Forum Widgets
Latest Discussions
Everything Azure Sentinel connectors
Hi Everyone, I have finalized my blog series on ingesting data to Azure Sentinel and thought you might find a summary useful. Even if you don't find the event, or enrichment, source in one of the built-in connectors, good chances that Sentinel does support it, and if not, Sentinel has a broad array of tools to create custom connectors. Here are the relevant blog posts to guide you to find your connector or develop a custom one: Using the agent to collect telemetry from on-prem and IaaS server Collecting Azure PaaS services logs The Syslog and CEF source configuration grand list Creating Custom Connectors ~ OferPrivate preview for automated playbook activation on an alert
Hi Everyone, Encountered this? I am happy to announce that we have started private for automated playbook activation. If you would like to fire up a playbook when an alert rule triggers, contact me to be included in the preview. Thanks ~ OferTime Series analysis and visualization in Azure Sentinel
I have posted couple of blogs around Time Series analysis and visualization on security event log data sources in Azure Sentinel Blog 1: Introduction to Time Series, Step by step guide on compiling queries, configure alerts and investigate the results. Data Source : Windows Event Log - Process Execution Data https://techcommunity.microsoft.com/t5/Azure-Sentinel/Looking-for-unknown-anomalies-what-is-normal-Time-Series/ba-p/555052 Blog 2: Visualization and interpreting Time Series Data. Data Source- Palo Alto Network Traffic Logs https://techcommunity.microsoft.com/t5/Azure-Sentinel/Time-Series-visualization-of-Palo-Alto-logs-to-detect-data/ba-p/666344 As always, Feedbacks or questions are welcome.Public Preview: Improved Data Connector
We’ve improved the data connector for Azure Sentinel and we’d like you to try it out. You can participate in the public preview by visiting the Azure Sentinel “Data connectors” page. Screenshots, explanations, and other details can be found in our documentation at https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources. The data connector’s new interface includes better visualization for status and permissions, improved search, and better instructions. We’d love to get your feedback at https://aka.ms/ASDCvNext.
Detailed Email Alerts
One area that I haven't seen covered is how to get more detail into email alerts that may be generated as the result of a playbook execution. You can get basic alert information but no information on the event data. I configured this playbook which will run the query that is part of the analytic rule and send those in an email formatted as an HTML table. This is the JSON schema: { "properties": { "Query": { "type": "string" }, "Query End Time UTC": { "type": "string" }, "Query Period": { "type": "string" }, "Query Results Aggregation Kind": { "type": "string" }, "Query Start Time UTC": { "type": "string" }, "Search Query Results Overall Count": { "type": "string" }, "Total Account Entities": { "type": "string" }, "Total Host Entities": { "type": "string" }, "Total URL Entities": { "type": "string" }, "Trigger Operator": { "type": "string" }, "Trigger Threshold": { "type": "string" } }, "type": "object" } Hope this is helpful for some of you.Using Jupyter Notebooks for CyberSecurity Hunting
We've start a blog companion to the #AzureSentinel Community. I've recently posted 2 articles on using Jupter Notebooks in Azure Sentinel for hunting and investigation. Security Investigation with Azure Sentinel and Jupyter Notebooks – Part 1 Security Investigation with Azure Sentinel and Jupyter Notebooks – Part 2 (3rd and final part coming shortly). Also check out this article if Jupyter is new to you Why Use Jupyter for Security Investigations? Also check out shainw's article on Azure Sentinel: Performing Additional Security Monitoring of High-Value Accounts. Feedback (including requests for future subjects) is very much welcome. Ian
