In today’s world of ever-evolving sophisticated threats, time is of the essence when it comes to an efficient SOC’s continuous feedback loop for reducing attacker dwell time. The days of humans writing effective rules to detect malicious activity are gone. Reducing attacker dwell time requires a host of people, processes, and modern technologies including Artificial Intelligence (AI), Machine Learning (ML), Threat Intelligence (TI), and automation to find and eliminate threats before they become a nightmare.
Microsoft Sentinel, along with the Defender Extended Detection and Response (XDR) platform, provides an enhanced toolset of top-grade technologies for your SOC to achieve its goals in today’s difficult threat landscape. With Microsoft’s XDR + SIEM/SOAR capabilities, you are future proofing your company’s security and modernizing your capabilities.
More Effective, Less Cost
Operationalizing an integrated security platform requires a shift in process, and change can be frightening when seconds matter. Many customers are concerned about their budget when considering a “lift and shift” to Sentinel because ingesting massive amounts of raw and contextual signal to a top-tier solution that allows for up to 2 years of hot, analytical retention can be price-prohibitive and, for some data, unnecessary.
As Microsoft Sentinel sits in the Azure cloud, this grants unmatched flexibility and simplicity to meet the “do-more-with-less” standards of a budget-restricted security organization. The Azure integration gives companies the ability to leverage Data and AI tooling to further enhance capabilities at a manageable cost rate for the value of that data.
Keep logs to Detect, not just to Collect (In Microsoft Sentinel, that is)
A simple rule that we advise companies when designing lower-cost data collection and retention for Microsoft Sentinel architecture is to focus on ingesting into Sentinel only the data with contextual security value. Given Sentinel’s modern capabilities geared toward detecting sophisticated threats across the kill chain, it is best utilized when data contains some security context.
However, with attacker sophistication, continuous improvement and (sometimes) threat detection requires quality forensics where a security analyst or researcher may need to look backwards across huge amounts of signal, including firewall logs, diagnostic logs, and network flow logs, to discover the “needle in the stack of needles.”
Although it may be convenient to centralize data collection and storage to one highly advanced technology that includes detection and forensic capabilities at your fingertips, it is a thing of the past! As organizations feel the squeeze of economic conditions, the extensibility of Microsoft Sentinel and its easily-integrated tooling within Azure allows for significant cost savings without sacrificing the power of the platform.
Azure Data Explorer as your intelligent Security Data Lake
Now, we'll walk through a tutorial that illustrates the "art of the possible" with Azure Data Explorer and Sentinel used together to reduce costs while offering access to utilize Azure Data Explorer (ADX) data.
(To cut through some of the explanation, the tutorial actions are represented in Green Italic text below.)
1. Select from high volume, lower security value data sources.
A. Consider security use cases from your traditional SIEM environment.
Although Microsoft Sentinel provides data connectors for Firewall logs, Netflow, and Defender Advanced Hunting tables, among other lower-context data sources, you may find that your immediate detection value does not justify the cost of such high-volume ingestion directly into Sentinel. (Ex. Security Threat Firewall Logging vs. Ping and TraceRoute Firewall data.)
B. Common IOC hunting is a great place to start.
Many organizations have under-utilized the power of a Threat Intelligence feed / integration within the SOC. However, IOC hunting is crucial to filling in the gaps in an attacker's methodology where many detections may be unique to a business where you know your environment best.
2. Map fields and ingest the data into Azure Data Explorer (ADX).
For a sample data set, we've followed the instructions provided by Jeff_Chin in his blog post
Limitless Microsoft Defender for Endpoint Advanced Hunting with Azure Data Explorer (ADX), where he illustrates how to enable streaming of Microsoft 365 Defender data into ADX. You may want to experiment with some alternative data ingestions scenarios where you’ll notice a degree of flexibility (as well as the cost-to-benefit trade-off of increased effort) that is not available with Log Analytics.
For example, with ADX queries, time filters are not required, but can be utilized. Without time filters, you can query an entire database, which speaks to the potential need for optimization and adjustments in processing power. Because ADX is a Platform as a Service (PaaS) solution in Azure, you have a great deal of flexibility over the architecture and cluster sizing, allowing for selection in how clusters are allowed to scale for changing demand: Manage cluster horizontal scaling (scale out) to match demand in Azure Data Explorer | Microsoft Learn
3. Form a filtering query and do a test run in Azure Data Explorer
Security Advantages of using Azure Data Explorer (ADX) with Sentinel
ADX is a documented and supported method for log retention and integration with Microsoft Sentinel. As with all Azure Platform Services, Security can be configured for Role Based Access Control (RBAC), Identity management, Encryption, etc. This is described in depth here: Integrate Azure Data Explorer for long-term log retention | Microsoft Learn.
Row Level Security
In a prior blog post, Simple Row-Based Access Workbook: Lab Walk-Through with Azure Sentinel and Azure Data Explorer (ADX) - Microsoft Community Hub, we described an example for utilizing the benefit of Row Level Security in Azure Data Explorer to present individual views for Cross-solution workbooks presented in Sentinel. Here, you’ll experience the familiar data platform Kusto for query building, filtering, grouping, etc., as you’ve experienced with Log Analytics as well as Advanced Hunting in the Microsoft 365 Defender portal.
Sample Query for Brute Force (use for illustration purposes only):
Back to the intent of this post, here’s a (potentially noisy, no proven detection accuracy) query to detect potential brute force based on successful login to a device after a designated number of failed logins. The successful login is joined with the remote IP used to authenticate to project the results needed for the sample analytic rule used later. You can test and adjust this query on your Azure Data Explorer cluster:
DeviceLogonEvents
| where TimeGenerated >= ago(180d)
| where RemoteIPType == "Public"
| summarize
LOGONFAILED=countif(ActionType =="LogonFailed"),
LOGONSUCCESS=countif(ActionType =="LogonSuccess")
by RemoteIP, DeviceName
| where LOGONSUCCESS > 0
| where LOGONFAILED >= 300
| join kind=innerunique
(DeviceLogonEvents
| where ActionType == "LogonSuccess")
on RemoteIP
| project TimeGenerated, RemoteIP, AccountName, LOGONFAILED, LOGONSUCCESS, Protocol, MachineGroup, LogonType, DeviceName
Feel free to adjust the number of days queried in the TimeGenerated line, as well as tuning the LOGONSUCCESS and LOGONFAILED quantities to deliver desired results.
The Arg_max KQL operator can be a life saver for situations when you plan to append data to an existing table or watchlist from ADX into Sentinel. This operator aggregates rows to find the row that has the maximum value for a certain column. It then returns the values of other columns in that row. For example, to find the maximum latitude of a storm event in each state, you can use the following query: Kusto StormEvents | summarize arg_max(BeginLat, BeginLocation) by State. This will return a table with two columns: State and BeginLocation, where each row represents a state and its corresponding location with the maximum latitude.
For your DeviceLogonEvents query, you can add a line to the end to see how this works.
| summarize arg_max(LOGONFAILED, LOGONSUCCESS, AccountName, DeviceName, LogonType) by RemoteIP
Query and results with arg_max operator
4. Create a Logic App to run the query on a recurrence and send the data to Sentinel.
Once you select the Action for “Run KQL query,” the box will request the details for your Cluster URL, Database Name, and the query.
Fill in cluster URL, Database name and desired KQL Query.
To find these details, you can search for “ADX” in the central search at the top of your Azure Portal and select the Azure Data Explorer Clusters Service.
Easily find Azure Data Explorer with search key "ADX".
The Cluster URL can be found in the cluster overview URI Field:
Select the URI as the cluster URL.
And the database name can be reference under the “Databases” option in the navigation menu:
D. Now that you have your ADX Database referenced, paste in the KQL query that you wrote or the sample from above.
Populated details in the ADX Query Connector in Logic Apps
For the next step, we’ll break into two options for sending filtered data from ADX into Sentinel for analytics.
5. Option A: Send data into a Sentinel Watchlist
Watchlists are easy to create, update and query in detection rules. However, they are limited to 10 million rows across all watchlists in a single Sentinel workspace. They also are incredibly straightforward for query purposes, so if you plan to use complex joins and functions, you may prefer to skip to Step 6: Option B (Custom Table).
1. First, create a CSV file with the aligned fields based on query results and then add that to Sentinel's Watchlists.
Hint: Although you can create a watchlist with the Logic app, this gets into some complexity outside of the scope of this blog, because we don’t want a new watchlist each time the recurrence executes. So, one way to get the appropriate CSV file to upload to Sentinel is to test run your query in ADX while adding |take 1
|take 1
to the end of the query. This will give you a single result to download as a CSV file and then upload to Sentinel for continuous bulk updates from the logic app that we’re building.
Use the option to export a "take 1" query result to CSV to upload into Sentinel for your Watchlist Template.
You’ll need to select a search key, and for this sample, we’ve used the RemoteIP.
Validated Watchlist fields
Once you name and save your watchlist in Sentinel, you’ll return to the Logic App to send the query results to it.
2. From here, search for the control operator, and then select “For Each.” This means that each time the query above delivers results, they’ll be appended to the watchlist. For this reason, you’ll want to work out the query time frame with the recurrence to deliver the desired results to append to the watchlist.
Select a "For each" control in the Logic App
From Dynamic Content, select the value of the ADX Query run previously in the Logic app,
Select the Dynamic value of the ADX query output for the Control Action
3. And then add a final action selecting the operation for Microsoft Sentinel
Select "Microsoft Sentinel" for the next operation.
Scroll down and select “Watchlists – Add a new Watchlist Item (preview)
You can Add a new Watchlist Item as a preview action in Logic Apps
You’ll validate the workspace IDin which the Watchlist lives by cross-referencing Sentinel Settings -->Workspace Settings
Where you can get the Subscription, Resource Group and Workspace ID from the workspace Overview.
Paste in your watchlist alias that you named when you created the watchlist(or check under Watchlists in Sentinel where the Alias is easily referenced as well).
Then, specify the results that you’d like as the JSON body, pulling from the Dynamic content exposed through the KQL query in the prior steps.
Watchlist Item Fields are available as dynamic content from the ADX KQL Query above.
Here’s JSON to copy/paste, just ensure you validate your specific dynamic content. If fields are missing, you may need to remove and re-add each dynamic field to fully validate the query results that will be sent to the watchlist:
4. Save the Logic app, then Run the Trigger, where you should see each step succeed:
The Logic App ran successfully.
Test your query in Sentinel by selecting the Watchlist from the Watchlist blade and clicking the “View in logs” button where you should see the results:
Here, we can see the Watchlist results in Sentinel Logs.
You can also skip to Step 7 Below and reference the instructions for using the Custom table but instead use the Watchlist function (_GetWatchlist('<custom_name>') to form a detection against Microsoft Defender Threat Intelligence.
6. Option B: Send data to a Custom Table in Sentinel
The benefit of this option is that now the Data filtered from the ADX query will exist in a table that can be referenced and joined with other tables rather than calling the watchlist operators. There’s no row restriction for results and the schema is available directly for building more complex queries. Also, this benefits consumers because they now can write detections against a custom table schema rather than managing rows in a watchlist, which reduces the amount of operational overhead.
1. Start with the initial logic app creation based on a recurrence (Step 4, above).
This time, however, we can make the query a bit simpler to drive toward our end goal of matching (low fidelity) potential brute force with Defender Threat Intelligence IP IOCs.
DeviceLogonEvents
| where TimeGenerated >= ago(180d)
| where RemoteIPType == "Public"
| summarize
LOGONFAILED=countif(ActionType =="LogonFailed"),
LOGONSUCCESS=countif(ActionType =="LogonSuccess")
by RemoteIP, DeviceName
| where LOGONSUCCESS > 0
| where LOGONFAILED >= 300
Input the desired query in the Logic App ADX KQL Query Operator after testing and tuning it.
Hint: For more complex query schemas you might, at this stage, want to save the Logic App, run it, and then capture the results of your Query Output. You can get to this by clicking on the “Run KQL Query step” and then selecting “show raw outputs” where you can copy and paste to a text editor. This can be useful if you need to add a step to understand your JSON schema, you can add an action "Parse JSON" and upload a sample payload to generate/see the JSON Schema from the query. This is not necessary for this tutorial but can be helpful for future reference.
Query Output JSON from Logic App run
Pasting the raw output as a sample payload from the KQL Query run will allow you to generate the output schema.
Parsing the data in the Logic App depends on the simplicity of the query and the resulting key value pair formatting of the request sent. If the query and results are straightforward enough, we may be able to follow the prior instructions with Log Analytics collecting the data directly. However, in this case, if we try to send each result to Log Analytics, we get a JSON request body input that includes an array that can’t neatly fit into the Schema of the new table.
Example of how the logic app may fail if you simply replace the action "send data to Sentinel Watchlist" with "Send Data to Log Analytics Workspace."
So, because the results are delivered as a JSON body, where the LOGONFAILED and LOGONSUCCESS fields contain an array of values, we need to deliver those as separate records into Log Analytics.
2. After the Logic app step where you run your ADX KQL Query, the next step will be a control to send the results to a Log Analytics workspace.
Select a "For each" control
3. Once you select the Dynamic "value" from the ADX query output, you'll select "Add an action" and add a second "for each" control to accommodate the array values and break them into individual records in Microsoft Sentinel's Log Analytics Workspace.
4. In the second "For each" control output box, select "Add dynamic content" and then select the "Expression" tab, where you can enter the expression shared below, and then click "OK":
array(triggerOutputs()?['value'])
Add an embedded "For each" control.
Input the expression to break the array into individual records
Hint: Once we begin nesting controls, it can be helpful to name them to keep track of what each control is intended to accomplish. This makes things much easier if you’re trying to troubleshoot a complex query for filtering data to Log Analytics.
5. The final step in the Logic App is to send the data to Log Analytics.
To do so, select “Add an action” and then search for Azure Log Analytics, where you can select the option to "Send Data."
Select the operation to Send Data to an Azure Log Analytics Workspace.
You’ll also need to establish your connection to the Workspace, where you’ll declare a name for the connection, then find the Workspace ID and Key details by navigating to your Sentinel portal-->Settings-->Workspace Settings-->Agents (use the drop down for Log Analytics agent instructions to find the workspace Key and ID.)
Input your Workspace details
6. Once populated, enter the desired JSON request body and name your custom log table, which you’ll be able to query in Sentinel.
For the JSON request body, here’s a copy/paste to start with:
Hint: Note how Dynamic content hides an expression under the selected shortcut item. This can be helpful for troubleshooting as well: items('For_Each_ADX_value,_send_to_Sentinel’’s_Log_Analytic_Workspace’)?['RemoteIP']
7. Save the Logic app and select “Run Trigger” to test. Once it runs, you should see green checks at each stage with the expected number of results.
Successful Logic App Run
8. Finally, you can see the results of your filtered import into Log Analytics from ADX!
Navigate to the “Logs” blade of Sentinel, where you can query the custom table, which will automatically append your “Custom Log Name” with an “_CL”. (Note: It can take several minutes to send the initial set of logs. If your results are unexpectedly empty after a successful Logic App trigger run, you can go get a beverage or snack and then try again.)
Use the Custom Log Name in the “Send Data” field of the Logic App to run the Log Analytics Query
Query your new custom table from Logs in Microsoft Sentinel.
Although in this tutorial, we're using well-formed data from Microsoft 365 Defender, It is possible to utilize this model with any data source, including Syslog, Netflow, Etc. In these cases, you can Use ASIM parsers to view data in a normalized format and to include all data relevant to the schema in your queries.
7. Build an Analytic Rule Matching Your New Custom Table to Threat Intelligence IOC's from the Defender Threat Intelligence Connector.
Here’s where the fun really begins. Whereas you cannot use ADX directly for Analytics queries, once you send filtered data back into Microsoft Sentinel, you can certainly write custom detection rules.
Of course, these will not be Near Real Time (NRT) detections, but this is a great scenario for running forensics or hunting older records against Threat Intelligence (TI) Indicators of Compromise (IOC’s).
It’s always helpful, whenever possible, to use an existing useful rule and make a copy to modify a similar detection for a custom detection.
The Preview Integration with Defender Threat Intelligence and its associated Solution, once installed, not only provides out of box TI matching on native tables as soon as it’s enabled, but it also builds a results table of its own and the native analytic rules provide great samples to draw from for the custom rule you can now write. (Learn more about Threat Intelligence in Sentinel here: Threat intelligence integration in Microsoft Sentinel | Microsoft Learn)
The beauty of the Defender Threat Intelligence solution is being able to take advantage of Microsoft’s massive scale of visibility on Threat Intelligence, providing operationalization and immediate SOC maturity gains with little effort.
1. First, enable the Threat Intelligence Solution if you haven’t yet done so.
Enable the Threat Intelligence Solution in Microsoft Sentinel.
Then, when you click the “Manage” button in the bottom right, you’ll be taken to the associated content. Since, in this case, we’re trying to get a match against our potential brute force IP address, a good rule to use for a model to start with is the “TI map IP entity to SignInLogs.”
The Threat Intelligence Solution includes a number of useful templates for detection against Threat Intelligence IOC's such as this one.
Once you select the rule, you’ll see the associated data sources and will notice that Custom Tables, like the one we just created, are not naturally included. To provide that native TI matching, you can enable the rule as-is (tuning as appropriate.)
2. You can also use the same template (“TI map IP entity to SignInLogs") to create a new rule for our purposes here.
3. Rename the rule accordingly.
4. In order to add the context for Sentinel’s built in Machine Learning, it’s important to select the proper Tactics & Techniques, so for the sample we’re building, you can select Tactic “Credential Access” and Technique “T1110 – Brute Force.”
Select Tactic "credential access" and Technique "Brute Force"
5. Select the blue button “Next : Set rule logic >”
6. Modify the KQL rule to address your detection goals.
If you’re modifying or creating a rule for a new detection, it can be helpful to have a separate log screen available to test the query for desired detection results.
Here’s a sample that’s sufficiently amended from the built-in query that delivers the intended results.
Note: For your query, you’ll need to specifically replace the custom table under the “join” operator with the name that you created in your Logic App.
ThreatIntelligenceIndicator
| where Active == true
// Picking up only IOC's that contain the entities we want
| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)
// As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.
// Taking the first non-empty value based on potential IOC match availability
| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)
// using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
| join kind=innerunique (
//join custom Table
DetailedADXSusIP_CL
// | where TimeGenerated >= ago(dt_lookBack)
| project TimeGenerated, IPEntity=RemoteIP_s, DeviceName_s, LOGONFAILED_s
// renaming time column so it is clear the log this came from
//| extend SigninLogs_TimeGenerated = TimeGenerated, Type = Type
)
//use appropriate custom table column for IOC match
on $left.TI_ipEntity == $right.IPEntity
The Results Simulation will be a good check for necessary tuning as well:
The Results Simulation on the right can be helpful for tuning your detection query.
7. Once the query is pasted and validated, you can select the appropriate entities, which are important to align for both the Built in Machine Learning and User and Entity Behaviour Analytics that are native capabilities of Sentinel.
The Entities that are being mapped for this example are Host and IP:
Map Host and IP Entities
8. You can then set your preference for the query scheduling and Alert Threshold. Just remember that even if there was a match in your data set, you won’t see incident results until the rule runs, which is the time frame designated by the Query Schedule. (don’t expect to see these results immediately if you’ve selected to run every 5 hours over the last 5 hours of data.)
On the next screen you can group alerts if desired (not required).
Then, you can align a desired Automated Response (not required).
9. On the Summary screen, you can review all of your selections, and once you’re satisfied, Create the rule.
Review selections before creating the rule.
...Several Hours Later:
We have an Incident match!
In a lab environment with a honeypot, this is what we were after.
The Threat Intelligence Rule Template found a match against the ADX Dataset!
If we investigate and “view full details” to check the Entity information for the IP address, we can see the details associated with the IP entity:
In Summary:
We hope you enjoyed this walkthrough of an example for using ADX as a security data lake from which you can draw filtered data back into Sentinel for Analytic rule matching.
The flexibility of Microsoft Sentinel within the rich ecosystem of the Azure Cloud provides many such creative and cost-saving capabilities allowing companies, who know their attack surface best, to benefit from the Native Cloud in which Microsoft Sentinel resides.
Special Thanks:
Thanks especially to co-author mlopinto. This blog post was inspired by Jeff_Chin and @Mary Lieb to help customers save costs while using Microsoft Sentinel. Thanks to Matt_Witman and YanivSh for assisting with the envisioning of this multi-resource solution.
If a group is satisfied with cost related to ingest into Sentinel with the included 90 days of retention but wants longer term storage, like 1 year, how would they leverage ADX for that? How would you export Sentinel logs, just prior to them dropping due to retention limits, into ADX?
Or would it just make more sense to retain them via Azure Monitor that is part of Sentinel? In that case I am assuming that this ADX solution is really about limiting ingest charges on the front end and less about the retention cost?
