Questions tagged [azure-sentinel]

Microsoft Azure Sentinel is a proprietary cloud-native SIEM (Security Information and Event Management) software that provides security analytics for an enterprise application.

Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.

Azure Sentinel is a birds-eye view across the enterprise alleviating the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution timeframes.

  • Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.

  • Detect previously undetected threats, and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.

  • Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.

  • Respond to incidents rapidly with built-in orchestration and automation of common tasks.

Building on the full range of existing Azure services, Azure Sentinel natively incorporates proven foundations, like Log Analytics, and Logic Apps. Azure Sentinel enriches your investigation and detection with AI, and provides Microsoft's threat intelligence stream and enables you to bring your own threat intelligence.

196 questions
0
votes
1 answer

Take output from query and use in subsequent KQL query

I'm using Azure Log Analytics to review certain events of interest. I would like to obtain timestamps from data that meets a certain criteria, and then reuse these timestamps in further queries, i.e. to see what else occurred around these times. The…
shearlynot
  • 81
  • 1
  • 11
0
votes
1 answer

Logic Apps: Data not parsed on the second query inside "foreach" loop

Hi Logic Apps Experts, I'd like to check with you some of the foreach loop behaviors, and to check whether this is expected/ is there any workarounds for this. So the steps with this logicapps is to "Run query and list results" search will do is…
Jaysec
  • 27
  • 5
0
votes
1 answer

Substring search on one column from the column of another table without IN operator

I have two tables in Azure one of which is a list of URLs and the other has only Domain Names. I want to be able to check if the the URLs in the URLtable "contains" the domain name from the DomainName_table. The "in" operator cannot be used since…
Grace A
  • 165
  • 1
  • 12
0
votes
1 answer

Routing Azure Resource Logs to Multiple Log Analytics Workspaces

We are building out logging within Azure and have multiple user groups who need access to the logging. Some of the logs are needed by multiple user groups, but not all users should have access to all logging. In the end, we are thinking we want a…
0
votes
1 answer

MS Advanced Threat Analytics import into Azure Sentinel

I need to import data collected by on-premise MS ATA server into Azure Sentinel. I haven't been able to find documentation on the proper way to do this. The goal is to import all data that is collected on the ATA server, not just logs about that…
0
votes
2 answers

Azure Sentinel Contributor Role is not available in Administrative Roles on Azure

According to this link, there should be 3 built in roles for azure sentinel. However, a global admin account is unable to see any of them in Administrative Roles on Azure.
0
votes
1 answer

Azure Sentinel - Log Analysis - Help - Finding all sucessful azure signs over 3 months period by location and user

I'm new to Sentinel/Work Analytics and KMQ. I have been trying to figure out a query to get all successful login by user and location from azure actvity sign in. I hope you can help me or point me to some references. I've tried using some examples…
0
votes
1 answer

Split KQL array into multiple columns

I'm trying to build a dashboard in Azure Sentinel's workbook. One of the columns is a JSON Array of varying length. I'd like to split that array so that each element in the array becomes its own column, but I can't figure out a good way to do that.…
jfeldzy
  • 90
  • 9
0
votes
1 answer

Can Azure Sentinel aggregates data from devices running on-premises or in any cloud?

Can Azure Sentinel aggregates data from devices running on-premises?
Sanjay Dwivedi
  • 699
  • 7
  • 10
0
votes
0 answers

Cisco ASA Concurrent VPN Users - Timechart in KQL / Azure Sentinel

I need to make a timechart of concurrent VPN users connected to my Cisco ASA like the one in the following screenshot: look! here is "the perfect" timechart in splunk Another timechart screenshot here:…
Prakhar
  • 1
  • 1
0
votes
1 answer

Dashboards on custom application using application insights

We have a lot of applications that throws custom logs to application insights. I would like to make a dashboard where I can see if each application is running or throwing exceptions etc. I have tried looking around in log analytics and it does not…
0
votes
1 answer

Is it possible to create log source health alerts in Azure Sentinel?

I am attempting to create an alert that lets me know if a data source stops providing logs to Sentinel. While I know it displays anomalies in log data on the dash board, I am hoping to receive alerts if a source stops providing logs for an extended…
0
votes
1 answer

Get Incident details such as assigned to, comments by the analyst,Incident ID etc using query in Logs

I am investigating incidents but I need to tie them with the SOC analyst who worked on it and what comments were added by them. I am not able to find these details in any table. This will be helpful to pull out the metrics for the SOC team. Where…
Grace A
  • 165
  • 1
  • 12
0
votes
1 answer

Kusto KQL query to Extend multiple entities

I need to parse out the users names from multiple alerts within azure. If i use the following extend i can get the data from '0' | extend Name = tostring(parse_json(Entities)[0].Name) but sometimes the data is at 6 or 9 ect, i can simple add a new…
0
votes
1 answer

Azure Sentinel Search to be alerted on new public IP assigned to subscription (tenant)

I appreciate any time or effort on this issue. I'd like to create an alert in Azure Sentinel (Log Analytics) that would let us know when a new public IP was created in our tenant. I'm not sure what solution or source would have this data. I don't…
C. Lozach
  • 31
  • 1
  • 2
1 2 3
12
13