Forum Discussion

Vshah335's avatar
Vshah335
Copper Contributor
Feb 24, 2021

Exclude IN Azure Sentinel

 

I am using this query for segregation of all Azure services coming into the sentinel. 

 

SecurityIncident
| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductname))[0]))
| summarize count() by (tostring(AdditionalData.alertProductNames))
|  sort by count_
 
Backgoround - In our incident dashboard all different teams incident shows  into centrally. 
Question -  Some incident we short by the title name. if we are using same query to exclude some title names won't shows me rest summerize services count. 
 
i hope you understoood. 
Any idea ? 

 

  • GaryBushey's avatar
    GaryBushey
    Bronze Contributor
    Feb 25, 2021

    Vshah335 If I understand what you are asking the following code will work.  It will only show those items that are NOT in the listing of products. In this case "Microsoft Cloud App Security" will not show up.  I removed the extend line since it was not being used.

     

    SecurityIncident
    | where tostring(AdditionalData.alertProductNames[0]) !in ("Microsoft Cloud App Security")
    | summarize count() by (tostring(AdditionalData.alertProductNames))
    | sort by count_

    • Vshah335's avatar
      Vshah335
      Copper Contributor
      Feb 25, 2021

      Thanks for the quick responses. GaryBushey 

       

       

      If I run this it provide all product names. 

      SecurityIncident
      | where tostring(AdditionalData.alertProductNames[0]) 

       

      So i need all product name but in Azure Sentien i seprate some incidnet by Tittle. I don't want count in Summerize function.  


      End Results will be All produt count show up as it is. but in Azure Sentienl product total count by seprated by Title . 

      but when i run this query won't get results what i am loooking for .  It only Showing me Azure Sentinel not other product count. 

       

       

      • GaryBushey's avatar
        GaryBushey
        Bronze Contributor
        Feb 26, 2021

        Vshah335 OK, I think I know what you want now.  You want to see all the incidents, but if they were not generated from Azure Sentinel you just want to get a total number of those incidents rather than seeing each one.  Is that correct?

         

        IF that is correct, I don't think you can do it with one query.  You can write a query to show all the incidents and then inside a Workbook display them as a grid and then group by the ProviderName field.  This will show the count and then you can expand the Azure Sentinel one to see all the incidents.

Resources