Share
"}},"componentScriptGroups({\"componentId\":\"custom.widget.Social_Sharing\"})":{"__typename":"ComponentScriptGroups","scriptGroups":{"__typename":"ComponentScriptGroupsDefinition","afterInteractive":{"__typename":"PageScriptGroupDefinition","group":"AFTER_INTERACTIVE","scriptIds":[]},"lazyOnLoad":{"__typename":"PageScriptGroupDefinition","group":"LAZY_ON_LOAD","scriptIds":[]}},"componentScripts":[]},"component({\"componentId\":\"custom.widget.MicrosoftFooter\"})":{"__typename":"Component","render({\"context\":{\"component\":{\"entities\":[],\"props\":{}},\"page\":{\"entities\":[\"board:MicrosoftSentinelBlog\",\"message:3866030\"],\"name\":\"BlogMessagePage\",\"props\":{},\"url\":\"https://techcommunity.microsoft.com/blog/microsoftsentinelblog/future-proof-your-soc-with-the-power-of-the-azure-ecosystem-and-defender-threat-/3866030\"}}})":{"__typename":"ComponentRenderResult","html":""}},"componentScriptGroups({\"componentId\":\"custom.widget.MicrosoftFooter\"})":{"__typename":"ComponentScriptGroups","scriptGroups":{"__typename":"ComponentScriptGroupsDefinition","afterInteractive":{"__typename":"PageScriptGroupDefinition","group":"AFTER_INTERACTIVE","scriptIds":[]},"lazyOnLoad":{"__typename":"PageScriptGroupDefinition","group":"LAZY_ON_LOAD","scriptIds":[]}},"componentScripts":[]},"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/community/NavbarDropdownToggle\"]})":[{"__ref":"CachedAsset:text:en_US-components/community/NavbarDropdownToggle-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/common/QueryHandler\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/common/QueryHandler-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageCoverImage\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageCoverImage-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/nodes/NodeTitle\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/nodes/NodeTitle-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageTimeToRead\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageTimeToRead-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageSubject\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageSubject-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/users/UserLink\"]})":[{"__ref":"CachedAsset:text:en_US-components/users/UserLink-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/users/UserRank\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/users/UserRank-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageTime\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageTime-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageBody\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageBody-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageCustomFields\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageCustomFields-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageRevision\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageRevision-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageReplyButton\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageReplyButton-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageAuthorBio\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageAuthorBio-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/users/UserAvatar\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/users/UserAvatar-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/ranks/UserRankLabel\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/ranks/UserRankLabel-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"components/users/UserRegistrationDate\"]})":[{"__ref":"CachedAsset:text:en_US-components/users/UserRegistrationDate-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/nodes/NodeAvatar\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/nodes/NodeAvatar-1743095130000"}],"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/nodes/NodeDescription\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/nodes/NodeDescription-1743095130000"}],"message({\"id\":\"message:3875368\"})":{"__ref":"BlogReplyMessage:message:3875368"},"message({\"id\":\"message:3874083\"})":{"__ref":"BlogReplyMessage:message:3874083"},"cachedText({\"lastModified\":\"1743095130000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/nodes/NodeIcon\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/nodes/NodeIcon-1743095130000"}]},"CachedAsset:pages-1743763625606":{"__typename":"CachedAsset","id":"pages-1743763625606","value":[{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"BlogViewAllPostsPage","type":"BLOG","urlPath":"/category/:categoryId/blog/:boardId/all-posts/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CasePortalPage","type":"CASE_PORTAL","urlPath":"/caseportal","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CreateGroupHubPage","type":"GROUP_HUB","urlPath":"/groups/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CaseViewPage","type":"CASE_DETAILS","urlPath":"/case/:caseId/:caseNumber","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"InboxPage","type":"COMMUNITY","urlPath":"/inbox","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"HelpFAQPage","type":"COMMUNITY","urlPath":"/help","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"IdeaMessagePage","type":"IDEA_POST","urlPath":"/idea/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"IdeaViewAllIdeasPage","type":"IDEA","urlPath":"/category/:categoryId/ideas/:boardId/all-ideas/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"LoginPage","type":"USER","urlPath":"/signin","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"BlogPostPage","type":"BLOG","urlPath":"/category/:categoryId/blogs/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"UserBlogPermissions.Page","type":"COMMUNITY","urlPath":"/c/user-blog-permissions/page","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ThemeEditorPage","type":"COMMUNITY","urlPath":"/designer/themes","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TkbViewAllArticlesPage","type":"TKB","urlPath":"/category/:categoryId/kb/:boardId/all-articles/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1730819800000,"localOverride":null,"page":{"id":"AllEvents","type":"CUSTOM","urlPath":"/Events","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"OccasionEditPage","type":"EVENT","urlPath":"/event/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"OAuthAuthorizationAllowPage","type":"USER","urlPath":"/auth/authorize/allow","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"PageEditorPage","type":"COMMUNITY","urlPath":"/designer/pages","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"PostPage","type":"COMMUNITY","urlPath":"/category/:categoryId/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForumBoardPage","type":"FORUM","urlPath":"/category/:categoryId/discussions/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TkbBoardPage","type":"TKB","urlPath":"/category/:categoryId/kb/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"EventPostPage","type":"EVENT","urlPath":"/category/:categoryId/events/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"UserBadgesPage","type":"COMMUNITY","urlPath":"/users/:login/:userId/badges","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"GroupHubMembershipAction","type":"GROUP_HUB","urlPath":"/membership/join/:nodeId/:membershipType","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"MaintenancePage","type":"COMMUNITY","urlPath":"/maintenance","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"IdeaReplyPage","type":"IDEA_REPLY","urlPath":"/idea/:boardId/:messageSubject/:messageId/comments/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"UserSettingsPage","type":"USER","urlPath":"/mysettings/:userSettingsTab","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"GroupHubsPage","type":"GROUP_HUB","urlPath":"/groups","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForumPostPage","type":"FORUM","urlPath":"/category/:categoryId/discussions/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"OccasionRsvpActionPage","type":"OCCASION","urlPath":"/event/:boardId/:messageSubject/:messageId/rsvp/:responseType","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"VerifyUserEmailPage","type":"USER","urlPath":"/verifyemail/:userId/:verifyEmailToken","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"AllOccasionsPage","type":"OCCASION","urlPath":"/category/:categoryId/events/:boardId/all-events/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"EventBoardPage","type":"EVENT","urlPath":"/category/:categoryId/events/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TkbReplyPage","type":"TKB_REPLY","urlPath":"/kb/:boardId/:messageSubject/:messageId/comments/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"IdeaBoardPage","type":"IDEA","urlPath":"/category/:categoryId/ideas/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CommunityGuideLinesPage","type":"COMMUNITY","urlPath":"/communityguidelines","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CaseCreatePage","type":"SALESFORCE_CASE_CREATION","urlPath":"/caseportal/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TkbEditPage","type":"TKB","urlPath":"/kb/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForgotPasswordPage","type":"USER","urlPath":"/forgotpassword","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"IdeaEditPage","type":"IDEA","urlPath":"/idea/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TagPage","type":"COMMUNITY","urlPath":"/tag/:tagName","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"BlogBoardPage","type":"BLOG","urlPath":"/category/:categoryId/blog/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"OccasionMessagePage","type":"OCCASION_TOPIC","urlPath":"/event/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ManageContentPage","type":"COMMUNITY","urlPath":"/managecontent","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ClosedMembershipNodeNonMembersPage","type":"GROUP_HUB","urlPath":"/closedgroup/:groupHubId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CommunityPage","type":"COMMUNITY","urlPath":"/","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForumMessagePage","type":"FORUM_TOPIC","urlPath":"/discussions/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"IdeaPostPage","type":"IDEA","urlPath":"/category/:categoryId/ideas/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1730819800000,"localOverride":null,"page":{"id":"CommunityHub.Page","type":"CUSTOM","urlPath":"/Directory","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"BlogMessagePage","type":"BLOG_ARTICLE","urlPath":"/blog/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"RegistrationPage","type":"USER","urlPath":"/register","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"EditGroupHubPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForumEditPage","type":"FORUM","urlPath":"/discussions/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ResetPasswordPage","type":"USER","urlPath":"/resetpassword/:userId/:resetPasswordToken","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1730819800000,"localOverride":null,"page":{"id":"AllBlogs.Page","type":"CUSTOM","urlPath":"/blogs","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TkbMessagePage","type":"TKB_ARTICLE","urlPath":"/kb/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"BlogEditPage","type":"BLOG","urlPath":"/blog/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ManageUsersPage","type":"USER","urlPath":"/users/manage/:tab?/:manageUsersTab?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForumReplyPage","type":"FORUM_REPLY","urlPath":"/discussions/:boardId/:messageSubject/:messageId/replies/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"PrivacyPolicyPage","type":"COMMUNITY","urlPath":"/privacypolicy","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"NotificationPage","type":"COMMUNITY","urlPath":"/notifications","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"UserPage","type":"USER","urlPath":"/users/:login/:userId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"OccasionReplyPage","type":"OCCASION_REPLY","urlPath":"/event/:boardId/:messageSubject/:messageId/comments/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ManageMembersPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId/manage/:tab?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"SearchResultsPage","type":"COMMUNITY","urlPath":"/search","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"BlogReplyPage","type":"BLOG_REPLY","urlPath":"/blog/:boardId/:messageSubject/:messageId/replies/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"GroupHubPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TermsOfServicePage","type":"COMMUNITY","urlPath":"/termsofservice","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"CategoryPage","type":"CATEGORY","urlPath":"/category/:categoryId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"ForumViewAllTopicsPage","type":"FORUM","urlPath":"/category/:categoryId/discussions/:boardId/all-topics/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"TkbPostPage","type":"TKB","urlPath":"/category/:categoryId/kbs/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1743763625606,"localOverride":null,"page":{"id":"GroupHubPostPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"}],"localOverride":false},"CachedAsset:text:en_US-components/context/AppContext/AppContextProvider-0":{"__typename":"CachedAsset","id":"text:en_US-components/context/AppContext/AppContextProvider-0","value":{"noCommunity":"Cannot find community","noUser":"Cannot find current user","noNode":"Cannot find node with id {nodeId}","noMessage":"Cannot find message with id {messageId}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/Loading/LoadingDot-0":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/Loading/LoadingDot-0","value":{"title":"Loading..."},"localOverride":false},"User:user:-1":{"__typename":"User","id":"user:-1","uid":-1,"login":"Deleted","email":"","avatar":null,"rank":null,"kudosWeight":1,"registrationData":{"__typename":"RegistrationData","status":"ANONYMOUS","registrationTime":null,"confirmEmailStatus":false,"registrationAccessLevel":"VIEW","ssoRegistrationFields":[]},"ssoId":null,"profileSettings":{"__typename":"ProfileSettings","dateDisplayStyle":{"__typename":"InheritableStringSettingWithPossibleValues","key":"layout.friendly_dates_enabled","value":"false","localValue":"true","possibleValues":["true","false"]},"dateDisplayFormat":{"__typename":"InheritableStringSetting","key":"layout.format_pattern_date","value":"MMM dd yyyy","localValue":"MM-dd-yyyy"},"language":{"__typename":"InheritableStringSettingWithPossibleValues","key":"profile.language","value":"en-US","localValue":"en","possibleValues":["en-US"]}},"deleted":false},"Theme:customTheme1":{"__typename":"Theme","id":"customTheme1"},"Category:category:microsoft-sentinel":{"__typename":"Category","id":"category:microsoft-sentinel","entityType":"CATEGORY","displayId":"microsoft-sentinel","nodeType":"category","depth":4,"title":"Microsoft Sentinel","shortTitle":"Microsoft Sentinel","parent":{"__ref":"Category:category:microsoft-security"}},"Category:category:top":{"__typename":"Category","id":"category:top","displayId":"top","nodeType":"category","depth":0,"title":"Top","entityType":"CATEGORY","shortTitle":"Top"},"Category:category:communities":{"__typename":"Category","id":"category:communities","displayId":"communities","nodeType":"category","depth":1,"parent":{"__ref":"Category:category:top"},"title":"Communities","entityType":"CATEGORY","shortTitle":"Communities"},"Category:category:products-services":{"__typename":"Category","id":"category:products-services","displayId":"products-services","nodeType":"category","depth":2,"parent":{"__ref":"Category:category:communities"},"title":"Products","entityType":"CATEGORY","shortTitle":"Products"},"Category:category:microsoft-security":{"__typename":"Category","id":"category:microsoft-security","displayId":"microsoft-security","nodeType":"category","depth":3,"parent":{"__ref":"Category:category:products-services"},"title":"Microsoft Security","entityType":"CATEGORY","shortTitle":"Microsoft Security","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Blog:board:MicrosoftSentinelBlog":{"__typename":"Blog","id":"board:MicrosoftSentinelBlog","entityType":"BLOG","displayId":"MicrosoftSentinelBlog","nodeType":"board","depth":5,"conversationStyle":"BLOG","title":"Microsoft Sentinel Blog","description":"
Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.
","avatar":null,"profileSettings":{"__typename":"ProfileSettings","language":null},"parent":{"__ref":"Category:category:microsoft-sentinel"},"ancestors":{"__typename":"CoreNodeConnection","edges":[{"__typename":"CoreNodeEdge","node":{"__ref":"Community:community:gxcuf89792"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:communities"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:products-services"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:microsoft-security"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:microsoft-sentinel"}}]},"userContext":{"__typename":"NodeUserContext","canAddAttachments":false,"canUpdateNode":false,"canPostMessages":false,"isSubscribed":false},"boardPolicies":{"__typename":"BoardPolicies","canPublishArticleOnCreate":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.forums.policy_can_publish_on_create_workflow_action.accessDenied","key":"error.lithium.policies.forums.policy_can_publish_on_create_workflow_action.accessDenied","args":[]}}},"shortTitle":"Microsoft Sentinel Blog","repliesProperties":{"__typename":"RepliesProperties","sortOrder":"REVERSE_PUBLISH_TIME","repliesFormat":"threaded"},"eventPath":"category:microsoft-sentinel/category:microsoft-security/category:products-services/category:communities/community:gxcuf89792board:MicrosoftSentinelBlog/","tagProperties":{"__typename":"TagNodeProperties","tagsEnabled":{"__typename":"PolicyResult","failureReason":null}},"requireTags":false,"tagType":"PRESET_ONLY"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/cmstNC05WEo0blc\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/cmstNC05WEo0blc","height":512,"width":512,"mimeType":"image/png"},"Rank:rank:4":{"__typename":"Rank","id":"rank:4","position":6,"name":"Microsoft","color":"333333","icon":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/cmstNC05WEo0blc\"}"},"rankStyle":"OUTLINE"},"User:user:357654":{"__typename":"User","id":"user:357654","uid":357654,"login":"Beth_Bischoff","deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0zNTc2NTQtMzE0NTk0aURDOTY5QTUwNTE5QjA5QzI"},"rank":{"__ref":"Rank:rank:4"},"email":"","messagesCount":4,"biography":null,"topicsCount":4,"kudosReceivedCount":8,"kudosGivenCount":13,"kudosWeight":1,"registrationData":{"__typename":"RegistrationData","status":null,"registrationTime":"2019-06-10T10:06:23.452-07:00","confirmEmailStatus":null},"followersCount":null,"solutionsCount":0},"BlogTopicMessage:message:3866030":{"__typename":"BlogTopicMessage","uid":3866030,"subject":"Future Proof your SOC with the Power of the Azure Ecosystem and Defender Threat Intelligence","id":"message:3866030","revisionNum":15,"repliesCount":2,"author":{"__ref":"User:user:357654"},"depth":0,"hasGivenKudo":false,"board":{"__ref":"Blog:board:MicrosoftSentinelBlog"},"conversation":{"__ref":"Conversation:conversation:3866030"},"messagePolicies":{"__typename":"MessagePolicies","canPublishArticleOnEdit":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.forums.policy_can_publish_on_edit_workflow_action.accessDenied","key":"error.lithium.policies.forums.policy_can_publish_on_edit_workflow_action.accessDenied","args":[]}},"canModerateSpamMessage":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.feature.moderation_spam.action.moderate_entity.allowed.accessDenied","key":"error.lithium.policies.feature.moderation_spam.action.moderate_entity.allowed.accessDenied","args":[]}}},"contentWorkflow":{"__typename":"ContentWorkflow","state":"PUBLISH","scheduledPublishTime":null,"scheduledTimezone":null,"userContext":{"__typename":"MessageWorkflowContext","canSubmitForReview":null,"canEdit":false,"canRecall":null,"canSubmitForPublication":null,"canReturnToAuthor":null,"canPublish":null,"canReturnToReview":null,"canSchedule":false},"shortScheduledTimezone":null},"readOnly":false,"editFrozen":false,"moderationData":{"__ref":"ModerationData:moderation_data:3866030"},"teaser":"
\n
In this blog post, we’ll look at a step-by-step tutorial, using the power of Azure Data Explorer (which can act as a security data repository), to bring key data into Sentinel for Analytics, Hunting, and Forensics. The Azure Ecosystem, used with Microsoft Sentinel, can dramatically reduce collection and retention costs while providing a flexible and familiar toolset.
\n
\n
Companies will be able to bring their own machine learning to feed contextual data from Azure Data Explorer into Microsoft Sentinel, benefiting from Microsoft Sentinel's underlying analytic engine, built-in ML models, UEBA, and new Threat Intelligence (TI) correlations provided by Defender Threat Intelligence.
\n
\n
\n
\n
","body":"
Future Proofing your SOC
\n
In today’s world of ever-evolving sophisticated threats, time is of the essence when it comes to an efficient SOC’s continuous feedback loop for reducing attacker dwell time. The days of humans writing effective rules to detect malicious activity are gone. Reducing attacker dwell time requires a host of people, processes, and modern technologies including Artificial Intelligence (AI), Machine Learning (ML), Threat Intelligence (TI), and automation to find and eliminate threats before they become a nightmare.
\n
\n
Microsoft Sentinel, along with the Defender Extended Detection and Response (XDR) platform, provides an enhanced toolset of top-grade technologies for your SOC to achieve its goals in today’s difficult threat landscape. With Microsoft’s XDR + SIEM/SOAR capabilities, you are future proofing your company’s security and modernizing your capabilities.
\n
\n
More Effective, Less Cost
\n
Operationalizing an integrated security platform requires a shift in process, and change can be frightening when seconds matter. Many customers are concerned about their budget when considering a “lift and shift” to Sentinel because ingesting massive amounts of raw and contextual signal to a top-tier solution that allows for up to 2 years of hot, analytical retention can be price-prohibitive and, for some data, unnecessary.
\n
\n
As Microsoft Sentinel sits in the Azure cloud, this grants unmatched flexibility and simplicity to meet the “do-more-with-less” standards of a budget-restricted security organization. The Azure integration gives companies the ability to leverage Data and AI tooling to further enhance capabilities at a manageable cost rate for the value of that data.
\n
\n
Keep logs to Detect, not just to Collect (In Microsoft Sentinel, that is)
\n
A simple rule that we advise companies when designing lower-cost data collection and retention for Microsoft Sentinel architecture is to focus on ingesting into Sentinel only the data with contextual security value. Given Sentinel’s modern capabilities geared toward detecting sophisticated threats across the kill chain, it is best utilized when data contains some security context.
\n
\n
However, with attacker sophistication, continuous improvement and (sometimes) threat detection requires quality forensics where a security analyst or researcher may need to look backwards across huge amounts of signal, including firewall logs, diagnostic logs, and network flow logs, to discover the “needle in the stack of needles.”
\n
\n
Although it may be convenient to centralize data collection and storage to one highly advanced technology that includes detection and forensic capabilities at your fingertips, it is a thing of the past! As organizations feel the squeeze of economic conditions, the extensibility of Microsoft Sentinel and its easily-integrated tooling within Azure allows for significant cost savings without sacrificing the power of the platform.
\n
\n
Azure Data Explorer as your intelligent Security Data Lake
\n
Now, we'll walk through a tutorial that illustrates the \"art of the possible\" with Azure Data Explorer and Sentinel used together to reduce costs while offering access to utilize Azure Data Explorer (ADX) data.
\n
(To cut through some of the explanation, the tutorial actions are represented in Green Italic text below.)
\n
\n
1. Select from high volume, lower security value data sources.
\n
\n
A. Consider security use cases from your traditional SIEM environment.
\n
Although Microsoft Sentinel provides data connectors for Firewall logs, Netflow, and Defender Advanced Hunting tables, among other lower-context data sources, you may find that your immediate detection value does not justify the cost of such high-volume ingestion directly into Sentinel. (Ex. Security Threat Firewall Logging vs. Ping and TraceRoute Firewall data.)
\n
\n
B. Common IOC hunting is a great place to start.
\n
Many organizations have under-utilized the power of a Threat Intelligence feed / integration within the SOC. However, IOC hunting is crucial to filling in the gaps in an attacker's methodology where many detections may be unique to a business where you know your environment best.
\n
\n
2. Map fields and ingest the data into Azure Data Explorer (ADX).
\n
For a sample data set, we've followed the instructions provided by Jeff_Chin in his blog post
\n
Limitless Microsoft Defender for Endpoint Advanced Hunting with Azure Data Explorer (ADX), where he illustrates how to enable streaming of Microsoft 365 Defender data into ADX. You may want to experiment with some alternative data ingestions scenarios where you’ll notice a degree of flexibility (as well as the cost-to-benefit trade-off of increased effort) that is not available with Log Analytics.
\n
\n
For example, with ADX queries, time filters are not required, but can be utilized. Without time filters, you can query an entire database, which speaks to the potential need for optimization and adjustments in processing power. Because ADX is a Platform as a Service (PaaS) solution in Azure, you have a great deal of flexibility over the architecture and cluster sizing, allowing for selection in how clusters are allowed to scale for changing demand: Manage cluster horizontal scaling (scale out) to match demand in Azure Data Explorer | Microsoft Learn
3. Form a filtering query and do a test run in Azure Data Explorer
\n
Security Advantages of using Azure Data Explorer (ADX) with Sentinel
\n
ADX is a documented and supported method for log retention and integration with Microsoft Sentinel. As with all Azure Platform Services, Security can be configured for Role Based Access Control (RBAC), Identity management, Encryption, etc. This is described in depth here: Integrate Azure Data Explorer for long-term log retention | Microsoft Learn.
