How to calculate the shannon entropy for a string or number with azure sentinel logs using KQL

Robert Feldman 21

This seems to be available on other platforms, eg. splunk. Have I missed something?

1 answer

Marilee Turscak-MSFT 37,141 Reputation points Microsoft Employee

2021-11-15T19:33:47.25+00:00

This is the Azure Sentinel entropy calculation that currently exists. This is used to identify Hosts where they have a high variety of entropy processes. https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/SecurityEvent/ProcessEntropy.yaml

I believe this is all that exists currently, but if you provide more details about your scenario I would be happy to reach out to the Sentinel team and request a sample or documentation.
Please sign in to rate this answer.
Robert Feldman 21 Reputation points

2021-11-16T09:13:32.307+00:00

HI! Basically, it is this that I want to accomplish. http://bearcave.com/misl/misl_tech/wavelets/compression/shannon.html

There is a python implementation here:
https://stackoverflow.com/a/2979208

Or if that link doesnt work: https://stackoverflow.com/questions/2979174/how-do-i-compute-the-approximate-entropy-of-a-bit-string

One use for this is to evaluate domains that are made up of random characters.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Your answer