Asset Inventory analysis kql query in MS Sentinel

Sujit Mahakhud 0 Reputation points
2023-01-18T09:44:29.7+00:00

What can be the query to make a workbook in Ms sentinel to visualize Asset Inventory

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
986 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,559 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. David Broggy 5,681 Reputation points MVP
    2023-01-18T16:36:40.05+00:00

    Hi Sujit,

    We might need more information about what you're asking for.

    If I was looking for a FULL asset inventory of everything being collected by Sentinel I would need to scan all of the tables in the underlying workspace, and then use something like UNIONs to built a table of the results.

    I would also need to know what field contains the asset name. This will vary depending on the log source/table.

    If you have an EDR installed on all of your endpoints this is a great way to get a clear inventory of your endpoints.
    For all mobile devices you could pull this information from the Azure AD table.
    For all network devices you'd need them all logging to one of your tables.
    Azure Arc and Defender for Cloud is a great tool for getting an inventory of all of your servers both on-prem and in cloud.

    Microsoft encourages the ASIM data model but it's not used very much in practice by vendors.
    If it was, we'd have a common field for the hostname in all tables and your question would be easy to answer! For now, I'd say building custom queries for each table and combining them with UNIONs might be the most practical way.

    References:

    [https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory
    [https://learn.microsoft.com/en-us/azure/sentinel/normalization