\n
\n
Row Level Security
\n
In a prior blog post, Simple Row-Based Access Workbook: Lab Walk-Through with Azure Sentinel and Azure Data Explorer (ADX) - Microsoft Community Hub, we described an example for utilizing the benefit of Row Level Security in Azure Data Explorer to present individual views for Cross-solution workbooks presented in Sentinel. Here, you’ll experience the familiar data platform Kusto for query building, filtering, grouping, etc., as you’ve experienced with Log Analytics as well as Advanced Hunting in the Microsoft 365 Defender portal.
Sample Query for Brute Force (use for illustration purposes only):
\n
Back to the intent of this post, here’s a (potentially noisy, no proven detection accuracy) query to detect potential brute force based on successful login to a device after a designated number of failed logins. The successful login is joined with the remote IP used to authenticate to project the results needed for the sample analytic rule used later. You can test and adjust this query on your Azure Data Explorer cluster:
\n
\n
\n
\n
\n
DeviceLogonEvents\n| where TimeGenerated >= ago(180d)\n| where RemoteIPType == \"Public\"\n| summarize \n LOGONFAILED=countif(ActionType ==\"LogonFailed\"),\n LOGONSUCCESS=countif(ActionType ==\"LogonSuccess\")\n by RemoteIP, DeviceName\n| where LOGONSUCCESS > 0\n| where LOGONFAILED >= 300\n| join kind=innerunique \n(DeviceLogonEvents\n| where ActionType == \"LogonSuccess\")\non RemoteIP\n| project TimeGenerated, RemoteIP, AccountName, LOGONFAILED, LOGONSUCCESS, Protocol, MachineGroup, LogonType, DeviceName \n
Feel free to adjust the number of days queried in the TimeGenerated line, as well as tuning the LOGONSUCCESS and LOGONFAILED quantities to deliver desired results.
The Arg_max KQL operator can be a life saver for situations when you plan to append data to an existing table or watchlist from ADX into Sentinel. This operator aggregates rows to find the row that has the maximum value for a certain column. It then returns the values of other columns in that row. For example, to find the maximum latitude of a storm event in each state, you can use the following query: Kusto StormEvents | summarize arg_max(BeginLat, BeginLocation) by State. This will return a table with two columns: State and BeginLocation, where each row represents a state and its corresponding location with the maximum latitude.
For your DeviceLogonEvents query, you can add a line to the end to see how this works.
\n
| summarize arg_max(LOGONFAILED, LOGONSUCCESS, AccountName, DeviceName, LogonType) by RemoteIP
\n
\nQuery and results with arg_max operator\n
\n
\n
4. Create a Logic App to run the query on a recurrence and send the data to Sentinel.
Once you select the Action for “Run KQL query,” the box will request the details for your Cluster URL, Database Name, and the query.
\n
Fill in cluster URL, Database name and desired KQL Query.
\n
To find these details, you can search for “ADX” in the central search at the top of your Azure Portal and select the Azure Data Explorer Clusters Service.
\n
Easily find Azure Data Explorer with search key \"ADX\".
\n
The Cluster URL can be found in the cluster overview URI Field:
\nSelect the URI as the cluster URL.\n
\n
And the database name can be reference under the “Databases” option in the navigation menu:
\n\n
\n
\n
D. Now that you have your ADX Database referenced, paste in the KQL query that you wrote or the sample from above.
\n
Populated details in the ADX Query Connector in Logic Apps
\n
For the next step, we’ll break into two options for sending filtered data from ADX into Sentinel for analytics.
\n
\n
5. Option A: Send data into a Sentinel Watchlist
\n
Watchlists are easy to create, update and query in detection rules. However, they are limited to 10 million rows across all watchlists in a single Sentinel workspace. They also are incredibly straightforward for query purposes, so if you plan to use complex joins and functions, you may prefer to skip to Step 6: Option B (Custom Table).
\n
\n
1. First, create a CSV file with the aligned fields based on query results and then add that to Sentinel's Watchlists.
Hint: Although you can create a watchlist with the Logic app, this gets into some complexity outside of the scope of this blog, because we don’t want a new watchlist each time the recurrence executes. So, one way to get the appropriate CSV file to upload to Sentinel is to test run your query in ADX while adding |take 1
\n
|take 1
\n
to the end of the query. This will give you a single result to download as a CSV file and then upload to Sentinel for continuous bulk updates from the logic app that we’re building.
\n
\nUse the option to export a \"take 1\" query result to CSV to upload into Sentinel for your Watchlist Template.\n
\n
\n
You’ll need to select a search key, and for this sample, we’ve used the RemoteIP.
\n
\n
Validated Watchlist fields
\n
Once you name and save your watchlist in Sentinel, you’ll return to the Logic App to send the query results to it.
\n
\n
2. From here, search for the control operator, and then select “For Each.” This means that each time the query above delivers results, they’ll be appended to the watchlist. For this reason, you’ll want to work out the query time frame with the recurrence to deliver the desired results to append to the watchlist.
\n
Select a \"For each\" control in the Logic App
\n
\n
From Dynamic Content, select the value of the ADX Query run previously in the Logic app,
\n
\n
Select the Dynamic value of the ADX query output for the Control Action
\n
\n
3. And then add a final action selecting the operation for Microsoft Sentinel
\n
Select \"Microsoft Sentinel\" for the next operation.
\n
\n
Scroll down and select “Watchlists – Add a new Watchlist Item (preview)
\n
You can Add a new Watchlist Item as a preview action in Logic Apps
\n
\n
You’ll validate the workspace IDin which the Watchlist lives by cross-referencing Sentinel Settings -->Workspace Settings
\n
Where you can get the Subscription, Resource Group and Workspace ID from the workspace Overview.
\n
\n
Paste in your watchlist alias that you named when you created the watchlist(or check under Watchlists in Sentinel where the Alias is easily referenced as well).
\n
\n
Then, specify the results that you’d like as the JSON body, pulling from the Dynamic content exposed through the KQL query in the prior steps.
\n
Watchlist Item Fields are available as dynamic content from the ADX KQL Query above.
Here’s JSON to copy/paste, just ensure you validate your specific dynamic content. If fields are missing, you may need to remove and re-add each dynamic field to fully validate the query results that will be sent to the watchlist:
4. Save the Logic app, then Run the Trigger, where you should see each step succeed:
\n
The Logic App ran successfully.
\n
\n
Test your query in Sentinel by selecting the Watchlist from the Watchlist blade and clicking the “View in logs” button where you should see the results:
\n
Here, we can see the Watchlist results in Sentinel Logs.
You can also skip to Step 7 Below and reference the instructions for using the Custom table but instead use the Watchlist function (_GetWatchlist('<custom_name>') to form a detection against Microsoft Defender Threat Intelligence.
\n
\n
6. Option B: Send data to a Custom Table in Sentinel
\n
The benefit of this option is that now the Data filtered from the ADX query will exist in a table that can be referenced and joined with other tables rather than calling the watchlist operators. There’s no row restriction for results and the schema is available directly for building more complex queries. Also, this benefits consumers because they now can write detections against a custom table schema rather than managing rows in a watchlist, which reduces the amount of operational overhead.
\n
\n
1. Start with the initial logic app creation based on a recurrence (Step 4, above).
\n
This time, however, we can make the query a bit simpler to drive toward our end goal of matching (low fidelity) potential brute force with Defender Threat Intelligence IP IOCs.
\n
\n
\n
\n
DeviceLogonEvents\n| where TimeGenerated >= ago(180d)\n| where RemoteIPType == \"Public\"\n| summarize \n LOGONFAILED=countif(ActionType ==\"LogonFailed\"),\n LOGONSUCCESS=countif(ActionType ==\"LogonSuccess\")\n by RemoteIP, DeviceName\n| where LOGONSUCCESS > 0\n| where LOGONFAILED >= 300\n
\n
\n
\n
\n
Input the desired query in the Logic App ADX KQL Query Operator after testing and tuning it.
Hint: For more complex query schemas you might, at this stage, want to save the Logic App, run it, and then capture the results of your Query Output. You can get to this by clicking on the “Run KQL Query step” and then selecting “show raw outputs” where you can copy and paste to a text editor. This can be useful if you need to add a step to understand your JSON schema, you can add an action \"Parse JSON\" and upload a sample payload to generate/see the JSON Schema from the query. This is not necessary for this tutorial but can be helpful for future reference.
\nQuery Output JSON from Logic App run\n
\nPasting the raw output as a sample payload from the KQL Query run will allow you to generate the output schema.\n
\n
\n
Parsing the data in the Logic App depends on the simplicity of the query and the resulting key value pair formatting of the request sent. If the query and results are straightforward enough, we may be able to follow the prior instructions with Log Analytics collecting the data directly. However, in this case, if we try to send each result to Log Analytics, we get a JSON request body input that includes an array that can’t neatly fit into the Schema of the new table.
\n
Example of how the logic app may fail if you simply replace the action \"send data to Sentinel Watchlist\" with \"Send Data to Log Analytics Workspace.\"
\n
So, because the results are delivered as a JSON body, where the LOGONFAILED and LOGONSUCCESS fields contain an array of values, we need to deliver those as separate records into Log Analytics.
\n
\n
2. After the Logic app step where you run your ADX KQL Query, the next step will be a control to send the results to a Log Analytics workspace.
\n
Select a \"For each\" control
\n
3. Once you select the Dynamic \"value\" from the ADX query output, you'll select \"Add an action\" and add a second \"for each\" control to accommodate the array values and break them into individual records in Microsoft Sentinel's Log Analytics Workspace.
\n
\n
4. In the second \"For each\" control output box, select \"Add dynamic content\" and then select the \"Expression\" tab, where you can enter the expression shared below, and then click \"OK\":
\n
\n
\n
\n
array(triggerOutputs()?['value'])
\n
\n
\n
\n
Add an embedded \"For each\" control.
\n
Input the expression to break the array into individual records
Hint: Once we begin nesting controls, it can be helpful to name them to keep track of what each control is intended to accomplish. This makes things much easier if you’re trying to troubleshoot a complex query for filtering data to Log Analytics.
\n
\n
5. The final step in the Logic App is to send the data to Log Analytics.
\n
To do so, select “Add an action” and then search for Azure Log Analytics, where you can select the option to \"Send Data.\"
\n
Select the operation to Send Data to an Azure Log Analytics Workspace.
\n
You’ll also need to establish your connection to the Workspace, where you’ll declare a name for the connection, then find the Workspace ID and Key details by navigating to your Sentinel portal-->Settings-->Workspace Settings-->Agents (use the drop down for Log Analytics agent instructions to find the workspace Key and ID.)
\n
Input your Workspace details
\n
6. Once populated, enter the desired JSON request body and name your custom log table, which you’ll be able to query in Sentinel.
\n
For the JSON request body, here’s a copy/paste to start with:
Hint: Note how Dynamic content hides an expression under the selected shortcut item. This can be helpful for troubleshooting as well: items('For_Each_ADX_value,_send_to_Sentinel’’s_Log_Analytic_Workspace’)?['RemoteIP']
\n
\n
7. Save the Logic app and select “Run Trigger” to test. Once it runs, you should see green checks at each stage with the expected number of results.
\n
Successful Logic App Run
\n
8. Finally, you can see the results of your filtered import into Log Analytics from ADX!
\n
Navigate to the “Logs” blade of Sentinel, where you can query the custom table, which will automatically append your “Custom Log Name” with an “_CL”. (Note: It can take several minutes to send the initial set of logs. If your results are unexpectedly empty after a successful Logic App trigger run, you can go get a beverage or snack and then try again.)
\n
Use the Custom Log Name in the “Send Data” field of the Logic App to run the Log Analytics Query
\n
Query your new custom table from Logs in Microsoft Sentinel.
Although in this tutorial, we're using well-formed data from Microsoft 365 Defender, It is possible to utilize this model with any data source, including Syslog, Netflow, Etc. In these cases, you can Use ASIM parsers to view data in a normalized format and to include all data relevant to the schema in your queries.
\n
7. Build an Analytic Rule Matching Your New Custom Table to Threat Intelligence IOC's from the Defender Threat Intelligence Connector.
\n
Here’s where the fun really begins. Whereas you cannot use ADX directly for Analytics queries, once you send filtered data back into Microsoft Sentinel, you can certainly write custom detection rules.
\n
Of course, these will not be Near Real Time (NRT) detections, but this is a great scenario for running forensics or hunting older records against Threat Intelligence (TI) Indicators of Compromise (IOC’s).
\n
\n
It’s always helpful, whenever possible, to use an existing useful rule and make a copy to modify a similar detection for a custom detection.
\n
The Preview Integration with Defender Threat Intelligence and its associated Solution, once installed, not only provides out of box TI matching on native tables as soon as it’s enabled, but it also builds a results table of its own and the native analytic rules provide great samples to draw from for the custom rule you can now write. (Learn more about Threat Intelligence in Sentinel here: Threat intelligence integration in Microsoft Sentinel | Microsoft Learn)
\n
\n
The beauty of the Defender Threat Intelligence solution is being able to take advantage of Microsoft’s massive scale of visibility on Threat Intelligence, providing operationalization and immediate SOC maturity gains with little effort.
\n
\n
1. First, enable the Threat Intelligence Solution if you haven’t yet done so.
\n
Enable the Threat Intelligence Solution in Microsoft Sentinel.
\n
Then, when you click the “Manage” button in the bottom right, you’ll be taken to the associated content. Since, in this case, we’re trying to get a match against our potential brute force IP address, a good rule to use for a model to start with is the “TI map IP entity to SignInLogs.”
\n
\n
The Threat Intelligence Solution includes a number of useful templates for detection against Threat Intelligence IOC's such as this one.
\n
Once you select the rule, you’ll see the associated data sources and will notice that Custom Tables, like the one we just created, are not naturally included. To provide that native TI matching, you can enable the rule as-is (tuning as appropriate.)
\n
\n
2. You can also use the same template (“TI map IP entity to SignInLogs\") to create a new rule for our purposes here.
\n
\n
3. Rename the rule accordingly.
\n
\n
4. In order to add the context for Sentinel’s built in Machine Learning, it’s important to select the proper Tactics & Techniques, so for the sample we’re building, you can select Tactic “Credential Access” and Technique “T1110 – Brute Force.”
\n
Select Tactic \"credential access\" and Technique \"Brute Force\"
\n
5. Select the blue button “Next : Set rule logic >”
\n
\n
6. Modify the KQL rule to address your detection goals.
If you’re modifying or creating a rule for a new detection, it can be helpful to have a separate log screen available to test the query for desired detection results.
\n
Here’s a sample that’s sufficiently amended from the built-in query that delivers the intended results.
\n
Note: For your query, you’ll need to specifically replace the custom table under the “join” operator with the name that you created in your Logic App.
\n
\n
\n
\n
ThreatIntelligenceIndicator\n| where Active == true\n// Picking up only IOC's that contain the entities we want\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\n// As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\n// Taking the first non-empty value based on potential IOC match availability\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)\n// using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated\n| join kind=innerunique (\n//join custom Table\n DetailedADXSusIP_CL \n // | where TimeGenerated >= ago(dt_lookBack)\n | project TimeGenerated, IPEntity=RemoteIP_s, DeviceName_s, LOGONFAILED_s\n // renaming time column so it is clear the log this came from\n //| extend SigninLogs_TimeGenerated = TimeGenerated, Type = Type\n)\n//use appropriate custom table column for IOC match\non $left.TI_ipEntity == $right.IPEntity\n
\n
\n
\n
\n
The Results Simulation will be a good check for necessary tuning as well:
\n
The Results Simulation on the right can be helpful for tuning your detection query.
\n
7. Once the query is pasted and validated, you can select the appropriate entities, which are important to align for both the Built in Machine Learning and User and Entity Behaviour Analytics that are native capabilities of Sentinel.
\n
\n
The Entities that are being mapped for this example are Host and IP:
\n
Map Host and IP Entities
\n
8. You can then set your preference for the query scheduling and Alert Threshold. Just remember that even if there was a match in your data set, you won’t see incident results until the rule runs, which is the time frame designated by the Query Schedule. (don’t expect to see these results immediately if you’ve selected to run every 5 hours over the last 5 hours of data.)
\n
\n
On the next screen you can group alerts if desired (not required).
\n
\n
Then, you can align a desired Automated Response (not required).
\n
\n
9. On the Summary screen, you can review all of your selections, and once you’re satisfied, Create the rule.
\n
Review selections before creating the rule.
\n
\n
...Several Hours Later:
\n
We have an Incident match!
\n
In a lab environment with a honeypot, this is what we were after.
\n
The Threat Intelligence Rule Template found a match against the ADX Dataset!
\n
\n
If we investigate and “view full details” to check the Entity information for the IP address, we can see the details associated with the IP entity:
\n
\n
\n
\n
In Summary:
\n
We hope you enjoyed this walkthrough of an example for using ADX as a security data lake from which you can draw filtered data back into Sentinel for Analytic rule matching.
\n
The flexibility of Microsoft Sentinel within the rich ecosystem of the Azure Cloud provides many such creative and cost-saving capabilities allowing companies, who know their attack surface best, to benefit from the Native Cloud in which Microsoft Sentinel resides.
\n
\n
Special Thanks:
\n
Thanks especially to co-author mlopinto. This blog post was inspired by Jeff_Chin and @Mary Lieb to help customers save costs while using Microsoft Sentinel. Thanks to Matt_Witman and YanivSh for assisting with the envisioning of this multi-resource solution.
","body@stringLength":"70446","rawBody":"
Future Proofing your SOC
\n
In today’s world of ever-evolving sophisticated threats, time is of the essence when it comes to an efficient SOC’s continuous feedback loop for reducing attacker dwell time. The days of humans writing effective rules to detect malicious activity are gone. Reducing attacker dwell time requires a host of people, processes, and modern technologies including Artificial Intelligence (AI), Machine Learning (ML), Threat Intelligence (TI), and automation to find and eliminate threats before they become a nightmare.
\n
\n
Microsoft Sentinel, along with the Defender Extended Detection and Response (XDR) platform, provides an enhanced toolset of top-grade technologies for your SOC to achieve its goals in today’s difficult threat landscape. With Microsoft’s XDR + SIEM/SOAR capabilities, you are future proofing your company’s security and modernizing your capabilities.
\n
\n
More Effective, Less Cost
\n
Operationalizing an integrated security platform requires a shift in process, and change can be frightening when seconds matter. Many customers are concerned about their budget when considering a “lift and shift” to Sentinel because ingesting massive amounts of raw and contextual signal to a top-tier solution that allows for up to 2 years of hot, analytical retention can be price-prohibitive and, for some data, unnecessary.
\n
\n
As Microsoft Sentinel sits in the Azure cloud, this grants unmatched flexibility and simplicity to meet the “do-more-with-less” standards of a budget-restricted security organization. The Azure integration gives companies the ability to leverage Data and AI tooling to further enhance capabilities at a manageable cost rate for the value of that data.
\n
\n
Keep logs to Detect, not just to Collect (In Microsoft Sentinel, that is)
\n
A simple rule that we advise companies when designing lower-cost data collection and retention for Microsoft Sentinel architecture is to focus on ingesting into Sentinel only the data with contextual security value. Given Sentinel’s modern capabilities geared toward detecting sophisticated threats across the kill chain, it is best utilized when data contains some security context.
\n
\n
However, with attacker sophistication, continuous improvement and (sometimes) threat detection requires quality forensics where a security analyst or researcher may need to look backwards across huge amounts of signal, including firewall logs, diagnostic logs, and network flow logs, to discover the “needle in the stack of needles.”
\n
\n
Although it may be convenient to centralize data collection and storage to one highly advanced technology that includes detection and forensic capabilities at your fingertips, it is a thing of the past! As organizations feel the squeeze of economic conditions, the extensibility of Microsoft Sentinel and its easily-integrated tooling within Azure allows for significant cost savings without sacrificing the power of the platform.
\n
\n
Azure Data Explorer as your intelligent Security Data Lake
\n
Now, we'll walk through a tutorial that illustrates the \"art of the possible\" with Azure Data Explorer and Sentinel used together to reduce costs while offering access to utilize Azure Data Explorer (ADX) data.
\n
(To cut through some of the explanation, the tutorial actions are represented in Green Italic text below.)
\n
\n
1. Select from high volume, lower security value data sources.
\n
\n
A. Consider security use cases from your traditional SIEM environment.
\n
Although Microsoft Sentinel provides data connectors for Firewall logs, Netflow, and Defender Advanced Hunting tables, among other lower-context data sources, you may find that your immediate detection value does not justify the cost of such high-volume ingestion directly into Sentinel. (Ex. Security Threat Firewall Logging vs. Ping and TraceRoute Firewall data.)
\n
\n
B. Common IOC hunting is a great place to start.
\n
Many organizations have under-utilized the power of a Threat Intelligence feed / integration within the SOC. However, IOC hunting is crucial to filling in the gaps in an attacker's methodology where many detections may be unique to a business where you know your environment best.
\n
\n
2. Map fields and ingest the data into Azure Data Explorer (ADX).
\n
For a sample data set, we've followed the instructions provided by in his blog post
\n
Limitless Microsoft Defender for Endpoint Advanced Hunting with Azure Data Explorer (ADX), where he illustrates how to enable streaming of Microsoft 365 Defender data into ADX. You may want to experiment with some alternative data ingestions scenarios where you’ll notice a degree of flexibility (as well as the cost-to-benefit trade-off of increased effort) that is not available with Log Analytics.
\n
\n
For example, with ADX queries, time filters are not required, but can be utilized. Without time filters, you can query an entire database, which speaks to the potential need for optimization and adjustments in processing power. Because ADX is a Platform as a Service (PaaS) solution in Azure, you have a great deal of flexibility over the architecture and cluster sizing, allowing for selection in how clusters are allowed to scale for changing demand: Manage cluster horizontal scaling (scale out) to match demand in Azure Data Explorer | Microsoft Learn
3. Form a filtering query and do a test run in Azure Data Explorer
\n
Security Advantages of using Azure Data Explorer (ADX) with Sentinel
\n
ADX is a documented and supported method for log retention and integration with Microsoft Sentinel. As with all Azure Platform Services, Security can be configured for Role Based Access Control (RBAC), Identity management, Encryption, etc. This is described in depth here: Integrate Azure Data Explorer for long-term log retention | Microsoft Learn.
