971 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
1 answer

Is it possible to manipulate Azure Sentinel Watchlists through Powershell/API

Hi team: Is it possible to administrate Azure Sentinel Watchlists through Powershell, like Rules with Az.SecurityInsights? Aim is to keep Watchlist references in outer VCS for simpler manipulation, and sync it with Powershell to remote. Thanks,

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,354 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2021-08-18T14:06:27.427+00:00
Geoffrey Montel 1 Reputation point
commented 2022-02-16T14:18:21.587+00:00
Rogier Dijkman 1 Reputation point MVP
3 answers

Entities not correctly displaying in custom alerts in Azure Sentinel

I have created an alert in Azure Sentinel that will alert me when a user account has recorded an event that has originated outside of my country of of work. When an incident is created I am able to display the UPN under the "Entites" section…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-25T15:48:22.087+00:00
I'mLenny 51 Reputation points
answered 2022-02-16T12:55:45.39+00:00
I'mLenny 51 Reputation points
0 answers

clone project code from azure git with idea

I clones code from azure-git with microsoft auth-info , when i choose the project and click the clone button , the idea console shows the error notes below. anyone who has same deal with same case , please show the way to solve it . thanks！ Invocation…

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
35,815 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
6,831 questions
asked 2022-02-11T04:08:01.67+00:00
holiday.yang 1 Reputation point
commented 2022-02-14T16:52:21.577+00:00
JamesTran-MSFT 36,361 Reputation points Microsoft Employee
1 answer

Import Summary Field from Azure Activity logs into Sentinel

Hi. I want to import the Message field under Summary in Azure Activity logs under Monitor. In the provided screenshot I want to export the 2. field into Sentinel to find out who was granted the permissions.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-28T11:52:38.423+00:00
Magnus Korneliussen 1 Reputation point
commented 2022-02-14T15:32:44.017+00:00
Stanislav Zhelyazkov 20,616 Reputation points MVP
1 answer One of the answers was accepted by the question author.

Sentinel Playbook "Block-IP-Address-Meraki" erroring out

Hi, The Microsoft Sentinel playbook "Block-IP-Address-Meraki" is erroring out on execution with the error "Cannot override L3 firewall rules on a network bound to a template - the firewall rules are inherited from the template."…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-31T12:59:50.777+00:00
Anand R Menon 286 Reputation points
commented 2022-02-11T11:05:28.667+00:00
Anand R Menon 286 Reputation points
1 answer One of the answers was accepted by the question author.

Sentinel Connector custom parsers not found

The configuration steps for the connectors "Apache HTTP Server" and "VMware ESXi" mentions "This data connector depends on a parser based on a Kusto Function to work as expected" But these custom parsers are not…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-02-05T05:54:16.413+00:00
Anand R Menon 286 Reputation points
commented 2022-02-11T10:57:09.027+00:00
Anand R Menon 286 Reputation points
1 answer

API Sentinel Alert List pagination

Hi, In many of the API GET list, there's an option using $top for limiting the size in response and giving nextLink param. In GET List of alerts - I can't control the size using $top, but in doc I still receiving nextLink. why is $top not supported…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-02-10T10:53:06.617+00:00
Yair Rascovsky 21 Reputation points
answered 2022-02-10T13:13:28.39+00:00
VipulSparsh-MSFT 16,231 Reputation points Microsoft Employee
1 answer

Updating threat indicator in Microsoft Graph HTTP Error 404 on IndicatorId from Microsoft Sentinel

Trying to update ThreatIndicator in Sentinel via the Graph API to Active=False but getting HTTP Error 404. When querying via: ThreatIntelligenceIndicator | where Active == true | limit 5 | project IndicatorId, Active Taking the IndicatorId…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-02-07T23:54:05.97+00:00
ZLT 21 Reputation points
commented 2022-02-08T20:28:40.053+00:00
ZLT 21 Reputation points
2 answers

Microsoft and SOC Alert

Dear All, I need an advise , to check logs or incident inside Microsoft cloud, you need to log to many different console also most of them not reflect for example Azure AD Identify Protection and Azure sentinel Console need to open to check…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-02-04T10:17:26.317+00:00
odweik 21 Reputation points
commented 2022-02-07T13:29:42.363+00:00
Alistair Ross 7,101 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

Sign-ins from IPs that attempt sign-ins to disabled accounts

Dear Team, could you advise me what i have to do with this kind of alerts Sign-ins from IPs that attempt sign-ins to disabled accounts

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-09T13:55:46.667+00:00
odweik 21 Reputation points
accepted 2022-02-04T10:21:20.023+00:00
odweik 21 Reputation points
1 answer One of the answers was accepted by the question author.

