Microsoft Sentinel | Microsoft Community Hub

Connect with experts and redefine what’s possible at work – join us at the Microsoft 365 Community Conference May 6-8. Learn more >

Forum Widgets

Latest Discussions

Affected rows stateful anomaly on database vs. Response rows stateful anomaly on database
Is there a difference between the two scheduled rules, "Affected rows stateful anomaly on database" and "Response rows stateful anomaly on database"? I can see that they have different descriptions: - Affected rows stateful anomaly on database - To detect anomalous data change/deletion. This query detects SQL queries that changed/deleted a large number of rows. - Response rows stateful anomaly on database - To detect anomalous data exfiltration. This query detects SQL queries that accessed a large number of rows. This tells me the alerts query should be different. However, when I compare the two they are exactly the same.
Solved
lfg524
Copper Contributor
Feb 21, 2025
alerts
analytics
45Views
0likes
2Comments
KQL to match URL FW LOGS and Threatfox URL feeds
Hi all, I try to match RequestURL field (in CommonSecurityLog) from a Fortigate FW with URL Haus live feeds. The query does not produce any errors but it doesn't match anything. let ThreatFox = externaldata(URL: string ) ["https://threatfox.abuse.ch/export/csv/recent/"] with (format="txt", ignoreFirstRecord=True); let ThreatFoxUrl = ThreatFox | where URL contains "url" | extend URL = replace_string(URL, "\"", "") | extend parse_csv(URL) | extend URL = URL[2]; CommonSecurityLog | where RequestURL has_any (ThreatFoxUrl) The following query is working fine with HASH let MalwareBazaarMISP = externaldata(SHA256: string) ["https://bazaar.abuse.ch/export/txt/sha256/recent"] with (format="txt", ignoreFirstRecord=True); let SHA256Regex = '[a-f0-9]{64}'; let MaliciousSHA256 = materialize ( MalwareBazaarMISP | where SHA256 matches regex SHA256Regex | distinct SHA256 ); DeviceProcessEvents | where SHA256 has_any (MaliciousSHA256) Rehards, HA
Solved
HA13029
Brass Contributor
Feb 14, 2025
analytics
KQL
78Views
0likes
7Comments
SecurityIncident access from Sentinel tenants
Hello, My company's business model follows the Sentinel MSP with visibility to Customer Sentinel via Lighthouse. All the incidents from across the Customer Sentinels are located on the Sentinel MSP (since the detection rules reside on the Sentinel MSP). Although it might not be the usual MSP model (hosting incidents in the MSP Sentinel), we want to provide visibility to our Customers regarding their Incidents (with all updates) in a dashboard. Is there a possibility we can have a solution for this?
Solved
un1claudiu
Copper Contributor
Feb 06, 2025
Dashboards
siem
96Views
0likes
5Comments
Query to Fetch Sentinel Admin Activities from Sentinel
Hello, I would like to know if there is a specific query available to fetch Sentinel admin activities directly from Sentinel itself. Thank you!
Solved
Rayen
Copper Contributor
Jan 13, 2025
data collection
KQL
Log Data
siem
52Views
0likes
1Comment
Fetch Sentinel admin activity
Hello, I would like to know if there is a specific query available to fetch Sentinel admin activities directly from Sentinel itself. Thank you!
Solved
Rayen
Copper Contributor
Jan 13, 2025
analytics
data collection
Log Data
monitoring
playbooks
43Views
0likes
1Comment
ARM template for deploying a workbook template to Microsoft Sentinel
Hello, I am attempting to deploy an ARM Template (execution using PowerShell) for any Analytic Rule to a Microsoft Sentinel instance. I have been following this link: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-automate#next-steps. I am struggling with ensuring the Workbook is deployed to the Microsoft Sentinel workbook gallery and NOT the Azure Monitor one. The link includes a sample ARM template where you can add <templateData> (JSON code), which represents the workbook you wish to deploy. I get it working to deploy to the Azure Monitor workbook gallery but not for it to be present in the Microsoft Sentinel one. Jason
Solved
JMSHW0420
Iron Contributor
Dec 16, 2024
analytics
automation
Workbooks
520Views
0likes
15Comments
Cannot access aka.ms/lademo