\n
\n
Row Level Security
\n
In a prior blog post, Simple Row-Based Access Workbook: Lab Walk-Through with Azure Sentinel and Azure Data Explorer (ADX) - Microsoft Community Hub, we described an example for utilizing the benefit of Row Level Security in Azure Data Explorer to present individual views for Cross-solution workbooks presented in Sentinel. Here, you’ll experience the familiar data platform Kusto for query building, filtering, grouping, etc., as you’ve experienced with Log Analytics as well as Advanced Hunting in the Microsoft 365 Defender portal.
Sample Query for Brute Force (use for illustration purposes only):
\n
Back to the intent of this post, here’s a (potentially noisy, no proven detection accuracy) query to detect potential brute force based on successful login to a device after a designated number of failed logins. The successful login is joined with the remote IP used to authenticate to project the results needed for the sample analytic rule used later. You can test and adjust this query on your Azure Data Explorer cluster:
\n
\n
\n
\n
\nDeviceLogonEvents\n| where TimeGenerated >= ago(180d)\n| where RemoteIPType == \"Public\"\n| summarize \n LOGONFAILED=countif(ActionType ==\"LogonFailed\"),\n LOGONSUCCESS=countif(ActionType ==\"LogonSuccess\")\n by RemoteIP, DeviceName\n| where LOGONSUCCESS > 0\n| where LOGONFAILED >= 300\n| join kind=innerunique \n(DeviceLogonEvents\n| where ActionType == \"LogonSuccess\")\non RemoteIP\n| project TimeGenerated, RemoteIP, AccountName, LOGONFAILED, LOGONSUCCESS, Protocol, MachineGroup, LogonType, DeviceName \n\n
\n
\n
\n
\n\n
Feel free to adjust the number of days queried in the TimeGenerated line, as well as tuning the LOGONSUCCESS and LOGONFAILED quantities to deliver desired results.
The Arg_max KQL operator can be a life saver for situations when you plan to append data to an existing table or watchlist from ADX into Sentinel. This operator aggregates rows to find the row that has the maximum value for a certain column. It then returns the values of other columns in that row. For example, to find the maximum latitude of a storm event in each state, you can use the following query: Kusto StormEvents | summarize arg_max(BeginLat, BeginLocation) by State. This will return a table with two columns: State and BeginLocation, where each row represents a state and its corresponding location with the maximum latitude.
For your DeviceLogonEvents query, you can add a line to the end to see how this works.
\n| summarize arg_max(LOGONFAILED, LOGONSUCCESS, AccountName, DeviceName, LogonType) by RemoteIP\n
\nQuery and results with arg_max operator\n
\n\n
4. Create a Logic App to run the query on a recurrence and send the data to Sentinel.
A. To create a new Logic app, you can select “Automation” in the navigation pane on the left in the Sentinel portal.
\n
From here, you’ll create a Blank Playbook.
\n
select \"Blank playbook\" from the playbook creation options.
\n
B. Once your Logic App Deployment is complete, you can create a playbook to start with the common “Recurrence” Trigger.
\n
For the sample scenario described here, we can start with a recurrence Interval of “1” and frequency of “Day.”
\n
Option to decide on a recurrence interval.
\n
C. You’ll add a “New step” to query your ADX Cluster with the built in Connector for Azure Data Explorer
\n
Easily run a KQL auery in Azure Data Explorer from within Logic Apps.
\n
\n
\n\n
Once you select the Action for “Run KQL query,” the box will request the details for your Cluster URL, Database Name, and the query.
\n
Fill in cluster URL, Database name and desired KQL Query.
\n
To find these details, you can search for “ADX” in the central search at the top of your Azure Portal and select the Azure Data Explorer Clusters Service.
\n
Easily find Azure Data Explorer with search key \"ADX\".
\n
The Cluster URL can be found in the cluster overview URI Field:
\nSelect the URI as the cluster URL.\n
\n
And the database name can be reference under the “Databases” option in the navigation menu:
\n\n
\n\n
D. Now that you have your ADX Database referenced, paste in the KQL query that you wrote or the sample from above.
\n
Populated details in the ADX Query Connector in Logic Apps
\n
For the next step, we’ll break into two options for sending filtered data from ADX into Sentinel for analytics.
\n
\n
5. Option A: Send data into a Sentinel Watchlist
\n
Watchlists are easy to create, update and query in detection rules. However, they are limited to 10 million rows across all watchlists in a single Sentinel workspace. They also are incredibly straightforward for query purposes, so if you plan to use complex joins and functions, you may prefer to skip to Step 6: Option B (Custom Table).
\n
\n
1. First, create a CSV file with the aligned fields based on query results and then add that to Sentinel's Watchlists.
\n\n
Hint: Although you can create a watchlist with the Logic app, this gets into some complexity outside of the scope of this blog, because we don’t want a new watchlist each time the recurrence executes. So, one way to get the appropriate CSV file to upload to Sentinel is to test run your query in ADX while adding |take 1
\n|take 1\n
to the end of the query. This will give you a single result to download as a CSV file and then upload to Sentinel for continuous bulk updates from the logic app that we’re building.
\n
\nUse the option to export a \"take 1\" query result to CSV to upload into Sentinel for your Watchlist Template.\n
\n\n
You’ll need to select a search key, and for this sample, we’ve used the RemoteIP.
\n
\n
Validated Watchlist fields
\n
Once you name and save your watchlist in Sentinel, you’ll return to the Logic App to send the query results to it.
\n
\n
2. From here, search for the control operator, and then select “For Each.” This means that each time the query above delivers results, they’ll be appended to the watchlist. For this reason, you’ll want to work out the query time frame with the recurrence to deliver the desired results to append to the watchlist.
\n
Select a \"For each\" control in the Logic App
\n
\n
From Dynamic Content, select the value of the ADX Query run previously in the Logic app,
\n
\n
Select the Dynamic value of the ADX query output for the Control Action
\n
\n
3. And then add a final action selecting the operation for Microsoft Sentinel
\n
Select \"Microsoft Sentinel\" for the next operation.
\n
\n
Scroll down and select “Watchlists – Add a new Watchlist Item (preview)
\n
You can Add a new Watchlist Item as a preview action in Logic Apps
\n
\n
You’ll validate the workspace IDin which the Watchlist lives by cross-referencing Sentinel Settings -->Workspace Settings
\n
Where you can get the Subscription, Resource Group and Workspace ID from the workspace Overview.
\n
\n
Paste in your watchlist alias that you named when you created the watchlist(or check under Watchlists in Sentinel where the Alias is easily referenced as well).
\n
\n
Then, specify the results that you’d like as the JSON body, pulling from the Dynamic content exposed through the KQL query in the prior steps.
\n
Watchlist Item Fields are available as dynamic content from the ADX KQL Query above.
\n
\n\n
Hint:
\n
Here’s JSON to copy/paste, just ensure you validate your specific dynamic content. If fields are missing, you may need to remove and re-add each dynamic field to fully validate the query results that will be sent to the watchlist:
4. Save the Logic app, then Run the Trigger, where you should see each step succeed:
\n
The Logic App ran successfully.
\n
\n
Test your query in Sentinel by selecting the Watchlist from the Watchlist blade and clicking the “View in logs” button where you should see the results:
\n
Here, we can see the Watchlist results in Sentinel Logs.
You can also skip to Step 7 Below and reference the instructions for using the Custom table but instead use the Watchlist function (_GetWatchlist('<custom_name>') to form a detection against Microsoft Defender Threat Intelligence.
\n
\n
6. Option B: Send data to a Custom Table in Sentinel
\n
The benefit of this option is that now the Data filtered from the ADX query will exist in a table that can be referenced and joined with other tables rather than calling the watchlist operators. There’s no row restriction for results and the schema is available directly for building more complex queries. Also, this benefits consumers because they now can write detections against a custom table schema rather than managing rows in a watchlist, which reduces the amount of operational overhead.
\n
\n
1. Start with the initial logic app creation based on a recurrence (Step 4, above).
\n
This time, however, we can make the query a bit simpler to drive toward our end goal of matching (low fidelity) potential brute force with Defender Threat Intelligence IP IOCs.
\n
\n
\n
\nDeviceLogonEvents\n| where TimeGenerated >= ago(180d)\n| where RemoteIPType == \"Public\"\n| summarize \n LOGONFAILED=countif(ActionType ==\"LogonFailed\"),\n LOGONSUCCESS=countif(ActionType ==\"LogonSuccess\")\n by RemoteIP, DeviceName\n| where LOGONSUCCESS > 0\n| where LOGONFAILED >= 300\n\n
\n
\n
\n
Input the desired query in the Logic App ADX KQL Query Operator after testing and tuning it.
\n
\n\n
Hint: For more complex query schemas you might, at this stage, want to save the Logic App, run it, and then capture the results of your Query Output. You can get to this by clicking on the “Run KQL Query step” and then selecting “show raw outputs” where you can copy and paste to a text editor. This can be useful if you need to add a step to understand your JSON schema, you can add an action \"Parse JSON\" and upload a sample payload to generate/see the JSON Schema from the query. This is not necessary for this tutorial but can be helpful for future reference.
\nQuery Output JSON from Logic App run\n
\nPasting the raw output as a sample payload from the KQL Query run will allow you to generate the output schema.\n
\n\n
Parsing the data in the Logic App depends on the simplicity of the query and the resulting key value pair formatting of the request sent. If the query and results are straightforward enough, we may be able to follow the prior instructions with Log Analytics collecting the data directly. However, in this case, if we try to send each result to Log Analytics, we get a JSON request body input that includes an array that can’t neatly fit into the Schema of the new table.
\n
Example of how the logic app may fail if you simply replace the action \"send data to Sentinel Watchlist\" with \"Send Data to Log Analytics Workspace.\"
\n
So, because the results are delivered as a JSON body, where the LOGONFAILED and LOGONSUCCESS fields contain an array of values, we need to deliver those as separate records into Log Analytics.
\n
\n
2. After the Logic app step where you run your ADX KQL Query, the next step will be a control to send the results to a Log Analytics workspace.
\n
Select a \"For each\" control
\n
3. Once you select the Dynamic \"value\" from the ADX query output, you'll select \"Add an action\" and add a second \"for each\" control to accommodate the array values and break them into individual records in Microsoft Sentinel's Log Analytics Workspace.
\n
\n
4. In the second \"For each\" control output box, select \"Add dynamic content\" and then select the \"Expression\" tab, where you can enter the expression shared below, and then click \"OK\":
\n
\n
\n
\narray(triggerOutputs()?['value'])\n
\n
\n
\n
Add an embedded \"For each\" control.
\n
Input the expression to break the array into individual records
\n
\n\n
Hint: Once we begin nesting controls, it can be helpful to name them to keep track of what each control is intended to accomplish. This makes things much easier if you’re trying to troubleshoot a complex query for filtering data to Log Analytics.
\n\n
5. The final step in the Logic App is to send the data to Log Analytics.
\n
To do so, select “Add an action” and then search for Azure Log Analytics, where you can select the option to \"Send Data.\"
\n
Select the operation to Send Data to an Azure Log Analytics Workspace.
\n
You’ll also need to establish your connection to the Workspace, where you’ll declare a name for the connection, then find the Workspace ID and Key details by navigating to your Sentinel portal-->Settings-->Workspace Settings-->Agents (use the drop down for Log Analytics agent instructions to find the workspace Key and ID.)
\n
Input your Workspace details
\n
6. Once populated, enter the desired JSON request body and name your custom log table, which you’ll be able to query in Sentinel.
\n
For the JSON request body, here’s a copy/paste to start with:
Pasting in the JSON request body from above should result in the automatic selection of the dynamic results from the ADX KQL query
\n\n
Hint: Note how Dynamic content hides an expression under the selected shortcut item. This can be helpful for troubleshooting as well: items('For_Each_ADX_value,_send_to_Sentinel’’s_Log_Analytic_Workspace’)?['RemoteIP']
\n\n
7. Save the Logic app and select “Run Trigger” to test. Once it runs, you should see green checks at each stage with the expected number of results.
\n
Successful Logic App Run
\n
8. Finally, you can see the results of your filtered import into Log Analytics from ADX!
\n
Navigate to the “Logs” blade of Sentinel, where you can query the custom table, which will automatically append your “Custom Log Name” with an “_CL”. (Note: It can take several minutes to send the initial set of logs. If your results are unexpectedly empty after a successful Logic App trigger run, you can go get a beverage or snack and then try again.)
\n
Use the Custom Log Name in the “Send Data” field of the Logic App to run the Log Analytics Query
\n
Query your new custom table from Logs in Microsoft Sentinel.
\nAlthough in this tutorial, we're using well-formed data from Microsoft 365 Defender, It is possible to utilize this model with any data source, including Syslog, Netflow, Etc. In these cases, you can Use ASIM parsers to view data in a normalized format and to include all data relevant to the schema in your queries.\n
7. Build an Analytic Rule Matching Your New Custom Table to Threat Intelligence IOC's from the Defender Threat Intelligence Connector.
\n
Here’s where the fun really begins. Whereas you cannot use ADX directly for Analytics queries, once you send filtered data back into Microsoft Sentinel, you can certainly write custom detection rules.
\n
Of course, these will not be Near Real Time (NRT) detections, but this is a great scenario for running forensics or hunting older records against Threat Intelligence (TI) Indicators of Compromise (IOC’s).
\n
\n
It’s always helpful, whenever possible, to use an existing useful rule and make a copy to modify a similar detection for a custom detection.
\n
The Preview Integration with Defender Threat Intelligence and its associated Solution, once installed, not only provides out of box TI matching on native tables as soon as it’s enabled, but it also builds a results table of its own and the native analytic rules provide great samples to draw from for the custom rule you can now write. (Learn more about Threat Intelligence in Sentinel here: Threat intelligence integration in Microsoft Sentinel | Microsoft Learn)
\n
\n
The beauty of the Defender Threat Intelligence solution is being able to take advantage of Microsoft’s massive scale of visibility on Threat Intelligence, providing operationalization and immediate SOC maturity gains with little effort.
\n
\n
1. First, enable the Threat Intelligence Solution if you haven’t yet done so.
\n
Enable the Threat Intelligence Solution in Microsoft Sentinel.
\n
Then, when you click the “Manage” button in the bottom right, you’ll be taken to the associated content. Since, in this case, we’re trying to get a match against our potential brute force IP address, a good rule to use for a model to start with is the “TI map IP entity to SignInLogs.”
\n
\n
The Threat Intelligence Solution includes a number of useful templates for detection against Threat Intelligence IOC's such as this one.
\n
Once you select the rule, you’ll see the associated data sources and will notice that Custom Tables, like the one we just created, are not naturally included. To provide that native TI matching, you can enable the rule as-is (tuning as appropriate.)
\n
\n
2. You can also use the same template (“TI map IP entity to SignInLogs\") to create a new rule for our purposes here.
\n
\n
3. Rename the rule accordingly.
\n
\n
4. In order to add the context for Sentinel’s built in Machine Learning, it’s important to select the proper Tactics & Techniques, so for the sample we’re building, you can select Tactic “Credential Access” and Technique “T1110 – Brute Force.”
\n
Select Tactic \"credential access\" and Technique \"Brute Force\"
\n
5. Select the blue button “Next : Set rule logic >”
\n
\n
6. Modify the KQL rule to address your detection goals.
\nIf you’re modifying or creating a rule for a new detection, it can be helpful to have a separate log screen available to test the query for desired detection results.\n
Here’s a sample that’s sufficiently amended from the built-in query that delivers the intended results.
\n
Note: For your query, you’ll need to specifically replace the custom table under the “join” operator with the name that you created in your Logic App.
\n
\n
\n
\nThreatIntelligenceIndicator\n| where Active == true\n// Picking up only IOC's that contain the entities we want\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\n// As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\n// Taking the first non-empty value based on potential IOC match availability\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)\n// using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated\n| join kind=innerunique (\n//join custom Table\n DetailedADXSusIP_CL \n // | where TimeGenerated >= ago(dt_lookBack)\n | project TimeGenerated, IPEntity=RemoteIP_s, DeviceName_s, LOGONFAILED_s\n // renaming time column so it is clear the log this came from\n //| extend SigninLogs_TimeGenerated = TimeGenerated, Type = Type\n)\n//use appropriate custom table column for IOC match\non $left.TI_ipEntity == $right.IPEntity\n\n
\n
\n
\n
The Results Simulation will be a good check for necessary tuning as well:
\n
The Results Simulation on the right can be helpful for tuning your detection query.
\n
7. Once the query is pasted and validated, you can select the appropriate entities, which are important to align for both the Built in Machine Learning and User and Entity Behaviour Analytics that are native capabilities of Sentinel.
\n
\n
The Entities that are being mapped for this example are Host and IP:
\n
Map Host and IP Entities
\n
8. You can then set your preference for the query scheduling and Alert Threshold. Just remember that even if there was a match in your data set, you won’t see incident results until the rule runs, which is the time frame designated by the Query Schedule. (don’t expect to see these results immediately if you’ve selected to run every 5 hours over the last 5 hours of data.)
\n
\n
On the next screen you can group alerts if desired (not required).
\n
\n
Then, you can align a desired Automated Response (not required).
\n
\n
9. On the Summary screen, you can review all of your selections, and once you’re satisfied, Create the rule.
\n
Review selections before creating the rule.
\n
\n
...Several Hours Later:
\n
We have an Incident match!
\n
In a lab environment with a honeypot, this is what we were after.
\n
The Threat Intelligence Rule Template found a match against the ADX Dataset!
\n
\n
If we investigate and “view full details” to check the Entity information for the IP address, we can see the details associated with the IP entity:
\n
\n
\n
\n
In Summary:
\n
We hope you enjoyed this walkthrough of an example for using ADX as a security data lake from which you can draw filtered data back into Sentinel for Analytic rule matching.
\n
The flexibility of Microsoft Sentinel within the rich ecosystem of the Azure Cloud provides many such creative and cost-saving capabilities allowing companies, who know their attack surface best, to benefit from the Native Cloud in which Microsoft Sentinel resides.
\n
\n
Special Thanks:
\n
Thanks especially to co-author . This blog post was inspired by and @Mary Lieb to help customers save costs while using Microsoft Sentinel. Thanks to and for assisting with the envisioning of this multi-resource solution.
In this blog post, we’ll look at a step-by-step tutorial, using the power of Azure Data Explorer (which can act as a security data repository), to bring key data into Sentinel for Analytics, Hunting, and Forensics. The Azure Ecosystem, used with Microsoft Sentinel, can dramatically reduce collection and retention costs while providing a flexible and familiar toolset.
\n
\n
Companies will be able to bring their own machine learning to feed contextual data from Azure Data Explorer into Microsoft Sentinel, benefiting from Microsoft Sentinel's underlying analytic engine, built-in ML models, UEBA, and new Threat Intelligence (TI) correlations provided by Defender Threat Intelligence.
