Can Sentinel tell which network WAP my endpoint devices are connected to?

Question

Hi,I am not familiar with Sentinel.&nbsp;Can it tell me&nbsp;which network Wireless Access Point that all the endpoint devices are connected to in real time?&nbsp;My context is a large enterprise environment with mixed network vendors and equipment.Since Sentinel can aggerate, maybe I could bring all the WAPs and Endpoint devices in?&nbsp;Best regards,Cheers,

billclarksonantill · Answer

nhtkid&nbsp;everyone starts somewhere&nbsp;&nbsp;short answer is yes to your question, Sentinel can correlate all the data you require and show which endpoints are connected to which WAPs in and around your environment&nbsp;it's all a matter of ingesting logs from the devices you have and there are several pathways to do that&nbsp;Check out this link below for data ingestion pathways into Sentinel for this&nbsp;Microsoft Sentinel data connectors | Microsoft LearnBest practices for data collection in Microsoft Sentinel | Microsoft LearnCustom data ingestion and transformation in Microsoft Sentinel | Microsoft Learn

christian_bartsch · Answer

You could create a playbook, that gets triggered when an alert that you are interested in pops up.

Within the playbook you can extract the IP address from the alert‘s entities and use it to perform a KQL query in the table that holds your AP logs and search for a connection event or something like that.

Then create an update incident action and tag that incident with the AP‘s name or something.

Forum Discussion

Can Sentinel tell which network WAP my endpoint devices are connected to?

2 Replies

Resources