Asset Inventory analysis kql query in MS Sentinel

Question

What can be the query to make a workbook in Ms sentinel to visualize Asset Inventory

Answer 1

Hi Sujit,

We might need more information about what you're asking for.

If I was looking for a FULL asset inventory of everything being collected by Sentinel I would need to scan all of the tables in the underlying workspace, and then use something like UNIONs to built a table of the results.

I would also need to know what field contains the asset name. This will vary depending on the log source/table.

If you have an EDR installed on all of your endpoints this is a great way to get a clear inventory of your endpoints.
For all mobile devices you could pull this information from the Azure AD table.
For all network devices you'd need them all logging to one of your tables.
Azure Arc and Defender for Cloud is a great tool for getting an inventory of all of your servers both on-prem and in cloud.

Microsoft encourages the ASIM data model but it's not used very much in practice by vendors.
If it was, we'd have a common field for the hostname in all tables and your question would be easy to answer! For now, I'd say building custom queries for each table and combining them with UNIONs might be the most practical way.

References:

[https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory
[https://learn.microsoft.com/en-us/azure/sentinel/normalization