cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Microsoft Sentinel Blog
Options
59K

Implementing Lookups in Azure Sentinel

nirgafni on Jan 06 2020 12:39 AM
Learn how to combine external data sources as part of your queries in Sentinel to implement lookups, allow-lists, watchl...
34.7K

Azure Sentinel correlation rules: the join KQL operator

Ofer_Shezaf on Dec 04 2019 05:27 PM
In the SIEM world, rules are often called correlation rules to stress the role of a SIEM to correlate signals from diffe...
33.1K

Azure Sentinel correlation rules: Active Lists out; make_list() in, the AAD/AWS correlation example

Ofer_Shezaf on Nov 25 2019 01:57 AM
Writing alert rules using KQL is powerful but does not have to be complicated. A good example would be rules that in tra...
21.2K

Tip: Easily use JSON fields in Sentinel

Ofer_Shezaf on Jul 22 2019 05:15 PM
Learn how to easily extract values embedded in JSON constructs in Sentinel as primary fields for easy viewing, filtering...
29.9K

Using KQL functions to speed up analysis in Azure Sentinel

Pete Bryan on Jun 25 2019 08:27 AM
Security Operations can often be a very repetitive role. As a security analyst, you will often find yourself conducting ...

Latest Comments

Ciyaresh91
in Split Microsoft Sentinel Tables with Multi-Destination Data Collection Rules on Apr 15 2024 08:06 AM
@Matt_Lowe Is it possible to use this to prevent certain logs from being ingested? Xpath for DCR is not customization enough for us to drop certain logs. We are currently trying to drop certain WindowsEvent table logs(windows event forwarding). This certain event is very noisy and has no value. We c...
0 Likes
Azizjaz24
in Software Defined Monitoring - Using Automated Notebooks and Azure Sentinel to Improve Sec Ops on Apr 15 2024 06:41 AM
Hello, Very helpful blog thank you. I have a question though , is this way of automation is recommanded rather than using playbooks/logic apps to trigger the notebooks i need in the context of SOAR capabilities of sentinel ? like is it better ? if so how ?
0 Likes
Came19xx
in Run Microsoft Sentinel playbooks from workbooks on-demand on Apr 12 2024 07:46 AM
Hi,i've tried implementing this feature and it was working, but now it's failing with error:POST action failedPOST failed. Missing required permissions for Microsoft Sentinel on the playbook resource '/subscriptions/XXXXXXXXX/resourceGroups/XXXXXXX/providers/Microsoft.Logic/workflows/XXXXXXX'ThanksF...
0 Likes
mbbhimji
in Table Level RBAC In Microsoft Sentinel on Apr 11 2024 06:55 AM
A question can this be setup for tables like the SecurityEvent and SecurityAlert table. I did the following and could not get it to work. {"Name": "Test Windows Security Logs Table Access","Id": null,"IsCustom": true,"Description": "Enable users to monitor WIndows servers Security Events and Alerts"...
0 Likes
TheHoff70
in Introducing a Unified Security Operations Platform with Microsoft Sentinel and Defender XDR on Apr 10 2024 02:09 AM
GreetingsI was quick to onboard our Sentinel workspace into our Defender tenant but was then just as quick to find the features available from the Defender portal to be lacking, at least from the perspektive of the workflow we have established in Sentinel over the years.The feature most important to...
0 Likes