Forum Discussion
Add Search Results to alert details in Microsoft Sentinel
Thanks for the reply GaryBushey ,
I am not currently running any queries. My goal is to append the logs that triggered the alerts to the alert details. In the SecurityAlert table, there is a column called OriginalQuery, and I assume that by using this KQL query, I can retrieve the events that triggered these alerts.
I need to add these triggering events to the SecurityAlert table. My question is: what is the easiest and most straightforward way to achieve this? The query inside OriginalQuery varies depending on the alert.
Hello, you already get a few places that take you to the results in the Investigation UI (see below), so I guess you need this data for some other use like in your ITSM tool? You'll see a query like this
SecurityAlert
| summarize arg_max(TimeGenerated, *) by SystemAlertId
| where SystemAlertId in("a guid will go in here")
and if there are events you'll see
But if you really need it again, then as Gary says, a playbook will be the option
Note even with the contents of OriginalQuery you may need to amend it to re-run at the same time as the original, so you may need something like this as a new line 1 of the query
set query_now = datetime("1/1/2025, 2:20:46.333 PM");
Thank you for the reply Clive_Watson
I need to archive alerts along with their associated events and send them to an external storage solution. Do you think appending these events to the alerts table is the best approach to ensure both entities (alerts and the events that triggered them) are archived together? I am considering using Logic Apps to automate the process.