\n
\n
\n
\n
","introduction":"","coverImage":null,"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""},"currentRevision":{"__ref":"Revision:revision:3866030_15"},"latestVersion":{"__typename":"FriendlyVersion","major":"2","minor":"0"},"metrics":{"__typename":"MessageMetrics","views":13401},"visibilityScope":"PUBLIC","canonicalUrl":null,"seoTitle":null,"seoDescription":null,"placeholder":false,"originalMessageForPlaceholder":null,"contributors":{"__typename":"UserConnection","edges":[]},"nonCoAuthorContributors":{"__typename":"UserConnection","edges":[]},"coAuthors":{"__typename":"UserConnection","edges":[]},"blogMessagePolicies":{"__typename":"BlogMessagePolicies","canDoAuthoringActionsOnBlog":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.blog.action_can_do_authoring_action.accessDenied","key":"error.lithium.policies.blog.action_can_do_authoring_action.accessDenied","args":[]}}},"archivalData":null,"replies":{"__typename":"MessageConnection","edges":[{"__typename":"MessageEdge","cursor":"MjUuMXwyLjF8aXwxMHwxMzI6MHxpbnQsMzg3NTM2OCwzODc1MzY4","node":{"__ref":"BlogReplyMessage:message:3875368"}},{"__typename":"MessageEdge","cursor":"MjUuMXwyLjF8aXwxMHwxMzI6MHxpbnQsMzg3NTM2OCwzODc0MDgz","node":{"__ref":"BlogReplyMessage:message:3874083"}}],"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"customFields":[],"revisions({\"constraints\":{\"isPublished\":{\"eq\":true}},\"first\":1})":{"__typename":"RevisionConnection","totalCount":15}},"Conversation:conversation:3866030":{"__typename":"Conversation","id":"conversation:3866030","solved":false,"topic":{"__ref":"BlogTopicMessage:message:3866030"},"lastPostingActivityTime":"2023-07-15T14:07:14.605-07:00","lastPostTime":"2023-07-15T14:07:14.605-07:00","unreadReplyCount":2,"isSubscribed":false},"ModerationData:moderation_data:3866030":{"__typename":"ModerationData","id":"moderation_data:3866030","status":"APPROVED","rejectReason":null,"isReportedAbuse":false,"rejectUser":null,"rejectTime":null,"rejectActorType":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIwOWk4MzU0RUMwQjk2QjFFMzBE?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIwOWk4MzU0RUMwQjk2QjFFMzBE?revision=15","title":"Beth_Bischoff_7-1688587625077.png","associationType":"TEASER","width":1824,"height":904,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIxNmlFNjY5ODBDMEU1OURCRjEz?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIxNmlFNjY5ODBDMEU1OURCRjEz?revision=15","title":"Beth_Bischoff_0-1688589325852.png","associationType":"BODY","width":1052,"height":458,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2Mmk1NzRFODNCREJDNDM3Q0I4?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2Mmk1NzRFODNCREJDNDM3Q0I4?revision=15","title":"Beth_Bischoff_1-1688572228379.png","associationType":"BODY","width":221,"height":204,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2MWlEOUM3NDc2NjVERTEwM0U1?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2MWlEOUM3NDc2NjVERTEwM0U1?revision=15","title":"Beth_Bischoff_2-1688572228381.png","associationType":"BODY","width":647,"height":242,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2M2k3NkU3MzVBRUM2MTYyQjJD?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2M2k3NkU3MzVBRUM2MTYyQjJD?revision=15","title":"Beth_Bischoff_3-1688572228386.png","associationType":"BODY","width":508,"height":466,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA3Nmk0MjMxMDZDRTZENzYxMTZD?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA3Nmk0MjMxMDZDRTZENzYxMTZD?revision=15","title":"Beth_Bischoff_9-1688573594133.png","associationType":"BODY","width":630,"height":230,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2NWkxQ0ExNUI3NjIzMTI3MjlE?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA2NWkxQ0ExNUI3NjIzMTI3MjlE?revision=15","title":"Beth_Bischoff_5-1688572228388.png","associationType":"BODY","width":438,"height":209,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIzMWk4QzYzMTMxMEEyQjA3MDVB?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIzMWk4QzYzMTMxMEEyQjA3MDVB?revision=15","title":"Beth_Bischoff_1-1688589977598.png","associationType":"BODY","width":1252,"height":245,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIzN2k0MDIxODU2NDdBM0MwQUUx?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjIzN2k0MDIxODU2NDdBM0MwQUUx?revision=15","title":"Beth_Bischoff_2-1688590148487.png","associationType":"BODY","width":673,"height":260,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0MWk3MjMzMTQ4ODE0NDk0OEYz?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0MWk3MjMzMTQ4ODE0NDk0OEYz?revision=15","title":"Beth_Bischoff_4-1688590349191.png","associationType":"BODY","width":768,"height":536,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0Mmk0QTRBNUU1RjY1RUIzMkFB?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0Mmk0QTRBNUU1RjY1RUIzMkFB?revision=15","title":"Beth_Bischoff_5-1688590580546.png","associationType":"BODY","width":983,"height":422,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4MmlFMzJENkM2MzdFQjEyNUYw?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4MmlFMzJENkM2MzdFQjEyNUYw?revision=15","title":"Beth_Bischoff_1-1688574823657.png","associationType":"BODY","width":520,"height":561,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4NGk1QjFGMzYzMDRFMEFCNjJG?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4NGk1QjFGMzYzMDRFMEFCNjJG?revision=15","title":"Beth_Bischoff_2-1688574823658.png","associationType":"BODY","width":619,"height":252,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4Nmk0NjYxQTk3NkU3NTY4RkYy?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4Nmk0NjYxQTk3NkU3NTY4RkYy?revision=15","title":"Beth_Bischoff_3-1688574823660.png","associationType":"BODY","width":1026,"height":285,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4N2lDMjdGRkFEMTUwQzJDMUY0?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4N2lDMjdGRkFEMTUwQzJDMUY0?revision=15","title":"Beth_Bischoff_4-1688574823662.png","associationType":"BODY","width":651,"height":461,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4NWlFRDRCMjhEOTg4ODUzQUUy?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4NWlFRDRCMjhEOTg4ODUzQUUy?revision=15","title":"Beth_Bischoff_5-1688574823663.png","associationType":"BODY","width":651,"height":64,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA5MGlEQjZCODY1ODQ2OEQ4N0E0?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA5MGlEQjZCODY1ODQ2OEQ4N0E0?revision=15","title":"Beth_Bischoff_6-1688574823665.png","associationType":"BODY","width":1103,"height":320,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4OGlCRTJFMTg0RUEwNUVCMDlB?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4OGlCRTJFMTg0RUEwNUVCMDlB?revision=15","title":"Beth_Bischoff_7-1688574823667.png","associationType":"BODY","width":697,"height":329,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4OWlGMUI1OEUyNEY4QzJDRTAy?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjA4OWlGMUI1OEUyNEY4QzJDRTAy?revision=15","title":"Beth_Bischoff_8-1688574823668.png","associationType":"BODY","width":1508,"height":191,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0M2lGRjcwQkQ4MkE3NkY3NUZB?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0M2lGRjcwQkQ4MkE3NkY3NUZB?revision=15","title":"Beth_Bischoff_6-1688591051531.png","associationType":"BODY","width":908,"height":564,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0NGlFQjAzQzE5QTFDMEUwOTQ1?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjI0NGlFQjAzQzE5QTFDMEUwOTQ1?revision=15","title":"Beth_Bischoff_7-1688591257461.png","associationType":"BODY","width":799,"height":621,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjEzM2lERUE1NkEyQzNGRTg4RTg0?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjEzM2lERUE1NkEyQzNGRTg4RTg0?revision=15","title":"Beth_Bischoff_0-1688578387016.png","associationType":"BODY","width":926,"height":965,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjEzOWk3NkNGNzkyQjQxMzRBMjlC?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjEzOWk3NkNGNzkyQjQxMzRBMjlC?revision=15","title":"Beth_Bischoff_2-1688578692542.png","associationType":"BODY","width":674,"height":326,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjE1NmlCMzcyNkU4RkY1NkQ0Qzg5?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjE1NmlCMzcyNkU4RkY1NkQ0Qzg5?revision=15","title":"Beth_Bischoff_3-1688581134386.png","associationType":"BODY","width":631,"height":256,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjE2MWkzQkY1NjcwNTVDMDZENTBF?revision=15\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0zODY2MDMwLTQ4NjE2MWkzQkY1NjcwNTVDMDZENTBF?revision=15","title":"Beth_Bischoff_5-1688581496704.png","associationType":"BODY","width":513,"height":181,"altText":null},"Revision:revision:3866030_15":{"__typename":"Revision","id":"revision:3866030_15","lastEditTime":"2023-07-11T05:14:50.897-07:00"},"CachedAsset:theme:customTheme1-1743778046204":{"__typename":"CachedAsset","id":"theme:customTheme1-1743778046204","value":{"id":"customTheme1","animation":{"fast":"150ms","normal":"250ms","slow":"500ms","slowest":"750ms","function":"cubic-bezier(0.07, 0.91, 0.51, 1)","__typename":"AnimationThemeSettings"},"avatar":{"borderRadius":"50%","collections":["default"],"__typename":"AvatarThemeSettings"},"basics":{"browserIcon":{"imageAssetName":"favicon-1730836283320.png","imageLastModified":"1730836286415","__typename":"ThemeAsset"},"customerLogo":{"imageAssetName":"favicon-1730836271365.png","imageLastModified":"1730836274203","__typename":"ThemeAsset"},"maximumWidthOfPageContent":"1300px","oneColumnNarrowWidth":"800px","gridGutterWidthMd":"30px","gridGutterWidthXs":"10px","pageWidthStyle":"WIDTH_OF_BROWSER","__typename":"BasicsThemeSettings"},"buttons":{"borderRadiusSm":"3px","borderRadius":"3px","borderRadiusLg":"5px","paddingY":"5px","paddingYLg":"7px","paddingYHero":"var(--lia-bs-btn-padding-y-lg)","paddingX":"12px","paddingXLg":"16px","paddingXHero":"60px","fontStyle":"NORMAL","fontWeight":"700","textTransform":"NONE","disabledOpacity":0.5,"primaryTextColor":"var(--lia-bs-white)","primaryTextHoverColor":"var(--lia-bs-white)","primaryTextActiveColor":"var(--lia-bs-white)","primaryBgColor":"var(--lia-bs-primary)","primaryBgHoverColor":"hsl(var(--lia-bs-primary-h), var(--lia-bs-primary-s), calc(var(--lia-bs-primary-l) * 0.85))","primaryBgActiveColor":"hsl(var(--lia-bs-primary-h), var(--lia-bs-primary-s), calc(var(--lia-bs-primary-l) * 0.7))","primaryBorder":"1px solid transparent","primaryBorderHover":"1px solid transparent","primaryBorderActive":"1px solid transparent","primaryBorderFocus":"1px solid var(--lia-bs-white)","primaryBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","secondaryTextColor":"var(--lia-bs-gray-900)","secondaryTextHoverColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.95))","secondaryTextActiveColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.9))","secondaryBgColor":"var(--lia-bs-gray-200)","secondaryBgHoverColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.96))","secondaryBgActiveColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.92))","secondaryBorder":"1px solid transparent","secondaryBorderHover":"1px solid transparent","secondaryBorderActive":"1px solid transparent","secondaryBorderFocus":"1px solid transparent","secondaryBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","tertiaryTextColor":"var(--lia-bs-gray-900)","tertiaryTextHoverColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.95))","tertiaryTextActiveColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.9))","tertiaryBgColor":"transparent","tertiaryBgHoverColor":"transparent","tertiaryBgActiveColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.04)","tertiaryBorder":"1px solid transparent","tertiaryBorderHover":"1px solid hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","tertiaryBorderActive":"1px solid transparent","tertiaryBorderFocus":"1px solid transparent","tertiaryBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","destructiveTextColor":"var(--lia-bs-danger)","destructiveTextHoverColor":"hsl(var(--lia-bs-danger-h), var(--lia-bs-danger-s), calc(var(--lia-bs-danger-l) * 0.95))","destructiveTextActiveColor":"hsl(var(--lia-bs-danger-h), var(--lia-bs-danger-s), calc(var(--lia-bs-danger-l) * 0.9))","destructiveBgColor":"var(--lia-bs-gray-200)","destructiveBgHoverColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.96))","destructiveBgActiveColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.92))","destructiveBorder":"1px solid transparent","destructiveBorderHover":"1px solid transparent","destructiveBorderActive":"1px solid transparent","destructiveBorderFocus":"1px solid transparent","destructiveBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","__typename":"ButtonsThemeSettings"},"border":{"color":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","mainContent":"NONE","sideContent":"LIGHT","radiusSm":"3px","radius":"5px","radiusLg":"9px","radius50":"100vw","__typename":"BorderThemeSettings"},"boxShadow":{"xs":"0 0 0 1px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.08), 0 3px 0 -1px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.16)","sm":"0 2px 4px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.12)","md":"0 5px 15px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.3)","lg":"0 10px 30px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.3)","__typename":"BoxShadowThemeSettings"},"cards":{"bgColor":"var(--lia-panel-bg-color)","borderRadius":"var(--lia-panel-border-radius)","boxShadow":"var(--lia-box-shadow-xs)","__typename":"CardsThemeSettings"},"chip":{"maxWidth":"300px","height":"30px","__typename":"ChipThemeSettings"},"coreTypes":{"defaultMessageLinkColor":"var(--lia-bs-link-color)","defaultMessageLinkDecoration":"none","defaultMessageLinkFontStyle":"NORMAL","defaultMessageLinkFontWeight":"400","defaultMessageFontStyle":"NORMAL","defaultMessageFontWeight":"400","forumColor":"#4099E2","forumFontFamily":"var(--lia-bs-font-family-base)","forumFontWeight":"var(--lia-default-message-font-weight)","forumLineHeight":"var(--lia-bs-line-height-base)","forumFontStyle":"var(--lia-default-message-font-style)","forumMessageLinkColor":"var(--lia-default-message-link-color)","forumMessageLinkDecoration":"var(--lia-default-message-link-decoration)","forumMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","forumMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","forumSolvedColor":"#148563","blogColor":"#1CBAA0","blogFontFamily":"var(--lia-bs-font-family-base)","blogFontWeight":"var(--lia-default-message-font-weight)","blogLineHeight":"1.75","blogFontStyle":"var(--lia-default-message-font-style)","blogMessageLinkColor":"var(--lia-default-message-link-color)","blogMessageLinkDecoration":"var(--lia-default-message-link-decoration)","blogMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","blogMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","tkbColor":"#4C6B90","tkbFontFamily":"var(--lia-bs-font-family-base)","tkbFontWeight":"var(--lia-default-message-font-weight)","tkbLineHeight":"1.75","tkbFontStyle":"var(--lia-default-message-font-style)","tkbMessageLinkColor":"var(--lia-default-message-link-color)","tkbMessageLinkDecoration":"var(--lia-default-message-link-decoration)","tkbMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","tkbMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","qandaColor":"#4099E2","qandaFontFamily":"var(--lia-bs-font-family-base)","qandaFontWeight":"var(--lia-default-message-font-weight)","qandaLineHeight":"var(--lia-bs-line-height-base)","qandaFontStyle":"var(--lia-default-message-link-font-style)","qandaMessageLinkColor":"var(--lia-default-message-link-color)","qandaMessageLinkDecoration":"var(--lia-default-message-link-decoration)","qandaMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","qandaMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","qandaSolvedColor":"#3FA023","ideaColor":"#FF8000","ideaFontFamily":"var(--lia-bs-font-family-base)","ideaFontWeight":"var(--lia-default-message-font-weight)","ideaLineHeight":"var(--lia-bs-line-height-base)","ideaFontStyle":"var(--lia-default-message-font-style)","ideaMessageLinkColor":"var(--lia-default-message-link-color)","ideaMessageLinkDecoration":"var(--lia-default-message-link-decoration)","ideaMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","ideaMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","contestColor":"#FCC845","contestFontFamily":"var(--lia-bs-font-family-base)","contestFontWeight":"var(--lia-default-message-font-weight)","contestLineHeight":"var(--lia-bs-line-height-base)","contestFontStyle":"var(--lia-default-message-link-font-style)","contestMessageLinkColor":"var(--lia-default-message-link-color)","contestMessageLinkDecoration":"var(--lia-default-message-link-decoration)","contestMessageLinkFontStyle":"ITALIC","contestMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","occasionColor":"#D13A1F","occasionFontFamily":"var(--lia-bs-font-family-base)","occasionFontWeight":"var(--lia-default-message-font-weight)","occasionLineHeight":"var(--lia-bs-line-height-base)","occasionFontStyle":"var(--lia-default-message-font-style)","occasionMessageLinkColor":"var(--lia-default-message-link-color)","occasionMessageLinkDecoration":"var(--lia-default-message-link-decoration)","occasionMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","occasionMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","grouphubColor":"#333333","categoryColor":"#949494","communityColor":"#FFFFFF","productColor":"#949494","__typename":"CoreTypesThemeSettings"},"colors":{"black":"#000000","white":"#FFFFFF","gray100":"#F7F7F7","gray200":"#F7F7F7","gray300":"#E8E8E8","gray400":"#D9D9D9","gray500":"#CCCCCC","gray600":"#717171","gray700":"#707070","gray800":"#545454","gray900":"#333333","dark":"#545454","light":"#F7F7F7","primary":"#0069D4","secondary":"#333333","bodyText":"#1E1E1E","bodyBg":"#FFFFFF","info":"#409AE2","success":"#41C5AE","warning":"#FCC844","danger":"#BC341B","alertSystem":"#FF6600","textMuted":"#707070","highlight":"#FFFCAD","outline":"var(--lia-bs-primary)","custom":["#D3F5A4","#243A5E"],"__typename":"ColorsThemeSettings"},"divider":{"size":"3px","marginLeft":"4px","marginRight":"4px","borderRadius":"50%","bgColor":"var(--lia-bs-gray-600)","bgColorActive":"var(--lia-bs-gray-600)","__typename":"DividerThemeSettings"},"dropdown":{"fontSize":"var(--lia-bs-font-size-sm)","borderColor":"var(--lia-bs-border-color)","borderRadius":"var(--lia-bs-border-radius-sm)","dividerBg":"var(--lia-bs-gray-300)","itemPaddingY":"5px","itemPaddingX":"20px","headerColor":"var(--lia-bs-gray-700)","__typename":"DropdownThemeSettings"},"email":{"link":{"color":"#0069D4","hoverColor":"#0061c2","decoration":"none","hoverDecoration":"underline","__typename":"EmailLinkSettings"},"border":{"color":"#e4e4e4","__typename":"EmailBorderSettings"},"buttons":{"borderRadiusLg":"5px","paddingXLg":"16px","paddingYLg":"7px","fontWeight":"700","primaryTextColor":"#ffffff","primaryTextHoverColor":"#ffffff","primaryBgColor":"#0069D4","primaryBgHoverColor":"#005cb8","primaryBorder":"1px solid transparent","primaryBorderHover":"1px solid transparent","__typename":"EmailButtonsSettings"},"panel":{"borderRadius":"5px","borderColor":"#e4e4e4","__typename":"EmailPanelSettings"},"__typename":"EmailThemeSettings"},"emoji":{"skinToneDefault":"#ffcd43","skinToneLight":"#fae3c5","skinToneMediumLight":"#e2cfa5","skinToneMedium":"#daa478","skinToneMediumDark":"#a78058","skinToneDark":"#5e4d43","__typename":"EmojiThemeSettings"},"heading":{"color":"var(--lia-bs-body-color)","fontFamily":"Segoe UI","fontStyle":"NORMAL","fontWeight":"400","h1FontSize":"34px","h2FontSize":"32px","h3FontSize":"28px","h4FontSize":"24px","h5FontSize":"20px","h6FontSize":"16px","lineHeight":"1.3","subHeaderFontSize":"11px","subHeaderFontWeight":"500","h1LetterSpacing":"normal","h2LetterSpacing":"normal","h3LetterSpacing":"normal","h4LetterSpacing":"normal","h5LetterSpacing":"normal","h6LetterSpacing":"normal","subHeaderLetterSpacing":"2px","h1FontWeight":"var(--lia-bs-headings-font-weight)","h2FontWeight":"var(--lia-bs-headings-font-weight)","h3FontWeight":"var(--lia-bs-headings-font-weight)","h4FontWeight":"var(--lia-bs-headings-font-weight)","h5FontWeight":"var(--lia-bs-headings-font-weight)","h6FontWeight":"var(--lia-bs-headings-font-weight)","__typename":"HeadingThemeSettings"},"icons":{"size10":"10px","size12":"12px","size14":"14px","size16":"16px","size20":"20px","size24":"24px","size30":"30px","size40":"40px","size50":"50px","size60":"60px","size80":"80px","size120":"120px","size160":"160px","__typename":"IconsThemeSettings"},"imagePreview":{"bgColor":"var(--lia-bs-gray-900)","titleColor":"var(--lia-bs-white)","controlColor":"var(--lia-bs-white)","controlBgColor":"var(--lia-bs-gray-800)","__typename":"ImagePreviewThemeSettings"},"input":{"borderColor":"var(--lia-bs-gray-600)","disabledColor":"var(--lia-bs-gray-600)","focusBorderColor":"var(--lia-bs-primary)","labelMarginBottom":"10px","btnFontSize":"var(--lia-bs-font-size-sm)","focusBoxShadow":"0 0 0 3px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","checkLabelMarginBottom":"2px","checkboxBorderRadius":"3px","borderRadiusSm":"var(--lia-bs-border-radius-sm)","borderRadius":"var(--lia-bs-border-radius)","borderRadiusLg":"var(--lia-bs-border-radius-lg)","formTextMarginTop":"4px","textAreaBorderRadius":"var(--lia-bs-border-radius)","activeFillColor":"var(--lia-bs-primary)","__typename":"InputThemeSettings"},"loading":{"dotDarkColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.2)","dotLightColor":"hsla(var(--lia-bs-white-h), var(--lia-bs-white-s), var(--lia-bs-white-l), 0.5)","barDarkColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.06)","barLightColor":"hsla(var(--lia-bs-white-h), var(--lia-bs-white-s), var(--lia-bs-white-l), 0.4)","__typename":"LoadingThemeSettings"},"link":{"color":"var(--lia-bs-primary)","hoverColor":"hsl(var(--lia-bs-primary-h), var(--lia-bs-primary-s), calc(var(--lia-bs-primary-l) - 