being deprecated…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,973 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2023-07-11T14:18:52.23+00:00
Stephen Crooks 20 Reputation points
answered 2024-07-07T23:15:58.16+00:00
Peter Cronwright 6 Reputation points
0 answers

Sentinel _BilledSize and estimate_data_size differences

hey folks Could somebody tell me the relationship between the _BilledSize field in a log and the result of the estimate_data_size(*) KQL command? I do understand that the _BilledSize field contains the info of the size of the data I have to pay for…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-07-07T14:02:15.47+00:00
Sándor Tőkési 181 Reputation points
1 answer

DataConnector connectorUI attributes - sampleQueries

hey folks, I was working on some data connectors and seemingly some of the old features are not working anymore. I tried to use some fields which seem to be dated now. The most relevant would be the 'sampleQueries' attribute. I remember having these in…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-06-10T08:25:05.6566667+00:00
Sándor Tőkési 181 Reputation points
commented 2024-07-07T11:46:08.5433333+00:00
Sándor Tőkési 181 Reputation points
0 answers

Regarding None Accounts Adding to Security Enabled Local, Global and Universal Groups

Hello Team, Greetings!! During our monitoring activities in Sentinel, we have observed that some non-accounts have been added to security-enabled local, global, and universal groups. Could you please provide insight into why this activity is being…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-07-03T16:54:11.04+00:00
Srisaiteja Palle 20 Reputation points
commented 2024-07-05T15:57:06.93+00:00
Srisaiteja Palle 20 Reputation points
1 answer One of the answers was accepted by the question author.

Find creation date of custom analytical rule created in Sentinel

Hi all, I am aiming to find the number of new analytical rules created per month (including custom as well as from github deployed), as well as the existing total per month on Sentinel for the last 2 months and present it to a Sentinel workbook. How…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-06-21T13:16:42.7966667+00:00
Ev s 20 Reputation points
accepted 2024-07-03T12:21:03.83+00:00
Ev s 20 Reputation points
2 answers One of the answers was accepted by the question author.

How to disconnect Azure Sentinel data connectors?

In Sentinel I cant able to find an option to disconnect the data connectors . And there are no documents available for the same. So what are the methods to disconnect a data connector inside sentinel for both native and non native products. When I…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-06-28T16:23:07.86+00:00
RAHUL MP 20 Reputation points
accepted 2024-07-03T11:55:28.2166667+00:00
RAHUL MP 20 Reputation points
1 answer

Stop Creating Incidents in Sentinel For every Alert generated by Custom detection rule in defender for endpoint

Hi Team, I have created a custom rule in Defender with KQL query to get the details about Device & owners of Vulnerable machines. So results are having rows more than 1500, and its generating that many alerts in defender. And same events are getting…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
asked 2024-06-25T17:06:28.82+00:00
Disha Bodade 65 Reputation points
commented 2024-07-03T05:50:47.05+00:00
Disha Bodade 65 Reputation points
0 answers

API Version Discrepancies for 'Data Connector Definitions' in Sentinel

Hello MS Community, Would you please help explain the discrepancy regarding API references to "data connector definitions"? I noticed the API related link…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-06-14T08:30:15.17+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:22:40.0133333+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

How connectivityCriteria works in Sentinel

Regarding the below sample json-code, I am trying to understand how the connectivityCriteria/IsConnectedQuery functions in Azure Sentinel. 1/Specifically, what happens when the KQL query within returns a positive result? 2/And suppose our server hasn't…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-06-11T09:35:08.2866667+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:22:17.5433333+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

Analytic rules in Sentinel Solutions

I am going to provide analytic rules in Sentinel's Solutions. I've observed that All the solutions by other companies available on Microsoft Sentinel Github contains .yaml file for analytic rules, but Azure's wiki/documentation does not mandate that…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-06-11T02:01:49.2633333+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:22:12.89+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

Preparing Sentinel Content and ARM Template Files

I am preparing Sentinel content (a dataConector) as outlined in the steps (from "\sentinel_with_ContentHub\Azure-Sentinel\Solutions\readme.md")shown in the below picture. Could you please confirm my understanding? Thank you in advance! In…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-06-04T02:12:46.0733333+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:21:41.02+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
0 answers

logo size for Sentinel Content Preparation

Hello, I am preparing the Sentinel content according to the following steps from github, my question is if there's requirement about the size of the logo? Thanks.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-06-03T09:35:57.3066667+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:21:28.14+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

Data Connector Types in Azure Sentinel

Hello Community, We've noted that there are various types of "Microsoft.SecurityInsights/dataConnectors," such as "RestApiPoller" and "GenericUI." Our case is that our service is hosted on other clouds, and we aim to…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-06-03T06:40:23.7466667+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:21:23.2633333+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

Custom Data Connector into Sentinel Content-Hub

Hello Microsoft Community, We are planning to build & integrate our custom data connector into the Sentinel Content-Hub to enable data analysis services for our customers who are interested in Azure Sentinel. And our data, which is unique and…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-05-31T01:00:56.8333333+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:21:02.71+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

How Do I Configure JSON Items for Different Types of Data Connectors?

Hello, I'm wondering if there're any wiki pages that give explanation and how to properly configure the data connectors. Thank you! I've been exploring the variety of data connectors available in Azure, such as GenericUI, APIPolling, and others, through…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,042 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
236 questions
asked 2024-05-30T06:50:41.1533333+00:00
LXF 160 Reputation points
edited the question 2024-07-03T04:20:50.3566667+00:00
Ryan Hill 26,866 Reputation points Microsoft Employee