Questions tagged [azure-sentinel]

Microsoft Azure Sentinel is a proprietary cloud-native SIEM (Security Information and Event Management) software that provides security analytics for an enterprise application.

Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.

Azure Sentinel is a birds-eye view across the enterprise alleviating the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution timeframes.

  • Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.

  • Detect previously undetected threats, and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.

  • Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.

  • Respond to incidents rapidly with built-in orchestration and automation of common tasks.

Building on the full range of existing Azure services, Azure Sentinel natively incorporates proven foundations, like Log Analytics, and Logic Apps. Azure Sentinel enriches your investigation and detection with AI, and provides Microsoft's threat intelligence stream and enables you to bring your own threat intelligence.

196 questions
1
vote
1 answer

Kusto: Not failing if Table does not exist

I intend to design rule templates for Microsoft Sentinel using KQL for different instances. The workspaces have various log sources, so different tables. Some detectoins can be made using different log sources, so different tables. For example for…
moutonjr
  • 223
  • 1
  • 3
  • 17
1
vote
1 answer

Convert PowerBI Query to append data and remove duplicates, rather than overwrite the whole table

I have a PowerBI Dashboard which, when refreshed, pulls data from Sentinel, and refreshes the data in "Table". When it does this, it removes the existing data, and imports the snapshot (which is limited to a 90 day rolling window - not controlled by…
Mark Tait
  • 545
  • 3
  • 12
  • 22
1
vote
1 answer

KQL List columns with a hit on specific text

Need a query to be able be able to list the fields in the table that have text "mouse" and what that count is, for example: col_1 col_2 col_3 dog cat mouse cat cat mouse mouse bird dog Result for "mouse" col_3 …
1
vote
1 answer

Is there a way to generate a set of random UUIDs using one `random_uuid` resource in Terraform

I'm trying to deploy few sentinel automation rules for a sentinel solution using Terraform. Because the automation rules require a UUID for its name, I'm using random_uuid resource per each automation rule to generate a UUID for the names of…
Akila Gamage
  • 43
  • 10
1
vote
1 answer

Azure Sentinel (KQL)

I'm looking for a KQL query to transform data from the query: EmailEvents | where EmailDirection=="Inbound" such that the sample results (below) are transformed into the ideal results (further below) Sample results: TimeGenerated [UTC] - …
1
vote
1 answer

Writing parser with | parse kind=regex operator

I`m trying to make a parser for FortiAnalyzer. I recieve log in next format (example from Fortinet documentation) : 2020-05-12 17:01:16 log_id=0001010018 type=event subtype=system pri=information desc="User login/logout successful" user="admin"…
l4serda
  • 13
  • 3
1
vote
1 answer

Azure sentinal alert vs monitor alert

In Azure kusto query window We can create two alerts Azure Monitor Alert Azure Sentinel Alert What are the difference between these.
Blue Clouds
  • 7,295
  • 4
  • 71
  • 112
1
vote
1 answer

KQL: Exclude partial string from results using Sentinel Watchlists

Using a watchlist to store domains to be excluded from this query. However unable to filter out the domains on the watchlist from the results. Dealing with SMTPS. The Watchlist items do not contain the "@" symbol. Watchlist…
CurlyCrank
  • 13
  • 3
1
vote
1 answer

How to drop [UTC] from a column table in KQL

Trying to clean up some columns coming into Sentinel from syslog, and working on changing from UTC to local time. Here is an example of what I have so far: print dt=now() | extend pacific_dt = datetime_utc_to_local(dt, 'US/Pacific') | extend…
mfalde
  • 15
  • 6
1
vote
1 answer

KQL - Check value every hour to see if it's higher than the week average

I'm new to kql and defender, looking for help in creating a hunting kql query which checks the avg number of alerts in the last 7 days on defender for endpoint and if at any hour the number of generated alerts spikes and goes above the 1week average…
Dantuzzo
  • 271
  • 6
  • 25
1
vote
1 answer

Group data using list KQL

I am quite new using Kusto so I want to make list grouping differents network connections by the same source ip in differents ports. For example, i got a table like this: Source IP Destination IP Destination…
Miguel Cuba
  • 29
  • 1
  • 4
1
vote
1 answer

Kusto - Is there a replace multiple/ parse unicode in string function?

I'm working with AZ/ KQL and I'm trying to find out if there is a function to be able to replace multiple values in a string, or alternatively (and better still) a function to replace unicode to string in a log line. For instance I have the…
chaser_o
  • 15
  • 4
1
vote
1 answer

How to create sentinel alerts via az-cli command?

I'm trying to create sentinel alert using az-cli. az sentinel alert-rule create —-name "test" --resource-group example-resources --workspace-name example-workspace But I'm facing this error even though name parameter is included in above…
dev333
  • 713
  • 2
  • 17
  • 38
1
vote
0 answers

Is it possible to automatically update rule analytics on Sentinel?

The Microsoft analytics rule templates get updates from time to time to include additional constraints within their KQL. Currently I'm manually updating each of the rule templates that have been updated by Microsoft. I was wondering if it is…
Antonio
  • 77
  • 2
  • 13
1
vote
2 answers

Azure Sentinel's Kusto: How to do regex does NOT match?

Simplified example | summarize event_count() by State | where State matches regex "K.*S" | where event_count > 10 | project State, event_count OUTPUT: State | event_count KANSAS | 3166 ARKANSAS | 1028 LAKE SUPERIOR | 34 In the above example, a…
zleblond
  • 11
  • 4
1
2
3
12 13