10%))","decoration":"none","hoverDecoration":"underline","__typename":"LinkThemeSettings"},"listGroup":{"itemPaddingY":"15px","itemPaddingX":"15px","borderColor":"var(--lia-bs-gray-300)","__typename":"ListGroupThemeSettings"},"modal":{"contentTextColor":"var(--lia-bs-body-color)","contentBg":"var(--lia-bs-white)","backgroundBg":"var(--lia-bs-black)","smSize":"440px","mdSize":"760px","lgSize":"1080px","backdropOpacity":0.3,"contentBoxShadowXs":"var(--lia-bs-box-shadow-sm)","contentBoxShadow":"var(--lia-bs-box-shadow)","headerFontWeight":"700","__typename":"ModalThemeSettings"},"navbar":{"position":"FIXED","background":{"attachment":null,"clip":null,"color":"var(--lia-bs-white)","imageAssetName":"","imageLastModified":"0","origin":null,"position":"CENTER_CENTER","repeat":"NO_REPEAT","size":"COVER","__typename":"BackgroundProps"},"backgroundOpacity":0.8,"paddingTop":"15px","paddingBottom":"15px","borderBottom":"1px solid var(--lia-bs-border-color)","boxShadow":"var(--lia-bs-box-shadow-sm)","brandMarginRight":"30px","brandMarginRightSm":"10px","brandLogoHeight":"30px","linkGap":"10px","linkJustifyContent":"flex-start","linkPaddingY":"5px","linkPaddingX":"10px","linkDropdownPaddingY":"9px","linkDropdownPaddingX":"var(--lia-nav-link-px)","linkColor":"var(--lia-bs-body-color)","linkHoverColor":"var(--lia-bs-primary)","linkFontSize":"var(--lia-bs-font-size-sm)","linkFontStyle":"NORMAL","linkFontWeight":"400","linkTextTransform":"NONE","linkLetterSpacing":"normal","linkBorderRadius":"var(--lia-bs-border-radius-sm)","linkBgColor":"transparent","linkBgHoverColor":"transparent","linkBorder":"none","linkBorderHover":"none","linkBoxShadow":"none","linkBoxShadowHover":"none","linkTextBorderBottom":"none","linkTextBorderBottomHover":"none","dropdownPaddingTop":"10px","dropdownPaddingBottom":"15px","dropdownPaddingX":"10px","dropdownMenuOffset":"2px","dropdownDividerMarginTop":"10px","dropdownDividerMarginBottom":"10px","dropdownBorderColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","controllerBgHoverColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.1)","controllerIconColor":"var(--lia-bs-body-color)","controllerIconHoverColor":"var(--lia-bs-body-color)","controllerTextColor":"var(--lia-nav-controller-icon-color)","controllerTextHoverColor":"var(--lia-nav-controller-icon-hover-color)","controllerHighlightColor":"hsla(30, 100%, 50%)","controllerHighlightTextColor":"var(--lia-yiq-light)","controllerBorderRadius":"var(--lia-border-radius-50)","hamburgerColor":"var(--lia-nav-controller-icon-color)","hamburgerHoverColor":"var(--lia-nav-controller-icon-color)","hamburgerBgColor":"transparent","hamburgerBgHoverColor":"transparent","hamburgerBorder":"none","hamburgerBorderHover":"none","collapseMenuMarginLeft":"20px","collapseMenuDividerBg":"var(--lia-nav-link-color)","collapseMenuDividerOpacity":0.16,"__typename":"NavbarThemeSettings"},"pager":{"textColor":"var(--lia-bs-link-color)","textFontWeight":"var(--lia-font-weight-md)","textFontSize":"var(--lia-bs-font-size-sm)","__typename":"PagerThemeSettings"},"panel":{"bgColor":"var(--lia-bs-white)","borderRadius":"var(--lia-bs-border-radius)","borderColor":"var(--lia-bs-border-color)","boxShadow":"none","__typename":"PanelThemeSettings"},"popover":{"arrowHeight":"8px","arrowWidth":"16px","maxWidth":"300px","minWidth":"100px","headerBg":"var(--lia-bs-white)","borderColor":"var(--lia-bs-border-color)","borderRadius":"var(--lia-bs-border-radius)","boxShadow":"0 0.5rem 1rem hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.15)","__typename":"PopoverThemeSettings"},"prism":{"color":"#000000","bgColor":"#f5f2f0","fontFamily":"var(--font-family-monospace)","fontSize":"var(--lia-bs-font-size-base)","fontWeightBold":"var(--lia-bs-font-weight-bold)","fontStyleItalic":"italic","tabSize":2,"highlightColor":"#b3d4fc","commentColor":"#62707e","punctuationColor":"#6f6f6f","namespaceOpacity":"0.7","propColor":"#990055","selectorColor":"#517a00","operatorColor":"#906736","operatorBgColor":"hsla(0, 0%, 100%, 0.5)","keywordColor":"#0076a9","functionColor":"#d3284b","variableColor":"#c14700","__typename":"PrismThemeSettings"},"rte":{"bgColor":"var(--lia-bs-white)","borderRadius":"var(--lia-panel-border-radius)","boxShadow":" var(--lia-panel-box-shadow)","customColor1":"#bfedd2","customColor2":"#fbeeb8","customColor3":"#f8cac6","customColor4":"#eccafa","customColor5":"#c2e0f4","customColor6":"#2dc26b","customColor7":"#f1c40f","customColor8":"#e03e2d","customColor9":"#b96ad9","customColor10":"#3598db","customColor11":"#169179","customColor12":"#e67e23","customColor13":"#ba372a","customColor14":"#843fa1","customColor15":"#236fa1","customColor16":"#ecf0f1","customColor17":"#ced4d9","customColor18":"#95a5a6","customColor19":"#7e8c8d","customColor20":"#34495e","customColor21":"#000000","customColor22":"#ffffff","defaultMessageHeaderMarginTop":"40px","defaultMessageHeaderMarginBottom":"20px","defaultMessageItemMarginTop":"0","defaultMessageItemMarginBottom":"10px","diffAddedColor":"hsla(170, 53%, 51%, 0.4)","diffChangedColor":"hsla(43, 97%, 63%, 0.4)","diffNoneColor":"hsla(0, 0%, 80%, 0.4)","diffRemovedColor":"hsla(9, 74%, 47%, 0.4)","specialMessageHeaderMarginTop":"40px","specialMessageHeaderMarginBottom":"20px","specialMessageItemMarginTop":"0","specialMessageItemMarginBottom":"10px","__typename":"RteThemeSettings"},"tags":{"bgColor":"var(--lia-bs-gray-200)","bgHoverColor":"var(--lia-bs-gray-400)","borderRadius":"var(--lia-bs-border-radius-sm)","color":"var(--lia-bs-body-color)","hoverColor":"var(--lia-bs-body-color)","fontWeight":"var(--lia-font-weight-md)","fontSize":"var(--lia-font-size-xxs)","textTransform":"UPPERCASE","letterSpacing":"0.5px","__typename":"TagsThemeSettings"},"toasts":{"borderRadius":"var(--lia-bs-border-radius)","paddingX":"12px","__typename":"ToastsThemeSettings"},"typography":{"fontFamilyBase":"Segoe UI","fontStyleBase":"NORMAL","fontWeightBase":"400","fontWeightLight":"300","fontWeightNormal":"400","fontWeightMd":"500","fontWeightBold":"700","letterSpacingSm":"normal","letterSpacingXs":"normal","lineHeightBase":"1.5","fontSizeBase":"16px","fontSizeXxs":"11px","fontSizeXs":"12px","fontSizeSm":"14px","fontSizeLg":"20px","fontSizeXl":"24px","smallFontSize":"14px","customFonts":[{"source":"SERVER","name":"Segoe UI","styles":[{"style":"NORMAL","weight":"400","__typename":"FontStyleData"},{"style":"NORMAL","weight":"300","__typename":"FontStyleData"},{"style":"NORMAL","weight":"600","__typename":"FontStyleData"},{"style":"NORMAL","weight":"700","__typename":"FontStyleData"},{"style":"ITALIC","weight":"400","__typename":"FontStyleData"}],"assetNames":["SegoeUI-normal-400.woff2","SegoeUI-normal-300.woff2","SegoeUI-normal-600.woff2","SegoeUI-normal-700.woff2","SegoeUI-italic-400.woff2"],"__typename":"CustomFont"},{"source":"SERVER","name":"MWF Fluent Icons","styles":[{"style":"NORMAL","weight":"400","__typename":"FontStyleData"}],"assetNames":["MWFFluentIcons-normal-400.woff2"],"__typename":"CustomFont"}],"__typename":"TypographyThemeSettings"},"unstyledListItem":{"marginBottomSm":"5px","marginBottomMd":"10px","marginBottomLg":"15px","marginBottomXl":"20px","marginBottomXxl":"25px","__typename":"UnstyledListItemThemeSettings"},"yiq":{"light":"#ffffff","dark":"#000000","__typename":"YiqThemeSettings"},"colorLightness":{"primaryDark":0.36,"primaryLight":0.74,"primaryLighter":0.89,"primaryLightest":0.95,"infoDark":0.39,"infoLight":0.72,"infoLighter":0.85,"infoLightest":0.93,"successDark":0.24,"successLight":0.62,"successLighter":0.8,"successLightest":0.91,"warningDark":0.39,"warningLight":0.68,"warningLighter":0.84,"warningLightest":0.93,"dangerDark":0.41,"dangerLight":0.72,"dangerLighter":0.89,"dangerLightest":0.95,"__typename":"ColorLightnessThemeSettings"},"localOverride":false,"__typename":"Theme"},"localOverride":false},"CachedAsset:text:en_US-components/common/EmailVerification-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/common/EmailVerification-1743095130000","value":{"email.verification.title":"Email Verification Required","email.verification.message.update.email":"To participate in the community, you must first verify your email address. The verification email was sent to {email}. To change your email, visit My Settings.","email.verification.message.resend.email":"To participate in the community, you must first verify your email address. The verification email was sent to {email}. Resend email."},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/Loading/LoadingDot-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/Loading/LoadingDot-1743095130000","value":{"title":"Loading..."},"localOverride":false},"CachedAsset:quilt:o365.prod:pages/blogs/BlogMessagePage:board:MicrosoftSentinelBlog-1743763623398":{"__typename":"CachedAsset","id":"quilt:o365.prod:pages/blogs/BlogMessagePage:board:MicrosoftSentinelBlog-1743763623398","value":{"id":"BlogMessagePage","container":{"id":"Common","headerProps":{"backgroundImageProps":null,"backgroundColor":null,"addComponents":null,"removeComponents":["community.widget.bannerWidget"],"componentOrder":null,"__typename":"QuiltContainerSectionProps"},"headerComponentProps":{"community.widget.breadcrumbWidget":{"disableLastCrumbForDesktop":false}},"footerProps":null,"footerComponentProps":null,"items":[{"id":"blog-article","layout":"ONE_COLUMN","bgColor":null,"showTitle":null,"showDescription":null,"textPosition":null,"textColor":null,"sectionEditLevel":"LOCKED","bgImage":null,"disableSpacing":null,"edgeToEdgeDisplay":null,"fullHeight":null,"showBorder":null,"__typename":"OneColumnQuiltSection","columnMap":{"main":[{"id":"blogs.widget.blogArticleWidget","className":"lia-blog-container","props":null,"__typename":"QuiltComponent"}],"__typename":"OneSectionColumns"}},{"id":"section-1729184836777","layout":"MAIN_SIDE","bgColor":"transparent","showTitle":false,"showDescription":false,"textPosition":"CENTER","textColor":"var(--lia-bs-body-color)","sectionEditLevel":null,"bgImage":null,"disableSpacing":null,"edgeToEdgeDisplay":null,"fullHeight":null,"showBorder":null,"__typename":"MainSideQuiltSection","columnMap":{"main":[],"side":[{"id":"custom.widget.Social_Sharing","className":null,"props":{"widgetVisibility":"signedInOrAnonymous","useTitle":true,"useBackground":true,"title":"Share","lazyLoad":false},"__typename":"QuiltComponent"}],"__typename":"MainSideSectionColumns"}}],"__typename":"QuiltContainer"},"__typename":"Quilt","localOverride":false},"localOverride":false},"CachedAsset:text:en_US-pages/blogs/BlogMessagePage-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-pages/blogs/BlogMessagePage-1743095130000","value":{"title":"{contextMessageSubject} | {communityTitle}","errorMissing":"This blog post cannot be found","name":"Blog Message Page","section.blog-article.title":"Blog Post","archivedMessageTitle":"This Content Has Been Archived","section.section-1729184836777.title":"","section.section-1729184836777.description":"","section.CncIde.title":"Blog Post","section.tifEmD.description":"","section.tifEmD.title":""},"localOverride":false},"CachedAsset:quiltWrapper:o365.prod:Common:1743763432872":{"__typename":"CachedAsset","id":"quiltWrapper:o365.prod:Common:1743763432872","value":{"id":"Common","header":{"backgroundImageProps":{"assetName":null,"backgroundSize":"COVER","backgroundRepeat":"NO_REPEAT","backgroundPosition":"CENTER_CENTER","lastModified":null,"__typename":"BackgroundImageProps"},"backgroundColor":"transparent","items":[{"id":"community.widget.navbarWidget","props":{"showUserName":true,"showRegisterLink":true,"useIconLanguagePicker":true,"useLabelLanguagePicker":true,"className":"QuiltComponent_lia-component-edit-mode__0nCcm","links":{"sideLinks":[],"mainLinks":[{"children":[],"linkType":"INTERNAL","id":"gxcuf89792","params":{},"routeName":"CommunityPage"},{"children":[],"linkType":"EXTERNAL","id":"external-link","url":"/Directory","target":"SELF"},{"children":[{"linkType":"INTERNAL","id":"microsoft365","params":{"categoryId":"microsoft365"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-teams","params":{"categoryId":"MicrosoftTeams"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"windows","params":{"categoryId":"Windows"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-securityand-compliance","params":{"categoryId":"microsoft-security"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"outlook","params":{"categoryId":"Outlook"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"planner","params":{"categoryId":"Planner"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"windows-server","params":{"categoryId":"Windows-Server"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"azure","params":{"categoryId":"Azure"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"exchange","params":{"categoryId":"Exchange"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-endpoint-manager","params":{"categoryId":"microsoft-endpoint-manager"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"s-q-l-server","params":{"categoryId":"SQL-Server"},"routeName":"CategoryPage"},{"linkType":"EXTERNAL","id":"external-link-2","url":"/Directory","target":"SELF"}],"linkType":"EXTERNAL","id":"communities","url":"/","target":"BLANK"},{"children":[{"linkType":"INTERNAL","id":"education-sector","params":{"categoryId":"EducationSector"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"a-i","params":{"categoryId":"AI"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"i-t-ops-talk","params":{"categoryId":"ITOpsTalk"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"partner-community","params":{"categoryId":"PartnerCommunity"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-mechanics","params":{"categoryId":"MicrosoftMechanics"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"healthcare-and-life-sciences","params":{"categoryId":"HealthcareAndLifeSciences"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"public-sector","params":{"categoryId":"PublicSector"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"io-t","params":{"categoryId":"IoT"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"driving-adoption","params":{"categoryId":"DrivingAdoption"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"s-m-b","params":{"categoryId":"SMB"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"startupsat-microsoft","params":{"categoryId":"StartupsatMicrosoft"},"routeName":"CategoryPage"},{"linkType":"EXTERNAL","id":"external-link-1","url":"/Directory","target":"SELF"}],"linkType":"EXTERNAL","id":"communities-1","url":"/","target":"SELF"},{"children":[],"linkType":"EXTERNAL","id":"external","url":"/Blogs","target":"SELF"},{"children":[],"linkType":"EXTERNAL","id":"external-1","url":"/Events","target":"SELF"},{"children":[{"linkType":"INTERNAL","id":"microsoft-learn-1","params":{"categoryId":"MicrosoftLearn"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-learn-blog","params":{"boardId":"MicrosoftLearnBlog","categoryId":"MicrosoftLearn"},"routeName":"BlogBoardPage"},{"linkType":"EXTERNAL","id":"external-10","url":"https://learningroomdirectory.microsoft.com/","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-3","url":"https://docs.microsoft.com/learn/dynamics365/?WT.mc_id=techcom_header-webpage-m365","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-4","url":"https://docs.microsoft.com/learn/m365/?wt.mc_id=techcom_header-webpage-m365","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-5","url":"https://docs.microsoft.com/learn/topics/sci/?wt.mc_id=techcom_header-webpage-m365","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-6","url":"https://docs.microsoft.com/learn/powerplatform/?wt.mc_id=techcom_header-webpage-powerplatform","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-7","url":"https://docs.microsoft.com/learn/github/?wt.mc_id=techcom_header-webpage-github","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-8","url":"https://docs.microsoft.com/learn/teams/?wt.mc_id=techcom_header-webpage-teams","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-9","url":"https://docs.microsoft.com/learn/dotnet/?wt.mc_id=techcom_header-webpage-dotnet","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-2","url":"https://docs.microsoft.com/learn/azure/?WT.mc_id=techcom_header-webpage-m365","target":"BLANK"}],"linkType":"INTERNAL","id":"microsoft-learn","params":{"categoryId":"MicrosoftLearn"},"routeName":"CategoryPage"},{"children":[],"linkType":"INTERNAL","id":"community-info-center","params":{"categoryId":"Community-Info-Center"},"routeName":"CategoryPage"}]},"style":{"boxShadow":"var(--lia-bs-box-shadow-sm)","controllerHighlightColor":"hsla(30, 100%, 50%)","linkFontWeight":"400","dropdownDividerMarginBottom":"10px","hamburgerBorderHover":"none","linkBoxShadowHover":"none","linkFontSize":"14px","backgroundOpacity":0.8,"controllerBorderRadius":"var(--lia-border-radius-50)","hamburgerBgColor":"transparent","hamburgerColor":"var(--lia-nav-controller-icon-color)","linkTextBorderBottom":"none","brandLogoHeight":"30px","linkBgHoverColor":"transparent","linkLetterSpacing":"normal","collapseMenuDividerOpacity":0.16,"dropdownPaddingBottom":"15px","paddingBottom":"15px","dropdownMenuOffset":"2px","hamburgerBgHoverColor":"transparent","borderBottom":"1px solid var(--lia-bs-border-color)","hamburgerBorder":"none","dropdownPaddingX":"10px","brandMarginRightSm":"10px","linkBoxShadow":"none","collapseMenuDividerBg":"var(--lia-nav-link-color)","linkColor":"var(--lia-bs-body-color)","linkJustifyContent":"flex-start","dropdownPaddingTop":"10px","controllerHighlightTextColor":"var(--lia-yiq-dark)","controllerTextColor":"var(--lia-nav-controller-icon-color)","background":{"imageAssetName":"","color":"var(--lia-bs-white)","size":"COVER","repeat":"NO_REPEAT","position":"CENTER_CENTER","imageLastModified":""},"linkBorderRadius":"var(--lia-bs-border-radius-sm)","linkHoverColor":"var(--lia-bs-body-color)","position":"FIXED","linkBorder":"none","linkTextBorderBottomHover":"2px solid var(--lia-bs-body-color)","brandMarginRight":"30px","hamburgerHoverColor":"var(--lia-nav-controller-icon-color)","linkBorderHover":"none","collapseMenuMarginLeft":"20px","linkFontStyle":"NORMAL","controllerTextHoverColor":"var(--lia-nav-controller-icon-hover-color)","linkPaddingX":"10px","linkPaddingY":"5px","paddingTop":"15px","linkTextTransform":"NONE","dropdownBorderColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","controllerBgHoverColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.1)","linkBgColor":"transparent","linkDropdownPaddingX":"var(--lia-nav-link-px)","linkDropdownPaddingY":"9px","controllerIconColor":"var(--lia-bs-body-color)","dropdownDividerMarginTop":"10px","linkGap":"10px","controllerIconHoverColor":"var(--lia-bs-body-color)"},"showSearchIcon":false,"languagePickerStyle":"iconAndLabel"},"__typename":"QuiltComponent"},{"id":"community.widget.breadcrumbWidget","props":{"backgroundColor":"transparent","linkHighlightColor":"var(--lia-bs-primary)","visualEffects":{"showBottomBorder":true},"linkTextColor":"var(--lia-bs-gray-700)"},"__typename":"QuiltComponent"},{"id":"custom.widget.community_banner","props":{"widgetVisibility":"signedInOrAnonymous","useTitle":true,"usePageWidth":false,"useBackground":false,"title":"","lazyLoad":false},"__typename":"QuiltComponent"},{"id":"custom.widget.HeroBanner","props":{"widgetVisibility":"signedInOrAnonymous","usePageWidth":false,"useTitle":true,"cMax_items":3,"useBackground":false,"title":"","lazyLoad":false,"widgetChooser":"custom.widget.HeroBanner"},"__typename":"QuiltComponent"}],"__typename":"QuiltWrapperSection"},"footer":{"backgroundImageProps":{"assetName":null,"backgroundSize":"COVER","backgroundRepeat":"NO_REPEAT","backgroundPosition":"CENTER_CENTER","lastModified":null,"__typename":"BackgroundImageProps"},"backgroundColor":"transparent","items":[{"id":"custom.widget.MicrosoftFooter","props":{"widgetVisibility":"signedInOrAnonymous","useTitle":true,"useBackground":false,"title":"","lazyLoad":false},"__typename":"QuiltComponent"}],"__typename":"QuiltWrapperSection"},"__typename":"QuiltWrapper","localOverride":false},"localOverride":false},"CachedAsset:text:en_US-components/common/ActionFeedback-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/common/ActionFeedback-1743095130000","value":{"joinedGroupHub.title":"Welcome","joinedGroupHub.message":"You are now a member of this group and are subscribed to updates.","groupHubInviteNotFound.title":"Invitation Not Found","groupHubInviteNotFound.message":"Sorry, we could not find your invitation to the group. The owner may have canceled the invite.","groupHubNotFound.title":"Group Not Found","groupHubNotFound.message":"The grouphub you tried to join does not exist. It may have been deleted.","existingGroupHubMember.title":"Already Joined","existingGroupHubMember.message":"You are already a member of this group.","accountLocked.title":"Account Locked","accountLocked.message":"Your account has been locked due to multiple failed attempts. Try again in {lockoutTime} minutes.","editedGroupHub.title":"Changes Saved","editedGroupHub.message":"Your group has been updated.","leftGroupHub.title":"Goodbye","leftGroupHub.message":"You are no longer a member of this group and will not receive future updates.","deletedGroupHub.title":"Deleted","deletedGroupHub.message":"The group has been deleted.","groupHubCreated.title":"Group Created","groupHubCreated.message":"{groupHubName} is ready to use","accountClosed.title":"Account Closed","accountClosed.message":"The account has been closed and you will now be redirected to the homepage","resetTokenExpired.title":"Reset Password Link has Expired","resetTokenExpired.message":"Try resetting your password again","invalidUrl.title":"Invalid URL","invalidUrl.message":"The URL you're using is not recognized. Verify your URL and try again.","accountClosedForUser.title":"Account Closed","accountClosedForUser.message":"{userName}'s account is closed","inviteTokenInvalid.title":"Invitation Invalid","inviteTokenInvalid.message":"Your invitation to the community has been canceled or expired.","inviteTokenError.title":"Invitation Verification Failed","inviteTokenError.message":"The url you are utilizing is not recognized. Verify your URL and try again","pageNotFound.title":"Access Denied","pageNotFound.message":"You do not have access to this area of the community or it doesn't exist","eventAttending.title":"Responded as Attending","eventAttending.message":"You'll be notified when there's new activity and reminded as the event approaches","eventInterested.title":"Responded as Interested","eventInterested.message":"You'll be notified when there's new activity and reminded as the event approaches","eventNotFound.title":"Event Not Found","eventNotFound.message":"The event you tried to respond to does not exist.","redirectToRelatedPage.title":"Showing Related Content","redirectToRelatedPageForBaseUsers.title":"Showing Related Content","redirectToRelatedPageForBaseUsers.message":"The content you are trying to access is archived","redirectToRelatedPage.message":"The content you are trying to access is archived","relatedUrl.archivalLink.flyoutMessage":"The content you are trying to access is archived View Archived Content"},"localOverride":false},"CachedAsset:component:custom.widget.community_banner-en-1743763658891":{"__typename":"CachedAsset","id":"component:custom.widget.community_banner-en-1743763658891","value":{"component":{"id":"custom.widget.community_banner","template":{"id":"community_banner","markupLanguage":"HANDLEBARS","style":".community-banner {\n a.top-bar.btn {\n top: 0px;\n width: 100%;\n z-index: 999;\n text-align: center;\n left: 0px;\n background: #0068b8;\n color: white;\n padding: 10px 0px;\n display:block;\n box-shadow:none !important;\n border: none !important;\n border-radius: none !important;\n margin: 0px !important;\n font-size:14px;\n }\n}","texts":null,"defaults":{"config":{"applicablePages":[],"description":"community announcement text","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.community_banner","form":null,"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":"community announcement text","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"form":null,"__typename":"Component","localOverride":false},"globalCss":{"css":".custom_widget_community_banner_community-banner_1a5zb_1 {\n a.custom_widget_community_banner_top-bar_1a5zb_2.custom_widget_community_banner_btn_1a5zb_2 {\n top: 0;\n width: 100%;\n z-index: 999;\n text-align: center;\n left: 0;\n background: #0068b8;\n color: white;\n padding: 0.625rem 0;\n display:block;\n box-shadow:none !important;\n border: none !important;\n border-radius: none !important;\n margin: 0 !important;\n font-size:0.875rem;\n }\n}","tokens":{"community-banner":"custom_widget_community_banner_community-banner_1a5zb_1","top-bar":"custom_widget_community_banner_top-bar_1a5zb_2","btn":"custom_widget_community_banner_btn_1a5zb_2"}},"form":null},"localOverride":false},"CachedAsset:component:custom.widget.HeroBanner-en-1743763658891":{"__typename":"CachedAsset","id":"component:custom.widget.HeroBanner-en-1743763658891","value":{"component":{"id":"custom.widget.HeroBanner","template":{"id":"HeroBanner","markupLanguage":"REACT","style":null,"texts":{"searchPlaceholderText":"Search this community","followActionText":"Follow","unfollowActionText":"Following","searchOnHoverText":"Please enter your search term(s) and then press return key to complete a search."