Sentinel Alert on below average log activity

Is it possible run a query in sentinel that averages out the last 7 days of daily total log events for our monitored servers and then trigger an alert if the last 24hours shows shows events is a certain percentage below the 7 day average? I have…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-28T00:43:39.007+00:00
GarudaLead-8570 46 Reputation points
commented 2022-01-28T18:32:58.447+00:00
GarudaLead-8570 46 Reputation points
1 answer

carbon black and sentinel

How do I receive carbon black logs into sentinel without AWS S3 bucket . Is it possible ? I want to send data from carbon black to adx for longer retention. We will separately send alerts from carbon black to another soar platform. But just for long…

Azure Data Explorer
Azure Data Explorer
An Azure data analytics service for real-time analysis on large volumes of data streaming from sources including applications, websites, and internet of things devices.
479 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-27T09:23:09.107+00:00
Soumya Banerjee 126 Reputation points
commented 2022-01-28T18:04:13.51+00:00
JamesTran-MSFT 36,361 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

How to segregrate data inside Sentinel ?

We have logstash sending all different logs to one custom table( created in output conf file in logstash) in Sentinel Note: We are not considering to create filters in logstash end and then define output file in logstash to send to different…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2021-12-13T17:28:48.797+00:00
Soumya Banerjee 126 Reputation points
accepted 2022-01-28T13:59:49.457+00:00
Soumya Banerjee 126 Reputation points
1 answer

Azure API Access Token with Longer Life

Is there a way to get an Azure Active Directory token with a longer lifetime? Is that something that can be requested as a parameter or header when submitting the x-www-form-urlencoded request? I ask as I have a FreshService workflow that updates a…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,381 questions
asked 2022-01-21T22:30:47.947+00:00
Phillip Terry 46 Reputation points
answered 2022-01-26T04:36:40.243+00:00
Siva-kumar-selvaraj 15,546 Reputation points
1 answer

Sentinel Pay-as-you-go

Hi, is there only a Pay-as-you option for Sentinel workspace when you have P1? Thanks,

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-25T16:53:14.073+00:00
zhades 1 Reputation point
answered 2022-01-25T18:29:39.58+00:00
Tasadduq Burney 8,361 Reputation points MVP
2 answers

Creating KQL Query to Detect and Alert on Offline Log Sources

G'Day, We're trying to alert when one or more log sources go offline in Sentinel, then project or summarize the offline log source(s) into an offense for review. I'm using the Heartbeat table here as an example because most people will have it. The…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,783 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-24T23:56:16.267+00:00
Michael Redbourne 1 Reputation point
answered 2022-01-25T14:49:11.66+00:00
Anonymous
1 answer

Azure Sentinel Num Of Open Incidents

I'd like to know if there is a way to write a query that returns: Total number of Incidents created. Total number of "Closed" and "Open" Incidents. So far I have tried: SecurityIncident | distinct ProviderIncidentId |…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-21T17:39:24.68+00:00
AzureSent-0127 41 Reputation points
commented 2022-01-25T01:28:29.333+00:00
AzureSent-0127 41 Reputation points
1 answer One of the answers was accepted by the question author.

How to Parse/Extract data that is in 'SyslogMessage' field in MS Sentinel ?

I have recently integrated and ingested Syslog data to MS Sentinel. Unfortunately there is a field named "SyslogMessage" that appears to be NOT parsed. How do I parse the data that is in "SyslogMessage" field and turn them into…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-10T20:23:16.43+00:00
AzureSent-0127 41 Reputation points
accepted 2022-01-21T17:17:24.84+00:00
AzureSent-0127 41 Reputation points
1 answer

Watchlist use force query time in log analytics

Hello, Have I missed something with watchlist use? Time is set by default when using a watchlist, even for non existing watchlist:

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-20T14:29:44.893+00:00
User989846-7900 1 Reputation point
answered 2022-01-20T16:17:45.087+00:00
Alistair Ross 7,101 Reputation points Microsoft Employee
1 answer

Azure Sentinel Incidents - Change the default lookback time for all users

Hi - I want to change the default time view for all of my users in Azure Sentinel (not just myself). I can change it manually, but when I come back to the page it defaults back to 24 hours. I'd like to change the behavior to default to 7 days…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
asked 2022-01-19T17:31:34.05+00:00
eagle2120 1 Reputation point
answered 2022-01-19T17:59:19.423+00:00
Andrew Blumhardt 9,491 Reputation points Microsoft Employee