Custom Logs in Sentinel not triggering incidents or showing up in Threat Mangament

Question

I have successfully forwarded security logs from Splunk to Azure Sentinel based on this tutorial from Microsoft devs.

While I'm able to view the logs from the Custom Logs table created for the forwarded alerts, it seems like they are not being treated like regular Azure alerts:

• They are not being analyzed by Sentinel Fusion
• They have not triggered any incidents
• They do not show up in any Threat Management pages (e.g. Entity Behaviour, Hunting, etc.)

Is there any way to get Sentinel to treat Custom Logs like actual security alerts?
If so, how do we do the field mapping from our custom logs to the one expected by Azure?

Answer 1

@Natoshi Sakamato Thanks for reaching out and apologies for the delay on this.

You should be able to generate the incidents on basis of whatever logs you have inflowing.
For that you need to create the Scheduled Query Rule (as default MS incident creation rule only check for MS related security products like Azure Defender, Cloud app security etc).

Once you are into the process of creating it and have specified the query , on 3rd segment you have the option to generate Incidents on basis of this Scheduled query rule.

Let me know if you have done this already and still having issue.

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.