Hello team, I am Nikolas. I am learning KQL for Microsoft Sentinel. As far as I know, we can access the aka.ms/lademo for demo data. However I cannot access the demo. I tried using VPN, access page from many other devices with different IP address different account. But it does not work. Can you help to confirm if this link is still accessible. I can access the resource last week, but not this week. I am looking forward to hearing from you.
Solved
NikolasMS
Copper Contributor
Dec 06, 2024
KQL
kusto
Log Data
219Views
1like
2Comments
Automating label downgrade email notifications
I've been asked to investigate scheduling a query to run once a day that searches for label downgrade activities and sends an email with a list of events to the user's manager (according to the AD attribute). The thinking is, the manager is more likely to know if the files that are being downgraded are sensitive, personal or inconsequential and can alert us if they are sensitive and we need to investigate further. I have a KQL query that provides the results, I have created an analytics rule that runs the query every 24 hours and generates an alert, but when it comes to the Playbook i'm not sure how/if I can extract the fields/attributes from the results so I can use them to generate the email(s). I want the manager to only get the results for the people in their team/department, not the results for everyone in the company, so I would expect separate emails will be sent to each manager daily, rather than the same email going to multiple managers. Is what I am trying to do feasible, and if so, am I going about it the right way? Any advice appreciated.
Solved
Cameron_Stephens
Copper Contributor
Nov 01, 2024
automation
KQL
playbooks
224Views
0likes
7Comments
Issue in Uninstallation of AMA for Arc Enabled Windows server
Dear Community, As a troubleshooting, I want to uninstall the AMA agent from Azure arc enabled server, I tried "Uninstall" from Azure arc machine - Extension - Uninstall but it went into "Deleting" state for 2 days. Then i tried uninstallation using the Powershell but again it went to "deleting" state. I tried removing and adding the Machine to and from DCR and Azure Arc again and then tried again still it shows deleting state only. So, i tried uninstallation direct from server using command azcmagent extension remove --name AzureMonitorWindowsAgent the got the below error, From my test machine i copied the "HandlerManifest.json" file and put in the same folder where error is showing above, Json file has this content as shown below Now after this i tried "azcmagent extension remove --name AzureMonitorWindowsAgent" command again and got the error, Please help in uninstalling this AMA agent. Thanks, Mahesh
Solved
JohnWickXV
Copper Contributor
Oct 29, 2024
azure
data collection
siem
227Views
0likes
2Comments
Sysmon /operational is not in Event table
Hi Team, Need to create usecase base on Sysmon /operational and with Event ID = 1. But Sysmon is not configured. Usecase is based on process. It is github usecase. Need to create with the help of defender table. Windows Binaries Lolbins Renamed KQL : Event | where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==1 | parse EventData with * 'Image">' Image "<" * 'OriginalFileName">' OriginalFileName "<" * | where OriginalFileName has_any (procList) and not (Image has_any (procList)) | parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Description">' Description "<" * 'CommandLine">' CommandLine "<" * 'CurrentDirectory">' CurrentDirectory "<" * 'User">' User "<" * 'LogonGuid">' LogonGuid "<" * 'Hashes">' Hashes "<" * 'ParentProcessGuid">' ParentProcessGuid "<" * 'ParentImage">' ParentImage "<" * 'ParentCommandLine">' ParentCommandLine "<" * 'ParentUser">' ParentUser "<" * | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ParentImage, ParentProcessGuid, ParentCommandLine, ParentUser, Image, ProcessGuid, CommandLine, Description, OriginalFileName, CurrentDirectory, Hashes | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'') Now same usecase need to be configured with the help of defender table "DeviceProcessEvents". But don't now how to find out Image information which is in Event Table.
Solved
akshay25june
Copper Contributor
Oct 10, 2024
KQL
187Views
0likes
3Comments

Resources

Tags

siem404 Topics
KQL279 Topics
data collection225 Topics
Log Data200 Topics
analytics143 Topics
azure137 Topics
automation126 Topics
integration122 Topics
kusto113 Topics
playbooks110 Topics

Share