Microsoft Sentinel Blog

Options
1,759
Umesh_Nagdev on Apr 19 2024 07:55 AM
1,508
jeffsc on Apr 15 2024 11:17 AM
1,509
jeffsc on Apr 15 2024 11:17 AM
4,069
Preeti_Krishna on Mar 28 2024 02:56 PM
5,071
Matt_Lowe on Mar 14 2024 05:21 PM
3,650
Umesh_Nagdev on Feb 20 2024 07:04 AM
2,989
Josefa-Sepulveda on Feb 08 2024 07:58 AM
5,183
BenjiSec on Feb 06 2024 04:03 AM
4,257
PrateekTaneja on Feb 04 2024 10:22 PM
5,459
madesous on Jan 17 2024 05:27 AM
3,140
GBushey on Jan 16 2024 07:20 AM
3,412
VipulDabhi on Jan 08 2024 11:11 AM
6,088
timurengin on Jan 08 2024 11:10 AM
25.2K
Josefa-Sepulveda on Jan 02 2024 02:24 AM
47.4K
Arjun_Trivedi on Nov 29 2023 10:13 PM
9,838
skochavi on Nov 27 2023 01:21 PM
8,519
ShaharAviv on Nov 20 2023 10:27 PM
6,533
Eric Burkholder on Nov 15 2023 02:26 PM
61.2K
Erez Einav on Nov 15 2023 08:00 AM
5,387
mahmoudmsft on Nov 08 2023 10:02 AM
14.3K
Pete Bryan on Sep 21 2023 03:02 PM
16K
lili on Sep 05 2023 12:18 AM
6,982
Tiander Turpijn on Aug 30 2023 04:33 AM
19K
Jeremy Tan on Aug 23 2023 04:30 AM
7,539
Matt_Lowe on Aug 22 2023 09:30 AM
13.4K
Nicolas Lepagnez on Aug 09 2023 04:44 AM
11.7K
MichalShechter on Aug 01 2023 11:02 AM

Latest Comments

@Matt_Lowe Is it possible to use this to prevent certain logs from being ingested? Xpath for DCR is not customization enough for us to drop certain logs. We are currently trying to drop certain WindowsEvent table logs(windows event forwarding). This certain event is very noisy and has no value. We c...
0 Likes
Hello, Very helpful blog thank you. I have a question though , is this way of automation is recommanded rather than using playbooks/logic apps to trigger the notebooks i need in the context of SOAR capabilities of sentinel ? like is it better ? if so how ?
0 Likes
Hi,i've tried implementing this feature and it was working, but now it's failing with error:POST action failedPOST failed. Missing required permissions for Microsoft Sentinel on the playbook resource '/subscriptions/XXXXXXXXX/resourceGroups/XXXXXXX/providers/Microsoft.Logic/workflows/XXXXXXX'ThanksF...
0 Likes
A question can this be setup for tables like the SecurityEvent and SecurityAlert table. I did the following and could not get it to work. {"Name": "Test Windows Security Logs Table Access","Id": null,"IsCustom": true,"Description": "Enable users to monitor WIndows servers Security Events and Alerts"...
0 Likes
GreetingsI was quick to onboard our Sentinel workspace into our Defender tenant but was then just as quick to find the features available from the Defender portal to be lacking, at least from the perspektive of the workflow we have established in Sentinel over the years.The feature most important to...
0 Likes