},"defaults":{"config":{"applicablePages":[],"description":null,"fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[{"id":"max_items","dataType":"NUMBER","list":false,"defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"control":"INPUT","__typename":"PropDefinition"}],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.HeroBanner","form":{"fields":[{"id":"widgetChooser","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"title","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useTitle","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useBackground","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"widgetVisibility","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"moreOptions","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"cMax_items","validation":null,"noValidation":null,"dataType":"NUMBER","list":false,"control":"INPUT","defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"__typename":"FormField"}],"layout":{"rows":[{"id":"widgetChooserGroup","type":"fieldset","as":null,"items":[{"id":"widgetChooser","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"titleGroup","type":"fieldset","as":null,"items":[{"id":"title","className":null,"__typename":"FormFieldRef"},{"id":"useTitle","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"useBackground","type":"fieldset","as":null,"items":[{"id":"useBackground","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"widgetVisibility","type":"fieldset","as":null,"items":[{"id":"widgetVisibility","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"moreOptionsGroup","type":"fieldset","as":null,"items":[{"id":"moreOptions","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"componentPropsGroup","type":"fieldset","as":null,"items":[{"id":"cMax_items","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"}],"actionButtons":null,"className":"custom_widget_HeroBanner_form","formGroupFieldSeparator":"divider","__typename":"FormLayout"},"__typename":"Form"},"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":null,"fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[{"id":"max_items","dataType":"NUMBER","list":false,"defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"control":"INPUT","__typename":"PropDefinition"}],"__typename":"ComponentProperties"},"form":{"fields":[{"id":"widgetChooser","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"title","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useTitle","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useBackground","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"widgetVisibility","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"moreOptions","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"cMax_items","validation":null,"noValidation":null,"dataType":"NUMBER","list":false,"control":"INPUT","defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"__typename":"FormField"}],"layout":{"rows":[{"id":"widgetChooserGroup","type":"fieldset","as":null,"items":[{"id":"widgetChooser","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"titleGroup","type":"fieldset","as":null,"items":[{"id":"title","className":null,"__typename":"FormFieldRef"},{"id":"useTitle","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"useBackground","type":"fieldset","as":null,"items":[{"id":"useBackground","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"widgetVisibility","type":"fieldset","as":null,"items":[{"id":"widgetVisibility","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"moreOptionsGroup","type":"fieldset","as":null,"items":[{"id":"moreOptions","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"componentPropsGroup","type":"fieldset","as":null,"items":[{"id":"cMax_items","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"}],"actionButtons":null,"className":"custom_widget_HeroBanner_form","formGroupFieldSeparator":"divider","__typename":"FormLayout"},"__typename":"Form"},"__typename":"Component","localOverride":false},"globalCss":null,"form":{"fields":[{"id":"widgetChooser","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"title","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useTitle","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useBackground","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"widgetVisibility","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"moreOptions","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"cMax_items","validation":null,"noValidation":null,"dataType":"NUMBER","list":false,"control":"INPUT","defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"__typename":"FormField"}],"layout":{"rows":[{"id":"widgetChooserGroup","type":"fieldset","as":null,"items":[{"id":"widgetChooser","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"titleGroup","type":"fieldset","as":null,"items":[{"id":"title","className":null,"__typename":"FormFieldRef"},{"id":"useTitle","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"useBackground","type":"fieldset","as":null,"items":[{"id":"useBackground","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"widgetVisibility","type":"fieldset","as":null,"items":[{"id":"widgetVisibility","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"moreOptionsGroup","type":"fieldset","as":null,"items":[{"id":"moreOptions","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"componentPropsGroup","type":"fieldset","as":null,"items":[{"id":"cMax_items","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"}],"actionButtons":null,"className":"custom_widget_HeroBanner_form","formGroupFieldSeparator":"divider","__typename":"FormLayout"},"__typename":"Form"}},"localOverride":false},"CachedAsset:component:custom.widget.Social_Sharing-en-1743763658891":{"__typename":"CachedAsset","id":"component:custom.widget.Social_Sharing-en-1743763658891","value":{"component":{"id":"custom.widget.Social_Sharing","template":{"id":"Social_Sharing","markupLanguage":"HANDLEBARS","style":".social-share {\n .sharing-options {\n position: relative;\n margin: 0;\n padding: 0;\n line-height: 10px;\n display: flex;\n justify-content: left;\n gap: 5px;\n list-style-type: none;\n li {\n text-align: left;\n a {\n min-width: 30px;\n min-height: 30px;\n display: block;\n padding: 1px;\n .social-share-linkedin {\n img {\n background-color: rgb(0, 119, 181);\n }\n }\n .social-share-facebook {\n img {\n background-color: rgb(59, 89, 152);\n }\n }\n .social-share-x {\n img {\n background-color: rgb(0, 0, 0);\n }\n }\n .social-share-rss {\n img {\n background-color: rgb(0, 0, 0);\n }\n }\n .social-share-reddit {\n img {\n background-color: rgb(255, 69, 0);\n }\n }\n .social-share-email {\n img {\n background-color: rgb(132, 132, 132);\n }\n }\n }\n a {\n img {\n height: 2rem;\n }\n }\n }\n }\n}\n","texts":null,"defaults":{"config":{"applicablePages":[],"description":"Adds buttons to share to various social media websites","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.Social_Sharing","form":null,"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":"Adds buttons to share to various social media websites","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"form":null,"__typename":"Component","localOverride":false},"globalCss":{"css":".custom_widget_Social_Sharing_social-share_c7xxz_1 {\n .custom_widget_Social_Sharing_sharing-options_c7xxz_2 {\n position: relative;\n margin: 0;\n padding: 0;\n line-height: 0.625rem;\n display: flex;\n justify-content: left;\n gap: 0.3125rem;\n list-style-type: none;\n li {\n text-align: left;\n a {\n min-width: 1.875rem;\n min-height: 1.875rem;\n display: block;\n padding: 0.0625rem;\n .custom_widget_Social_Sharing_social-share-linkedin_c7xxz_18 {\n img {\n background-color: rgb(0, 119, 181);\n }\n }\n .custom_widget_Social_Sharing_social-share-facebook_c7xxz_23 {\n img {\n background-color: rgb(59, 89, 152);\n }\n }\n .custom_widget_Social_Sharing_social-share-x_c7xxz_28 {\n img {\n background-color: rgb(0, 0, 0);\n }\n }\n .custom_widget_Social_Sharing_social-share-rss_c7xxz_33 {\n img {\n background-color: rgb(0, 0, 0);\n }\n }\n .custom_widget_Social_Sharing_social-share-reddit_c7xxz_38 {\n img {\n background-color: rgb(255, 69, 0);\n }\n }\n .custom_widget_Social_Sharing_social-share-email_c7xxz_43 {\n img {\n background-color: rgb(132, 132, 132);\n }\n }\n }\n a {\n img {\n height: 2rem;\n }\n }\n }\n }\n}\n","tokens":{"social-share":"custom_widget_Social_Sharing_social-share_c7xxz_1","sharing-options":"custom_widget_Social_Sharing_sharing-options_c7xxz_2","social-share-linkedin":"custom_widget_Social_Sharing_social-share-linkedin_c7xxz_18","social-share-facebook":"custom_widget_Social_Sharing_social-share-facebook_c7xxz_23","social-share-x":"custom_widget_Social_Sharing_social-share-x_c7xxz_28","social-share-rss":"custom_widget_Social_Sharing_social-share-rss_c7xxz_33","social-share-reddit":"custom_widget_Social_Sharing_social-share-reddit_c7xxz_38","social-share-email":"custom_widget_Social_Sharing_social-share-email_c7xxz_43"}},"form":null},"localOverride":false},"CachedAsset:component:custom.widget.MicrosoftFooter-en-1743763658891":{"__typename":"CachedAsset","id":"component:custom.widget.MicrosoftFooter-en-1743763658891","value":{"component":{"id":"custom.widget.MicrosoftFooter","template":{"id":"MicrosoftFooter","markupLanguage":"HANDLEBARS","style":".context-uhf {\n min-width: 280px;\n font-size: 15px;\n box-sizing: border-box;\n -ms-text-size-adjust: 100%;\n -webkit-text-size-adjust: 100%;\n & *,\n & *:before,\n & *:after {\n box-sizing: inherit;\n }\n a.c-uhff-link {\n color: #616161;\n word-break: break-word;\n text-decoration: none;\n }\n &a:link,\n &a:focus,\n &a:hover,\n &a:active,\n &a:visited {\n text-decoration: none;\n color: inherit;\n }\n & div {\n font-family: 'Segoe UI', SegoeUI, 'Helvetica Neue', Helvetica, Arial, sans-serif;\n }\n}\n.c-uhff {\n background: #f2f2f2;\n margin: -1.5625;\n width: auto;\n height: auto;\n}\n.c-uhff-nav {\n margin: 0 auto;\n max-width: calc(1600px + 10%);\n padding: 0 5%;\n box-sizing: inherit;\n &:before,\n &:after {\n content: ' ';\n display: table;\n clear: left;\n }\n @media only screen and (max-width: 1083px) {\n padding-left: 12px;\n }\n .c-heading-4 {\n color: #616161;\n word-break: break-word;\n font-size: 15px;\n line-height: 20px;\n padding: 36px 0 4px;\n font-weight: 600;\n }\n .c-uhff-nav-row {\n .c-uhff-nav-group {\n display: block;\n float: left;\n min-height: 1px;\n vertical-align: text-top;\n padding: 0 12px;\n width: 100%;\n zoom: 1;\n &:first-child {\n padding-left: 0;\n @media only screen and (max-width: 1083px) {\n padding-left: 12px;\n }\n }\n @media only screen and (min-width: 540px) and (max-width: 1082px) {\n width: 33.33333%;\n }\n @media only screen and (min-width: 1083px) {\n width: 16.6666666667%;\n }\n ul.c-list.f-bare {\n font-size: 11px;\n line-height: 16px;\n margin-top: 0;\n margin-bottom: 0;\n padding-left: 0;\n list-style-type: none;\n li {\n word-break: break-word;\n padding: 8px 0;\n margin: 0;\n }\n }\n }\n }\n}\n.c-uhff-base {\n background: #f2f2f2;\n margin: 0 auto;\n max-width: calc(1600px + 10%);\n padding: 30px 5% 16px;\n &:before,\n &:after {\n content: ' ';\n display: table;\n }\n &:after {\n clear: both;\n }\n a.c-uhff-ccpa {\n font-size: 11px;\n line-height: 16px;\n float: left;\n margin: 3px 0;\n }\n a.c-uhff-ccpa:hover {\n text-decoration: underline;\n }\n ul.c-list {\n font-size: 11px;\n line-height: 16px;\n float: right;\n margin: 3px 0;\n color: #616161;\n li {\n padding: 0 24px 4px 0;\n display: inline-block;\n }\n }\n .c-list.f-bare {\n padding-left: 0;\n list-style-type: none;\n }\n @media only screen and (max-width: 1083px) {\n display: flex;\n flex-wrap: wrap;\n padding: 30px 24px 16px;\n }\n}\n","texts":{"New tab":"What's New","New 1":"Surface Laptop Studio 2","New 2":"Surface Laptop Go 3","New 3":"Surface Pro 9","New 4":"Surface Laptop 5","New 5":"Surface Studio 2+","New 6":"Copilot in Windows","New 7":"Microsoft 365","New 8":"Windows 11 apps","Store tab":"Microsoft Store","Store 1":"Account Profile","Store 2":"Download Center","Store 3":"Microsoft Store Support","Store 4":"Returns","Store 5":"Order tracking","Store 6":"Certified Refurbished","Store 7":"Microsoft Store Promise","Store 8":"Flexible Payments","Education tab":"Education","Edu 1":"Microsoft in education","Edu 2":"Devices for education","Edu 3":"Microsoft Teams for Education","Edu 4":"Microsoft 365 Education","Edu 5":"How to buy for your school","Edu 6":"Educator Training and development","Edu 7":"Deals for students and parents","Edu 8":"Azure for students","Business tab":"Business","Bus 1":"Microsoft Cloud","Bus 2":"Microsoft Security","Bus 3":"Dynamics 365","Bus 4":"Microsoft 365","Bus 5":"Microsoft Power Platform","Bus 6":"Microsoft Teams","Bus 7":"Microsoft Industry","Bus 8":"Small Business","Developer tab":"Developer & IT","Dev 1":"Azure","Dev 2":"Developer Center","Dev 3":"Documentation","Dev 4":"Microsoft Learn","Dev 5":"Microsoft Tech Community","Dev 6":"Azure Marketplace","Dev 7":"AppSource","Dev 8":"Visual Studio","Company tab":"Company","Com 1":"Careers","Com 2":"About Microsoft","Com 3":"Company News","Com 4":"Privacy at Microsoft","Com 5":"Investors","Com 6":"Diversity and inclusion","Com 7":"Accessiblity","Com 8":"Sustainibility"},"defaults":{"config":{"applicablePages":[],"description":"The Microsoft Footer","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.MicrosoftFooter","form":null,"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":"The Microsoft Footer","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"form":null,"__typename":"Component","localOverride":false},"globalCss":{"css":".custom_widget_MicrosoftFooter_context-uhf_f95yq_1 {\n min-width: 17.5rem;\n font-size: 0.9375rem;\n box-sizing: border-box;\n -ms-text-size-adjust: 100%;\n -webkit-text-size-adjust: 100%;\n & *,\n & *:before,\n & *:after {\n box-sizing: inherit;\n }\n a.custom_widget_MicrosoftFooter_c-uhff-link_f95yq_12 {\n color: #616161;\n word-break: break-word;\n text-decoration: none;\n }\n &a:link,\n &a:focus,\n &a:hover,\n &a:active,\n &a:visited {\n text-decoration: none;\n color: inherit;\n }\n & div {\n font-family: 'Segoe UI', SegoeUI, 'Helvetica Neue', Helvetica, Arial, sans-serif;\n }\n}\n.custom_widget_MicrosoftFooter_c-uhff_f95yq_12 {\n background: #f2f2f2;\n margin: -1.5625;\n width: auto;\n height: auto;\n}\n.custom_widget_MicrosoftFooter_c-uhff-nav_f95yq_35 {\n margin: 0 auto;\n max-width: calc(100rem + 10%);\n padding: 0 5%;\n box-sizing: inherit;\n &:before,\n &:after {\n content: ' ';\n display: table;\n clear: left;\n }\n @media only screen and (max-width: 1083px) {\n padding-left: 0.75rem;\n }\n .custom_widget_MicrosoftFooter_c-heading-4_f95yq_49 {\n color: #616161;\n word-break: break-word;\n font-size: 0.9375rem;\n line-height: 1.25rem;\n padding: 2.25rem 0 0.25rem;\n font-weight: 600;\n }\n .custom_widget_MicrosoftFooter_c-uhff-nav-row_f95yq_57 {\n .custom_widget_MicrosoftFooter_c-uhff-nav-group_f95yq_58 {\n display: block;\n float: left;\n min-height: 0.0625rem;\n vertical-align: text-top;\n padding: 0 0.75rem;\n width: 100%;\n zoom: 1;\n &:first-child {\n padding-left: 0;\n @media only screen and (max-width: 1083px) {\n padding-left: 0.75rem;\n }\n }\n @media only screen and (min-width: 540px) and (max-width: 1082px) {\n width: 33.33333%;\n }\n @media only screen and (min-width: 1083px) {\n width: 16.6666666667%;\n }\n ul.custom_widget_MicrosoftFooter_c-list_f95yq_78.custom_widget_MicrosoftFooter_f-bare_f95yq_78 {\n font-size: 0.6875rem;\n line-height: 1rem;\n margin-top: 0;\n margin-bottom: 0;\n padding-left: 0;\n list-style-type: none;\n li {\n word-break: break-word;\n padding: 0.5rem 0;\n margin: 0;\n }\n }\n }\n }\n}\n.custom_widget_MicrosoftFooter_c-uhff-base_f95yq_94 {\n background: #f2f2f2;\n margin: 0 auto;\n max-width: calc(100rem + 10%);\n padding: 1.875rem 5% 1rem;\n &:before,\n &:after {\n content: ' ';\n display: table;\n }\n &:after {\n clear: both;\n }\n a.custom_widget_MicrosoftFooter_c-uhff-ccpa_f95yq_107 {\n font-size: 0.6875rem;\n line-height: 1rem;\n float: left;\n margin: 0.1875rem 0;\n }\n a.custom_widget_MicrosoftFooter_c-uhff-ccpa_f95yq_107:hover {\n text-decoration: underline;\n }\n ul.custom_widget_MicrosoftFooter_c-list_f95yq_78 {\n font-size: 0.6875rem;\n line-height: 1rem;\n float: right;\n margin: 0.1875rem 0;\n color: #616161;\n li {\n padding: 0 1.5rem 0.25rem 0;\n display: inline-block;\n }\n }\n .custom_widget_MicrosoftFooter_c-list_f95yq_78.custom_widget_MicrosoftFooter_f-bare_f95yq_78 {\n padding-left: 0;\n list-style-type: none;\n }\n @media only screen and (max-width: 1083px) {\n display: flex;\n flex-wrap: wrap;\n padding: 1.875rem 1.5rem 1rem;\n }\n}\n","tokens":{"context-uhf":"custom_widget_MicrosoftFooter_context-uhf_f95yq_1","c-uhff-link":"custom_widget_MicrosoftFooter_c-uhff-link_f95yq_12","c-uhff":"custom_widget_MicrosoftFooter_c-uhff_f95yq_12","c-uhff-nav":"custom_widget_MicrosoftFooter_c-uhff-nav_f95yq_35","c-heading-4":"custom_widget_MicrosoftFooter_c-heading-4_f95yq_49","c-uhff-nav-row":"custom_widget_MicrosoftFooter_c-uhff-nav-row_f95yq_57","c-uhff-nav-group":"custom_widget_MicrosoftFooter_c-uhff-nav-group_f95yq_58","c-list":"custom_widget_MicrosoftFooter_c-list_f95yq_78","f-bare":"custom_widget_MicrosoftFooter_f-bare_f95yq_78","c-uhff-base":"custom_widget_MicrosoftFooter_c-uhff-base_f95yq_94","c-uhff-ccpa":"custom_widget_MicrosoftFooter_c-uhff-ccpa_f95yq_107"}},"form":null},"localOverride":false},"CachedAsset:text:en_US-components/community/Breadcrumb-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/community/Breadcrumb-1743095130000","value":{"navLabel":"Breadcrumbs","dropdown":"Additional parent page navigation"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageBanner-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageBanner-1743095130000","value":{"messageMarkedAsSpam":"This post has been marked as spam","messageMarkedAsSpam@board:TKB":"This article has been marked as spam","messageMarkedAsSpam@board:BLOG":"This post has been marked as spam","messageMarkedAsSpam@board:FORUM":"This discussion has been marked as spam","messageMarkedAsSpam@board:OCCASION":"This event has been marked as spam","messageMarkedAsSpam@board:IDEA":"This idea has been marked as spam","manageSpam":"Manage Spam","messageMarkedAsAbuse":"This post has been marked as abuse","messageMarkedAsAbuse@board:TKB":"This article has been marked as abuse","messageMarkedAsAbuse@board:BLOG":"This post has been marked as abuse","messageMarkedAsAbuse@board:FORUM":"This discussion has been marked as abuse","messageMarkedAsAbuse@board:OCCASION":"This event has been marked as abuse","messageMarkedAsAbuse@board:IDEA":"This idea has been marked as abuse","preModCommentAuthorText":"This comment will be published as soon as it is approved","preModCommentModeratorText":"This comment is awaiting moderation","messageMarkedAsOther":"This post has been rejected due to other reasons","messageMarkedAsOther@board:TKB":"This article has been rejected due to other reasons","messageMarkedAsOther@board:BLOG":"This post has been rejected due to other reasons","messageMarkedAsOther@board:FORUM":"This discussion has been rejected due to other reasons","messageMarkedAsOther@board:OCCASION":"This event has been rejected due to other reasons","messageMarkedAsOther@board:IDEA":"This idea has been rejected due to other reasons","messageArchived":"This post was archived on {date}","relatedUrl":"View Related Content","relatedContentText":"Showing related content","archivedContentLink":"View Archived