Issue with Sentinel Entra ID Connector
Hello, We have a Log Analytics Workspace that was moved to a different Azure subscription. One of the connectors that is configured is for Entra ID. I'm able to confirm that we're receiving Entra ID logs, but we've found an issue when trying to access…
Incorrect data in the Usage table
Hi folks A few days ago I noticed an odd behavior in multiple environments. In these Sentinel instances we don't have any logs in the AzureDiagnotics table. But when I query the Usage table it shows some data for the AzureDiagnostics DataType. So,…
How to connect the Microsoft Defender XDR event logs using the API?
I'm currently working on automating the deployment of a Microsoft Sentinel workspace using PowerShell scripts. So far, I have successfully used the Microsoft.SecurityInsights API to install solutions and enable analytic rules. Now, I am looking to…
How to connect the Microsoft Defender XDR event logs using the API?
I'm currently working on a project to fully automate the deployment of a Microsoft Sentinel workspace. I already developed a working PowerShell script that uses the Microsoft.SecurityInsights API to install solutions from the content hub and enable the…
How to connect the Microsoft Defender XDR event logs using the API?
I'm currently working on a project to fully automate the deployment of a Microsoft Sentinel workspace. I already developed a working PowerShell script that uses the Microsoft.SecurityInsights API to install solutions from the content hub and enable the…
How to connect the Microsoft Defender XDR event logs using the API?
I'm currently working on a project to fully automate the deployment of a Microsoft Sentinel workspace. I already developed a working PowerShell script that uses the Microsoft.SecurityInsights API to install solutions from the content hub and enable the…
How to connect the Microsoft Defender XDR event logs using the API?
I'm currently working on a project to fully automate the deployment of a Microsoft Sentinel workspace. I already developed a working PowerShell script that uses the Microsoft.SecurityInsights API to install solutions from the content hub and enable the…
Anyone managed to get IoCs ( threat indicators ) from Sentinel to Defender for endpoint
Currently I have some scripts running on a cron job that import IoCs to defender for endpoint indicator list ( this allows blocking on the endpoints) . We have recently setup a Sentinel instance and it’s pretty easy to add threat intel to Sentinel via a…
SecurityEvent Table Transformation DCR not working
I'm having an issue with ingestion on to a Workspace that is connected to Microsoft Sentinel. I have created a Transformation DCR / Ingestion Time Filter on the SecurityEvents table, but am still seeing events in the logs that should have been filtered…
'Microsoft Community v2' in the SigninLogs Table
Hi all, Would anyone be able to explain what 'Microsoft Community v2' is under the AppDisplayName within the SigininLogs table in Sentinel. Does anyone know what this is used for and why it would be triggered failed sign-in attempts for users? Thanks,
Jumpcloud connector not in sentinel
How can we connect it with sentinel, I tried solutions available on Github but it seems to be having an issue The Function app may be missing a module containing the 'New-AzStorageContext' command definition. If this command belongs to a module…
AMA Validation failed - Syslog daemon configuration failed
Hi , Installed AMA via Azure Arc, After giving validation for installation , failed on Verifying Syslog daemon forwarding Configuration. Agent doesn't connected to log analytics workspace. Tried re -install doesn't work
integrating Snowflake with Microsoft Sentinel
i need to integrating Snowflake with Microsoft Sentinel what grants the role needs for this integration?
How to parse CSV data in Data Collection Rule?
Hello, I can parse CSV data with this KQL in LAW: parse_csv(RawData) However, when I use it in the Transform section of the Data Collection Rule, I get the following error: Update Error - Error occurred while compiling query in query:…
AWS S3 bucket logs not ingesting to Microsoft Sentinel
I have configured the AWS S3 data connector in Microsoft Sentinel. Ref: https://learn.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3. I have created a S3 bucket and Simple queue service as documented on the connector page. Furthermore, I have…
Tenable Nessus Data Connector Not working on Microsoft Sentinel
Hello good day, I deploy the Tenable Nessus Data connector to Sentinel using the ARM Template. I have gone over this setup several times without fail. All my settings are right. I see even see the Function App and other dependent components. Everything…
Mapping AWS CloudTrail log schema to Sentinel table columns
Is there a predefined mapping between the AWS CloudTrail log schema and the Sentinel table columns? Specifically, can you provide the schema mapping via the AWS S3 data connector?
A logic app Get-VirusTotalIPReport is not working
I am trying to automate IP enrichment using the Virus Total API. I have set up a logic app and tied it to a respective analytical rule but I am getting the following error. This is a test instance and we have only few resources running on it.
Add Microsoft Sentinel to Log Analytics Workspace using Ansible
I am trying to create a Log Analytics Workspace with Microsoft Sentinel using Ansible following this module: https://docs.ansible.com/ansible/latest/collections/azure/azcollection/azure_rm_loganalyticsworkspace_module.html - name: Create a workspace…
Postgre SQL DB logs
I am trying to connect PostgreSQL DB Events to Microsoft Sentinel using the PostgreSQL Events built in data connector. All the configurations are done properly, heartbeat is there from the machine where this PostgreSQL is installed, but no logs. We are…