Recent Discussions
Loop through array in KQL
Hi, I've been exploring parsing and noticed that when parsing xml you get dictionaries and arrays. You can't pass those in functions, but you can pass a var of type dynamic, but then to loop you have to make a table and join the table with the query that you ran. Does anybody have any idea of how to loop through an array, I couldn't find anything around this?
KQL query question: Filter out results where condition1, condition2, condition3 all evaluate true
Hi Sentinel friends, I've googled and read through many guides and can't find an easy way to perform a multi-variable exclusion statement. I need to be able to exclude a result if multiple variables ALL evaluate true. The pseudo logic I'm looking to apply is something like: Table | where Event == "12" (pseudo code) | except where (condition1 == x AND condition2 == y AND condition 3 == z) I tried things like: 1) | !where condition1 == "x" and condition2 == "y" and condition3 == "z" [this doesn't work] 2) | where !(condition1 == "x" and condition2 == "y" and condition3 == "z") [this doesn't work] 3) | where condition1 != "x" and !condition2 != "y" and condition3 == "z" [the logic here evaluates all conditions separately, instead I need it to only exclude only when all of the variables evaluate true for a specific log line] The only way I could figure out how to do this was to do 2 queries then do a left antijoin of the resulting datasets, but it's a big and messy query. I'm hoping that there's a simpler method that I'm missing. Ex: Table | where Event == "12" | join kind=leftanti ( Table |where Event == "12" | where condition1 == "x" and condition2 == "y" and condition3 == "z") on KEY Note: I did find materialize so at least I'm not querying the dataset twice.
Kusto Regex Matches
I'm trying write a query that will match logs where a field contains any domain other than our own. This is what I have tried: | where Recipient matches regex @"(@(?!ourdomain)[A-Za-z0-9]+(.))" But Kusto uses the re2 library which does not support lookarounds, as noted here: https://github.com/google/re2/wiki/Syntax Is there a workaround in Kusto to exclude strings from regex matches?AMA vs MMA which one should we go ahead???
Hello there, we have an issue with one of the Azure sentinel clients, where the cost has considerably increased due to a particular Event ID generating alot of traffic. Event ID 4663: Attempt to access an object” has highest count of “8263330” within 24 hours We dont want to just filter out this event all togather since this event ID is important specially for monitoring of OS level executables which at times attackers exploit/misuse. Going through the documentation, I see that AMA has capability to filter the event IDs using the XPath queries. I went through one of the blog post that says that when using AMA instead of MMA, we need to consider below: AMA can co-exist with MMA however, we will receive two heartbeats from one endpoint, one for each agent AMA will also collect logs and MMA as well, so rather than reducing logs, we will be having more logs coming in. I have customer who already has MMA installed and I cannot just ask him to uninstall all the MMA agents and install AMA agents from scratch? any easy resolution for this problem? We have new customers coming in and I dont want to end up in the same situation, so shall we start using AMA agent, is it stable enough as compared to MMA? or recommended by Microsoft to move ahead instead of MMA.? I dont see AMA agent installed within sentinel portal, only MMA is there. so from where can i download this?? I need answers on the above queries, any help will be much appreciated? Thanks Fahad.
Recent Blogs
- This guide will walk you through the steps required to integrate Fluent Bit with Microsoft Sentinel. Beware that in this article, we assume you already have a Sentinel workspace, a Data Collection En...Feb 14, 2025
- Microsoft Sentinel just rolled out a powerful new public preview feature: Ingestion Rules. This feature lets you fine-tune your threat intelligence (TI) feeds before they are ingested to Microsoft Se...Feb 14, 2025