Content"},"localOverride":false},"Category:category:Exchange":{"__typename":"Category","id":"category:Exchange","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Planner":{"__typename":"Category","id":"category:Planner","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Outlook":{"__typename":"Category","id":"category:Outlook","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Community-Info-Center":{"__typename":"Category","id":"category:Community-Info-Center","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:EducationSector":{"__typename":"Category","id":"category:EducationSector","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:DrivingAdoption":{"__typename":"Category","id":"category:DrivingAdoption","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Azure":{"__typename":"Category","id":"category:Azure","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Windows-Server":{"__typename":"Category","id":"category:Windows-Server","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:SQL-Server":{"__typename":"Category","id":"category:SQL-Server","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftTeams":{"__typename":"Category","id":"category:MicrosoftTeams","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:PublicSector":{"__typename":"Category","id":"category:PublicSector","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:microsoft365":{"__typename":"Category","id":"category:microsoft365","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:IoT":{"__typename":"Category","id":"category:IoT","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:HealthcareAndLifeSciences":{"__typename":"Category","id":"category:HealthcareAndLifeSciences","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:SMB":{"__typename":"Category","id":"category:SMB","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:ITOpsTalk":{"__typename":"Category","id":"category:ITOpsTalk","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:microsoft-endpoint-manager":{"__typename":"Category","id":"category:microsoft-endpoint-manager","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftLearn":{"__typename":"Category","id":"category:MicrosoftLearn","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Blog:board:MicrosoftLearnBlog":{"__typename":"Blog","id":"board:MicrosoftLearnBlog","blogPolicies":{"__typename":"BlogPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}},"boardPolicies":{"__typename":"BoardPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:AI":{"__typename":"Category","id":"category:AI","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftMechanics":{"__typename":"Category","id":"category:MicrosoftMechanics","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:StartupsatMicrosoft":{"__typename":"Category","id":"category:StartupsatMicrosoft","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:PartnerCommunity":{"__typename":"Category","id":"category:PartnerCommunity","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Windows":{"__typename":"Category","id":"category:Windows","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"QueryVariables:TopicReplyList:message:3866030:15":{"__typename":"QueryVariables","id":"TopicReplyList:message:3866030:15","value":{"id":"message:3866030","first":10,"sorts":{"postTime":{"direction":"DESC"}},"repliesFirst":3,"repliesFirstDepthThree":1,"repliesSorts":{"postTime":{"direction":"DESC"}},"useAvatar":true,"useAuthorLogin":true,"useAuthorRank":true,"useBody":true,"useKudosCount":true,"useTimeToRead":false,"useMedia":false,"useReadOnlyIcon":false,"useRepliesCount":true,"useSearchSnippet":false,"useAcceptedSolutionButton":false,"useSolvedBadge":false,"useAttachments":false,"attachmentsFirst":5,"useTags":true,"useNodeAncestors":false,"useUserHoverCard":false,"useNodeHoverCard":false,"useModerationStatus":true,"usePreviewSubjectModal":false,"useMessageStatus":true}},"ROOT_MUTATION":{"__typename":"Mutation"},"CachedAsset:text:en_US-components/community/Navbar-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/community/Navbar-1743095130000","value":{"community":"Community Home","inbox":"Inbox","manageContent":"Manage Content","tos":"Terms of Service","forgotPassword":"Forgot Password","themeEditor":"Theme Editor","edit":"Edit Navigation Bar","skipContent":"Skip to content","gxcuf89792":"Tech Community","external-1":"Events","s-m-b":"Small and Medium Businesses","windows-server":"Windows Server","education-sector":"Education Sector","driving-adoption":"Driving Adoption","microsoft-learn":"Microsoft Learn","s-q-l-server":"SQL Server","partner-community":"Microsoft Partner Community","microsoft365":"Microsoft 365","external-9":".NET","external-8":"Teams","external-7":"Github","products-services":"Products","external-6":"Power Platform","communities-1":"Topics","external-5":"Microsoft Security","planner":"Planner","external-4":"Microsoft 365","external-3":"Dynamics 365","azure":"Azure","healthcare-and-life-sciences":"Healthcare and Life Sciences","external-2":"Azure","microsoft-mechanics":"Microsoft Mechanics","microsoft-learn-1":"Community","external-10":"Learning Room Directory","microsoft-learn-blog":"Blog","windows":"Windows","i-t-ops-talk":"ITOps Talk","external-link-1":"View All","microsoft-securityand-compliance":"Microsoft Security","public-sector":"Public Sector","community-info-center":"Lounge","external-link-2":"View All","microsoft-teams":"Microsoft Teams","external":"Blogs","microsoft-endpoint-manager":"Microsoft Intune and Configuration Manager","startupsat-microsoft":"Startups at Microsoft","exchange":"Exchange","a-i":"AI and Machine Learning","io-t":"Internet of Things (IoT)","outlook":"Outlook","external-link":"Community Hubs","communities":"Products"},"localOverride":false},"CachedAsset:text:en_US-components/community/NavbarHamburgerDropdown-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarHamburgerDropdown-1743095130000","value":{"hamburgerLabel":"Side Menu"},"localOverride":false},"CachedAsset:text:en_US-components/community/BrandLogo-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/community/BrandLogo-1743095130000","value":{"logoAlt":"Khoros","themeLogoAlt":"Brand Logo"},"localOverride":false},"CachedAsset:text:en_US-components/community/NavbarTextLinks-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarTextLinks-1743095130000","value":{"more":"More"},"localOverride":false},"CachedAsset:text:en_US-components/authentication/AuthenticationLink-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/authentication/AuthenticationLink-1743095130000","value":{"title.login":"Sign In","title.registration":"Register","title.forgotPassword":"Forgot Password","title.multiAuthLogin":"Sign In"},"localOverride":false},"CachedAsset:text:en_US-components/nodes/NodeLink-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/nodes/NodeLink-1743095130000","value":{"place":"Place {name}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageView/MessageViewStandard-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageView/MessageViewStandard-1743095130000","value":{"anonymous":"Anonymous","author":"{messageAuthorLogin}","authorBy":"{messageAuthorLogin}","board":"{messageBoardTitle}","replyToUser":" to {parentAuthor}","showMoreReplies":"Show More","replyText":"Reply","repliesText":"Replies","markedAsSolved":"Marked as Solved","movedMessagePlaceholder.BLOG":"{count, plural, =0 {This comment has been} other {These comments have been} }","movedMessagePlaceholder.TKB":"{count, plural, =0 {This comment has been} other {These comments have been} }","movedMessagePlaceholder.FORUM":"{count, plural, =0 {This reply has been} other {These replies have been} }","movedMessagePlaceholder.IDEA":"{count, plural, =0 {This comment has been} other {These comments have been} }","movedMessagePlaceholder.OCCASION":"{count, plural, =0 {This comment has been} other {These comments have been} }","movedMessagePlaceholderUrlText":"moved.","messageStatus":"Status: ","statusChanged":"Status changed: {previousStatus} to {currentStatus}","statusAdded":"Status added: {status}","statusRemoved":"Status removed: {status}","labelExpand":"expand replies","labelCollapse":"collapse replies","unhelpfulReason.reason1":"Content is outdated","unhelpfulReason.reason2":"Article is missing information","unhelpfulReason.reason3":"Content is for a different Product","unhelpfulReason.reason4":"Doesn't match what I was searching for"},"localOverride":false},"CachedAsset:text:en_US-components/messages/ThreadedReplyList-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/ThreadedReplyList-1743095130000","value":{"title":"{count, plural, one{# Reply} other{# Replies}}","title@board:BLOG":"{count, plural, one{# Comment} other{# Comments}}","title@board:TKB":"{count, plural, one{# Comment} other{# Comments}}","title@board:IDEA":"{count, plural, one{# Comment} other{# Comments}}","title@board:OCCASION":"{count, plural, one{# Comment} other{# Comments}}","noRepliesTitle":"No Replies","noRepliesTitle@board:BLOG":"No Comments","noRepliesTitle@board:TKB":"No Comments","noRepliesTitle@board:IDEA":"No Comments","noRepliesTitle@board:OCCASION":"No Comments","noRepliesDescription":"Be the first to reply","noRepliesDescription@board:BLOG":"Be the first to comment","noRepliesDescription@board:TKB":"Be the first to comment","noRepliesDescription@board:IDEA":"Be the first to comment","noRepliesDescription@board:OCCASION":"Be the first to comment","messageReadOnlyAlert:BLOG":"Comments have been turned off for this post","messageReadOnlyAlert:TKB":"Comments have been turned off for this article","messageReadOnlyAlert:IDEA":"Comments have been turned off for this idea","messageReadOnlyAlert:FORUM":"Replies have been turned off for this discussion","messageReadOnlyAlert:OCCASION":"Comments have been turned off for this event"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageReplyCallToAction-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageReplyCallToAction-1743095130000","value":{"leaveReply":"Leave a reply...","leaveReply@board:BLOG@message:root":"Leave a comment...","leaveReply@board:TKB@message:root":"Leave a comment...","leaveReply@board:IDEA@message:root":"Leave a comment...","leaveReply@board:OCCASION@message:root":"Leave a comment...","repliesTurnedOff.FORUM":"Replies are turned off for this topic","repliesTurnedOff.BLOG":"Comments are turned off for this topic","repliesTurnedOff.TKB":"Comments are turned off for this topic","repliesTurnedOff.IDEA":"Comments are turned off for this topic","repliesTurnedOff.OCCASION":"Comments are turned off for this topic","infoText":"Stop poking me!"},"localOverride":false},"Rank:rank:32":{"__typename":"Rank","id":"rank:32","position":13,"name":"Silver Contributor","color":"333333","icon":null,"rankStyle":"TEXT"},"User:user:1096":{"__typename":"User","id":"user:1096","uid":1096,"login":"Dean_Gross","biography":null,"registrationData":{"__typename":"RegistrationData","status":null,"registrationTime":"2016-07-15T11:31:53.335-07:00"},"deleted":false,"email":"","avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0xMDk2LTU2M2k5OEQyOTdGNEU5QzI2N0I5"},"rank":{"__ref":"Rank:rank:32"},"entityType":"USER","eventPath":"community:gxcuf89792/user:1096"},"ModerationData:moderation_data:3875368":{"__typename":"ModerationData","id":"moderation_data:3875368","status":"APPROVED","rejectReason":null,"isReportedAbuse":false,"rejectUser":null,"rejectTime":null,"rejectActorType":null},"BlogReplyMessage:message:3875368":{"__typename":"BlogReplyMessage","author":{"__ref":"User:user:1096"},"id":"message:3875368","revisionNum":1,"uid":3875368,"depth":1,"hasGivenKudo":false,"subscribed":false,"board":{"__ref":"Blog:board:MicrosoftSentinelBlog"},"parent":{"__ref":"BlogTopicMessage:message:3866030"},"conversation":{"__ref":"Conversation:conversation:3866030"},"subject":"Re: Future Proof your SOC with the Power of the Azure Ecosystem and Defender Threat Intelligence","moderationData":{"__ref":"ModerationData:moderation_data:3875368"},"body":"
","body@stripHtml({\"removeProcessingText\":false,\"removeSpoilerMarkup\":false,\"removeTocMarkup\":false,\"truncateLength\":200})@stringLength":"147","kudosSumWeight":0,"repliesCount":0,"postTime":"2023-07-15T14:07:14.605-07:00","lastPublishTime":"2023-07-15T14:07:14.605-07:00","metrics":{"__typename":"MessageMetrics","views":2870},"visibilityScope":"PUBLIC","placeholder":false,"originalMessageForPlaceholder":null,"entityType":"BLOG_REPLY","eventPath":"category:microsoft-sentinel/category:microsoft-security/category:products-services/category:communities/community:gxcuf89792board:MicrosoftSentinelBlog/message:3866030/message:3875368","replies":{"__typename":"MessageConnection","pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null},"edges":[]},"attachments":{"__typename":"AttachmentConnection","edges":[],"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"customFields":[]},"Rank:rank:37":{"__typename":"Rank","id":"rank:37","position":18,"name":"Copper Contributor","color":"333333","icon":null,"rankStyle":"TEXT"},"User:user:578735":{"__typename":"User","id":"user:578735","uid":578735,"login":"Lance_Peterson","biography":null,"registrationData":{"__typename":"RegistrationData","status":null,"registrationTime":"2020-03-10T13:13:07.945-07:00"},"deleted":false,"email":"","avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/m_assets/avatars/default/avatar-7.svg?time=0"},"rank":{"__ref":"Rank:rank:37"},"entityType":"USER","eventPath":"community:gxcuf89792/user:578735"},"ModerationData:moderation_data:3874083":{"__typename":"ModerationData","id":"moderation_data:3874083","status":"APPROVED","rejectReason":null,"isReportedAbuse":false,"rejectUser":null,"rejectTime":null,"rejectActorType":null},"BlogReplyMessage:message:3874083":{"__typename":"BlogReplyMessage","author":{"__ref":"User:user:578735"},"id":"message:3874083","revisionNum":1,"uid":3874083,"depth":1,"hasGivenKudo":false,"subscribed":false,"board":{"__ref":"Blog:board:MicrosoftSentinelBlog"},"parent":{"__ref":"BlogTopicMessage:message:3866030"},"conversation":{"__ref":"Conversation:conversation:3866030"},"subject":"Re: Future Proof your SOC with the Power of the Azure Ecosystem and Defender Threat Intelligence","moderationData":{"__ref":"ModerationData:moderation_data:3874083"},"body":"
If a group is satisfied with cost related to ingest into Sentinel with the included 90 days of retention but wants longer term storage, like 1 year, how would they leverage ADX for that? How would you export Sentinel logs, just prior to them dropping due to retention limits, into ADX?
Or would it just make more sense to retain them via Azure Monitor that is part of Sentinel? In that case I am assuming that this ADX solution is really about limiting ingest charges on the front end and less about the retention cost?
","body@stripHtml({\"removeProcessingText\":false,\"removeSpoilerMarkup\":false,\"removeTocMarkup\":false,\"truncateLength\":200})@stringLength":"208","kudosSumWeight":0,"repliesCount":0,"postTime":"2023-07-13T15:00:50.097-07:00","lastPublishTime":"2023-07-13T15:00:50.097-07:00","metrics":{"__typename":"MessageMetrics","views":3112},"visibilityScope":"PUBLIC","placeholder":false,"originalMessageForPlaceholder":null,"entityType":"BLOG_REPLY","eventPath":"category:microsoft-sentinel/category:microsoft-security/category:products-services/category:communities/community:gxcuf89792board:MicrosoftSentinelBlog/message:3866030/message:3874083","replies":{"__typename":"MessageConnection","pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null},"edges":[]},"attachments":{"__typename":"AttachmentConnection","edges":[],"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"customFields":[]},"CachedAsset:text:en_US-components/community/NavbarDropdownToggle-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarDropdownToggle-1743095130000","value":{"ariaLabelClosed":"Press the down arrow to open the menu"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/QueryHandler-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/QueryHandler-1743095130000","value":{"title":"Query Handler"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageCoverImage-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageCoverImage-1743095130000","value":{"coverImageTitle":"Cover Image"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/nodes/NodeTitle-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/nodes/NodeTitle-1743095130000","value":{"nodeTitle":"{nodeTitle, select, community {Community} other {{nodeTitle}}} "},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageTimeToRead-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageTimeToRead-1743095130000","value":{"minReadText":"{min} MIN READ"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageSubject-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageSubject-1743095130000","value":{"noSubject":"(no subject)"},"localOverride":false},"CachedAsset:text:en_US-components/users/UserLink-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/users/UserLink-1743095130000","value":{"authorName":"View Profile: {author}","anonymous":"Anonymous"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/users/UserRank-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/users/UserRank-1743095130000","value":{"rankName":"{rankName}","userRank":"Author rank {rankName}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageTime-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageTime-1743095130000","value":{"postTime":"Published: {time}","lastPublishTime":"Last Update: {time}","conversation.lastPostingActivityTime":"Last posting activity time: {time}","conversation.lastPostTime":"Last post time: {time}","moderationData.rejectTime":"Rejected time: {time}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageBody-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageBody-1743095130000","value":{"showMessageBody":"Show More","mentionsErrorTitle":"{mentionsType, select, board {Board} user {User} message {Message} other {}} No Longer Available","mentionsErrorMessage":"The {mentionsType} you are trying to view has been removed from the community.","videoProcessing":"Video is being processed. Please try again in a few minutes.","bannerTitle":"Video provider requires cookies to play the video. Accept to continue or {url} it directly on the provider's site.","buttonTitle":"Accept","urlText":"watch"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageCustomFields-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageCustomFields-1743095130000","value":{"CustomField.default.label":"Value of {name}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageRevision-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageRevision-1743095130000","value":{"lastUpdatedDatePublished":"{publishCount, plural, one{Published} other{Updated}} {date}","lastUpdatedDateDraft":"Created {date}","version":"Version {major}.{minor}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageReplyButton-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageReplyButton-1743095130000","value":{"repliesCount":"{count}","title":"Reply","title@board:BLOG@message:root":"Comment","title@board:TKB@message:root":"Comment","title@board:IDEA@message:root":"Comment","title@board:OCCASION@message:root":"Comment"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageAuthorBio-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageAuthorBio-1743095130000","value":{"sendMessage":"Send Message","actionMessage":"Follow this blog board to get notified when there's new activity","coAuthor":"CO-PUBLISHER","contributor":"CONTRIBUTOR","userProfile":"View Profile","iconlink":"Go to {name} {type}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/users/UserAvatar-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/users/UserAvatar-1743095130000","value":{"altText":"{login}'s avatar","altTextGeneric":"User's avatar"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/ranks/UserRankLabel-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/ranks/UserRankLabel-1743095130000","value":{"altTitle":"Icon for {rankName} rank"},"localOverride":false},"CachedAsset:text:en_US-components/users/UserRegistrationDate-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-components/users/UserRegistrationDate-1743095130000","value":{"noPrefix":"{date}","withPrefix":"Joined {date}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/nodes/NodeAvatar-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/nodes/NodeAvatar-1743095130000","value":{"altTitle":"Node avatar for {nodeTitle}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/nodes/NodeDescription-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/nodes/NodeDescription-1743095130000","value":{"description":"{description}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/nodes/NodeIcon-1743095130000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/nodes/NodeIcon-1743095130000","value":{"contentType":"Content Type {style, select, FORUM {Forum} BLOG {Blog} TKB {Knowledge Base} IDEA {Ideas} OCCASION {Events} other {}} icon"},"localOverride":false}}}},"page":"/blogs/BlogMessagePage/BlogMessagePage","query":{"boardId":"microsoftsentinelblog","messageSubject":"future-proof-your-soc-with-the-power-of-the-azure-ecosystem-and-defender-threat-","messageId":"3866030"},"buildId":"HEhyUrv5OXNBIbfCLaOrw","runtimeConfig":{"buildInformationVisible":false,"logLevelApp":"info","logLevelMetrics":"info","openTelemetryClientEnabled":false,"openTelemetryConfigName":"o365","openTelemetryServiceVersion":"25.1.0","openTelemetryUniverse":"prod","openTelemetryCollector":"http://localhost:4318","openTelemetryRouteChangeAllowedTime":"5000","apolloDevToolsEnabled":false,"inboxMuteWipFeatureEnabled":false},"isFallback":false,"isExperimentalCompile":false,"dynamicIds":["./components/community/Navbar/NavbarWidget.tsx","./components/community/Breadcrumb/BreadcrumbWidget.tsx","./components/customComponent/CustomComponent/CustomComponent.tsx","./components/blogs/BlogArticleWidget/BlogArticleWidget.tsx","./components/external/components/ExternalComponent.tsx","./components/messages/MessageView/MessageViewStandard/MessageViewStandard.tsx","./components/messages/ThreadedReplyList/ThreadedReplyList.tsx","../shared/client/components/common/List/UnstyledList/UnstyledList.tsx","./components/messages/MessageView/MessageView.tsx"],"appGip":true,"scriptLoader":[{"id":"analytics","src":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/pagescripts/1730819800000/analytics.js?page.id=BlogMessagePage&entity.id=board%3Amicrosoftsentinelblog&entity.id=message%3A3866030","strategy":"afterInteractive"}]}
Microsoft
