Azure Sentinel To-Go (Part1): A Lab w/ Prerecorded Data 😈 & a Custom Logs Pipe via ARM Templates 🚀

Cyb3rWard0g - Using the KQL from your "Potential Lateral Movement" example I posted previously, I created an Analytic which ran every 5 hours over the last 5 days' worth of data - just so that I got a bunch of Incidents to look at, even though I appreciate they're really all the same event 

Once that had created a few Incidents I drilled into Investigation, and discovered that Sentinel can show linked events (related to Computer and User in this case) and it was this feature which I wanted to be able to showcase.  Whilst I was able to fake it with a dummy Incident (see KQL below) I was hoping to be able to use some of the real data present in the Mordor data set, but couldn't easily work out how to capture that via KQL, as all the examples listed on the Mordor website didn't appear to be present in the dataset.

Dummy Incident for showcasing linked events

prerecorded_CL
| extend a=parse_json(Message)
| where a.Hostname == "NASHUA.dmevals.local"
| where a.TargetImage != @"C:\windows\System32\svchost.exe"
| where a.SourceName == "Microsoft-Windows-Security-Auditing"
| where a.SourcePort == 59914
| project Hostname=tostring(a.Hostname)
| extend HostCustomEntity = Hostname