Recent Discussions
Minemeld Threat Intel Integration to Sentinel
Hello guys, I have deployed a Minemeld server in Azure, I'm pulling free threat intel in there. Processing it, then using the Microsoft Security Graph extension to forward it to Microsoft. Turned the Threat Intel Connector on and now I have the Threat Intel in the LogAnalytics space. There are two issues I have, in order: 1. Currently, with threat intel of type IP, I get the IP in a field called ExternalIndicatorID. A sample value for this is: IPv4:36.119.0.0-36.119.255.255 . As you can see, we have IPv4: then a range of IPs follows. The problem is this is something that's very impractical to use from an analytics point of view. I have to write the query in such a way to ignore the "IPv4:" and then also be able to interpret range. This is impractical and the preview Threat Intel rules offered by Microsoft do not use that field. They instead use NetworkIP, NetworkDestinationIP, NetworkSourceIP ....whichever of the three they find with a value. For me however, those values are empty. Apparently this is something that must be changed with the Minemeld processor so that it does not merge IPs and generate ranges. I have not found a way to do that. Has anyone managed to do that or otherwise any other workarounds to be able to consume Minemeld IP Threat Intel in Sentinel? 2. The second thing and I'm not completely sure here as nr 1 was a much bigger priority, is the Microsoft Security Graph extension for Minemeld only able to consume URLs, Domains and IPs? No emails, hashes, etc? I have also asked on Palo Alto's board, however I'm really curious and could use a hand from someone who managed to already do this. Thank you!
Playbook (Logic App) - trigger - When Azure Sentinel incident creation rule was triggered
Hi i am attempting to use the trigger "When Azure Sentinel incident creation rule was triggered" that's in preview. but the playbook is not triggered even if i know that i have a new incident in Sentinel what's missing from the configuration?
I am trying to create a watchlist that displays specific alerts from different business units
here is the query below. I would like to be able to determine which specific business unit server an alert was generated into Azure sentinel but I am unable to create a tag that includes a watchlist that provides the expected result. Please help Heartbeat | lookup kind=leftouter _GetWatchlist('MBSFQDN_01') on $left.Computer == $right.SearchKey | project UNIT, ComputerAzure Sentinel Automation (Preview) - Issue with Permission assignment
Hi @AzureSentinel Team, I believe this is a bug unless there is any reason to do so. At Azure Sentinel Automation (Preview) when tried to assign permission for logic app I am getting the error below. Pls Note: Although i am the owner of subscription i am not able to assign the permission whereas only global admin with subscription ownership can do this role assignment. Saving automation rule 'TEST 1' failed. Error: Caller is missing required playbook triggering permissions on playbook resource '/subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Logic/workflows/logicapp1', or Azure Sentinel is missing required permissions to verify the caller has permissions Thanks.TiIndicators not showing up in ThreatIntelligenceIndicator Logs
It seems that around July 2nd, 7/2/2020, 9:17:26.272 PM UTC, all of our custom TiIndicators stopped showing up in our ThreatIntelligenceIndicator logs. All of the logic apps are running successfully and POSTing to the SecGraphApi - with the correct responses. We can also send a GET to the API with the newly created TiIndicator ID and verify that the indicator exists. When searching the logs we are not seeing anything, however. The indicators retrieved by the built in TAXII data connector are still in the logs. We have tested this with the standard POST method the to API as well as the new MS Graph Security - Create TiIndicator/Create Multiple TiIndicator actions in the LogicApps. We have also tested in a separate tenant.
Sentinel data Connector Health Status -email notification
Hey guys, I have created a playbook for monitoring sentinel data connectors health and an email notification is setup if there is no logs received for any connector in last 48 hrs . It is fully functional and I able to fetch last event time and data type associated with connectors. Below snap show the data I am populating over the email in tabular format. I am using query based playbook and it is worth mentioning the query here which I am using to populate the data through logic app. union withsource=TableName1 * | where TimeGenerated > ago(2d) | project TimeGenerated, TableName1, DeviceVendor,ProviderName | summarize last_log = datetime_diff("second", now(), max(TimeGenerated)),last_event_received = max(TimeGenerated) by TableName1, DeviceVendor,ProviderName | project ['Table Name'] = TableName1, ['Latest Record Created'] = last_log, ['Time'] = last_event_received, DeviceVendor, ProviderName But, when I am trying to populate list of all the datatypes/datasets . It is not getting populated as it is time frame dependent. So, I am unable to know which datatype is missing if there is no logs generated in that particular time frame. Moreover, if someone don't know how many datatypes have been integrated then its very difficult to know which data type is not receiving logs as multiple device logs can be configured under common security logs or syslog datatypes . I am facing these two issues : 1. Please help me how I can populate all the datatype irrespective of time frame using KQL. 2. Also, I want to populate the data connector name associated with datatype but I was not lucky enough to create a KQL query for that as I don't know how connector name is mapped with data types. Any help or suggestion to fix above issues will be appreciated.
Recent Blogs
- This guide will walk you through the steps required to integrate Fluent Bit with Microsoft Sentinel. Beware that in this article, we assume you already have a Sentinel workspace, a Data Collection En...Feb 14, 2025
- Microsoft Sentinel just rolled out a powerful new public preview feature: Ingestion Rules. This feature lets you fine-tune your threat intelligence (TI) feeds before they are ingested to Microsoft Se...Feb 14, 2025
