Forum Discussion

TheHoff70's avatar
TheHoff70
Brass Contributor
Feb 16, 2024

Detonation screenshot missing

Greetings

I came across this post again, regarding the Sentinel URL detonation feature, and it reminded me I need to check the forum for input on this.
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-the-new-built-in-url-detonation-in-azure-sentinel/ba-p/996229.

I simply does not see the same information as presented by the blog post which is frustrating since having a screenshot of the URL would save our team a visit to a 3rd party service for the screenshot.

 

What makes me qurious is the fact that the screenshot information seems to be there in the incident as seen by the above incident when it's sent to a playbook.

 

 

{
      "url": "mse-amx.csdata3.com",
      "additionalData": {
        "DetonationVerdict": "GOOD",
        "DetonationFinalUrl": "mse-amx.csdata3.com",
        "DetonationScreenshot": "https://sentineldetonateprodweu.blob.core.windows.net/daasimagestore/20240215%5C4ce5e731-e932-4dd1-8099-0e23c43680d3%5CScreenshot-0.png?skoid=df0239eb-5cb3-48ab-9e85-599bb72690f5&sktid=33e01921-4d64-4f8c-a055-5bdaffd5e33d&skt=2024-02-15T15%3A06%3A45Z&ske=2024-02-22T15%3A06%3A45Z&sks=b&skv=2021-08-06&sv=2021-08-06&st=2024-02-15T15%3A06%3A45Z&se=2024-02-22T15%3A06%3A45Z&sr=b&sp=r&sig=37RgHciOoQJEReT2MDxLlEO2R9LYPdpM28mbXl27dDg%3D"
      }

 

 

In this case the rule generating the incident is an NRT but that shouldn't be the issue since the URL to the screenshot is written to the incident.

Feels like a bug but I don't know.

 

Regards

Fredrik

No RepliesBe the first to reply

Resources