Forum Discussion
AutomationMan
Aug 18, 2020Copper Contributor
Writing rules for legacy server feeds
Hi, I'm new to Sentinel with my only real experience being the MS Sentinel Ninja training. I have a list of events from an existing SIEM that I need to replicate in Sentinel using data coming from...
- Aug 24, 2020Hi
For the schedules, I would do it another way
You could write a script which runs a query for you and then shoots an email.
That is probably the preferred way as you are looking for reporting, not alerting.
For emails, it's true Logic Apps is the only way. For something simple as email, I agree that it's a bit of a hassle to go through
Uploading TI's is also possible through API, which might be easier for a few quick tests
Thijs Lecomte
Aug 23, 2020Bronze Contributor
Some of these rules are already in the analytics templates.
Have you looked into the rules with data 'security events'?
That's what you need here
Have you looked into the rules with data 'security events'?
That's what you need here
- AutomationManAug 23, 2020Copper Contributor
Hi there and thanks for the reply.
Yes I have looked through the templates and I made some reasonable progress over the weekend, but also hit a lot of challenges on the way!
Not the least of which is that the preview release won't allow alert schedules of more than one day so I'm still trying to figure out how to do the once a week and once a month reports.
e.g.
Other challenges include the need to set up Logic Apps and create a playbook just to send a response email and in doing that, having to resolve automation issues composing and sending the email.
I've yet to work through the integration of threat feeds so I can use the TI_rules to do the IoC matching requirements although I have found the page describing that process.
https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence- Thijs LecomteAug 24, 2020Bronze ContributorHi
For the schedules, I would do it another way
You could write a script which runs a query for you and then shoots an email.
That is probably the preferred way as you are looking for reporting, not alerting.
For emails, it's true Logic Apps is the only way. For something simple as email, I agree that it's a bit of a hassle to go through
Uploading TI's is also possible through API, which might be easier for a few quick tests- AutomationManAug 25, 2020Copper Contributor
Thank you for your input.
As I get more of an understanding of how the ecosystem fits together I am understanding more of what tables I need to query and what entities within those tables are/are-not populated from their sources.
We were asked to replicate what one SIEM (splunk) was being used for, in another SIEM (Sentinel) but now understanding that Logic Apps is actually the preferred (and in some case perhaps the only practical) way to achieve the email reporting function we were required to provide from Log Analytics, helped me clarify the definition of Sentinel as a SIEM (+SOAR) vs just being a glorified report generator which it is not really designed for!It all starts to make more sense now 🙂
My new challenge is getting the LA Playbook query output parsed up and presented in a neat email format, but I seem to be winning with that too now 🙂