Query Alert Status and Assigned User

%3CLINGO-SUB%20id%3D%22lingo-sub-1141641%22%20slang%3D%22en-US%22%3EQuery%20Alert%20Status%20and%20Assigned%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1141641%22%20slang%3D%22en-US%22%3E%3CP%3ELooking%20to%20query%20to%20alerts%2Fincidents%20that%20have%20not%20been%20assigned%2Fpicked%20up%20or%20to%20look%20at%20the%20current%20status%20(New%2FIn%20Progress)%20to%20detect%20and%20alert%20on%20stale%20events.%26nbsp%3B%20I%20use%20the%20following%20query%20to%20generate%20a%20list%20of%20all%20the%20SOC%20events%20the%20staff%20are%20looking%20at%20but%20I%20don't%20not%20see%20a%20User%20or%20Status%20field%2C%20anyone%20have%20a%20answer%20or%20work%20around%20to%20this%20one%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3ESecurityAlert%20%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20ProviderName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E'ASI%20Scheduled%20Alerts'%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%3CSPAN%3E%20ProviderName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E'CustomAlertRule'%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1141761%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20Alert%20Status%20and%20Assigned%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1141761%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F408589%22%20target%3D%22_blank%22%3E%40ryanksmith%3C%2FA%3E%26nbsp%3BWhat%20you%20are%20looking%20at%20is%20the%20listing%20of%20Alerts%2C%20not%20the%20Incidents.%26nbsp%3B%20Alerts%20do%20not%20get%20assigned%20to%20users%2C%20only%20the%20Incident%20will.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%2C%20you%20cannot%20query%20Incidents%20using%20KQL%20directly.%26nbsp%3B%20You%20have%20to%20use%20the%20Azure%20Sentinel%20REST%20API.%26nbsp%3B%20There%20have%20been%20a%20few%20posts%20about%20doing%20this%20lately%2C%20including%20mine%20on%20doing%20this%20through%20PowerShell%20%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.garybushey.com%2F2020%2F01%2F11%2Fyour-first-azure-sentinel-rest-api-call%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.garybushey.com%2F2020%2F01%2F11%2Fyour-first-azure-sentinel-rest-api-call%2F%3C%2FA%3E%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1142120%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20Alert%20Status%20and%20Assigned%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1142120%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%20I'll%20take%20a%20look%2C%20very%20surprised%20we%20cant%20query%20this%20without%20to%20jump%20though%20a%20bunch%20of%20hoops%2C%20I%20have%20been%20able%20in%20every%20other%20SIEM%20I%20have%20worked%20with.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1142807%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20Alert%20Status%20and%20Assigned%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1142807%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F408589%22%20target%3D%22_blank%22%3E%40ryanksmith%3C%2FA%3E%26nbsp%3BI%20agree%2C%20but%20considering%20the%20API%20is%20still%20not%20G.A.%20we%20may%20be%20able%20to%20see%20something%20to%20make%20it%20easier%20once%20it%20does.%26nbsp%3B%20I%20would%20love%20to%20be%20able%20to%20have%20a%20workbook%20showing%20me%20the%20stats%20of%20my%20Incidents%2C%20but%20I%20guess%20that%20is%20more%20what%20something%20like%20ServiceNow%20is%20for.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1142813%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20Alert%20Status%20and%20Assigned%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1142813%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F408589%22%20target%3D%22_blank%22%3E%40ryanksmith%3C%2FA%3E%26nbsp%3BI%20also%20have%20a%20blog%20post%20about%20getting%20the%20Incidents%20into%20PowerBI%20where%20you%20can%20create%20all%20sorts%20of%20nice%20reports.%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.garybushey.com%2F2020%2F01%2F20%2Fazure-sentinel-incidents-in-powerbi%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.garybushey.com%2F2020%2F01%2F20%2Fazure-sentinel-incidents-in-powerbi%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Looking to query to alerts/incidents that have not been assigned/picked up or to look at the current status (New/In Progress) to detect and alert on stale events.  I use the following query to generate a list of all the SOC events the staff are looking at but I don't not see a User or Status field, anyone have a answer or work around to this one?

 

SecurityAlert | where ProviderName == 'ASI Scheduled Alerts' or ProviderName == 'CustomAlertRule'
4 Replies

@ryanksmith What you are looking at is the listing of Alerts, not the Incidents.  Alerts do not get assigned to users, only the Incident will.

 

Unfortunately, you cannot query Incidents using KQL directly.  You have to use the Azure Sentinel REST API.  There have been a few posts about doing this lately, including mine on doing this through PowerShell : https://www.garybushey.com/2020/01/11/your-first-azure-sentinel-rest-api-call/  

Thanks @Gary Bushey I'll take a look, very surprised we cant query this without to jump though a bunch of hoops, I have been able in every other SIEM I have worked with. 

@ryanksmith I agree, but considering the API is still not G.A. we may be able to see something to make it easier once it does.  I would love to be able to have a workbook showing me the stats of my Incidents, but I guess that is more what something like ServiceNow is for.

@ryanksmith I also have a blog post about getting the Incidents into PowerBI where you can create all sorts of nice reports.  https://www.garybushey.com/2020/01/20/azure-sentinel-incidents-in-powerbi