Questions tagged [azure-sentinel]

Microsoft Azure Sentinel is a proprietary cloud-native SIEM (Security Information and Event Management) software that provides security analytics for an enterprise application.

Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.

Azure Sentinel is a birds-eye view across the enterprise alleviating the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution timeframes.

  • Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.

  • Detect previously undetected threats, and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.

  • Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.

  • Respond to incidents rapidly with built-in orchestration and automation of common tasks.

Building on the full range of existing Azure services, Azure Sentinel natively incorporates proven foundations, like Log Analytics, and Logic Apps. Azure Sentinel enriches your investigation and detection with AI, and provides Microsoft's threat intelligence stream and enables you to bring your own threat intelligence.

196 questions
10
votes
3 answers

How do I print a tree using the Kusto Query Language?

Below is a quick and unglamorous solution. If you have a better one, please include it in your answer. let tree_height = 15; range i from -1 to tree_height * 2 step 2 | extend side_width = tree_height + 1 - i / 2 | extend side_space = strrep(" ",…
4
votes
1 answer

Count how many elements are in an array created by make_set in kusto language

How to count the elements in an array created by make_set in KQL?
Adi Dibra
  • 43
  • 1
  • 3
3
votes
1 answer

Using KQL and externaldata() operator to pull infromation from json file

Trying to create a sentinel query (KQL) which uses the externaldata() operator to ingest the information from the json file 'https://www.gov.uk/bank-holidays.json'. Problems I am finding is due to this json file containing the column / field 'date'…
Stuart
  • 43
  • 3
2
votes
2 answers

Get all TI Indicators returns an empty list

I am trying to collect all active TIs via the Beta Graph API by following this. But it doesn't return anything. Here is what I use in Postman: https://graph.microsoft.com/beta/security/tiIndicators Response (200): { "@odata.context":…
Rubeste
  • 75
  • 1
  • 8
2
votes
1 answer

Kusto Query Language - Extract all between two Characters

I'm working on extracting an email address from the additionalextensions column in Sentinel. I've found a regex that works perfectly in a calculator, extracting everything after a colon (:) up to a semicolon followed by the latter s (;s). However,…
Con
  • 23
  • 3
2
votes
0 answers

Azure Sentinel PublicIP associations/disassociation logs

For the purposes of alerting when something has happened concerning a public IP, for example, a Public IP address was associated with a resource (NIC, Load Balancer, etc.), shouldn't this work? AzureActivity | where OperationNameValue ==…
Rakim
  • 167
  • 11
2
votes
2 answers

How to write a Kusto query to get previous month logs in sentinel?

| where TimeGenerated > ago(30d) only gives me the last 30 days logs and I'm searching for a query to get previous month logs from a table, so I can export it directly into Power BI.
St Online
  • 67
  • 1
  • 8
2
votes
1 answer

how to use wildcard (*) for join parameter in KQL?

I'm racking my brain with this and would like some help. :) I want to know how to use wildcard(*) for join union parameter. I need to join two tables with the same names in the fields, however, some fields may come with the wildcard(*), since for…
2
votes
1 answer

String Manipulation in KQL

How can you Manipulate the output of a string in KQL? For example I have a query to find loggedon users for a specific group of devices and this is an output I received. I would only want Username to show in the output. DeviceInfo |where DeviceID==…
2
votes
1 answer

Using KQL to search on subnets

I want to search something for IP's coming from a specific set of subnets. Some query languages are smart enough to know a /24 is a subnet, but KQL is not. Is there an alternative to this? This is not what I'll be searching on, but for the sake of…
2
votes
1 answer

Microsoft Graph Security API - Issue with https://graph.microsoft.com/beta/security/tiIndicators

I am trying to use Microsoft graph API threat Indicators API based on Azure sentinel recommended way of integrating threat intelligence sources for IOC ingestion to Sentinel Instance. I perform the following steps in linux curl to test the…
Deep
  • 35
  • 1
  • 3
  • 8
1
vote
1 answer

KQL: Merge 2 column of the same table

I'm trying to merge 2 column of the same table into 1 column. from Col1 Col2 1 4 2 5 3 6 into Col3 1 2 3 4 5 6 I'm a KQL newbie. My goal is to have a query, extract information of two column, merge the two…
kbo-eqs
  • 11
  • 2
1
vote
1 answer

Create a dynamic column with values that match a criteria - KQL

I am trying to add values from a dynamic array of integers called utfChars to a new dynamic array called suspiciousCharactersDetected but only when they match a specific criteria. The criteria is that if the value is in the range defined by the…
LiamWBA
  • 53
  • 7
1
vote
1 answer

Azure Sentinel: How to convert the existing log analytics as Azure Sentinel workspace?

I have a centralized log analytics workspace to which all the logs are being sent including: Activity Logs  Network Logs  Resource Logs  System Metrics  Application Logs  Application Insights Now, I want to use this log analytics workspace as a…
One Developer
  • 99
  • 5
  • 43
  • 103
1
vote
2 answers

Sentinel KQL query to extract JSON from syslog data (source is CSW / Tetration)

Below is an example syslog message coming into Sentinel from Cisco Secure Workload (formerly Tetration): Alert[11]: [WARNING]…
1
2 3
12 13