User Profile

ahhann

Copper Contributor

Joined Jan 25, 2022

8 Posts1 LikeLikes received

View All Badges

User Widgets

Recent Discussions

Re: Unified Security Operation Sentinel Vs Defender Tables
Echo to this, not all environment have the budget to ingest Device****** events into Sentinel, given the huge volume of events it produced. Thus you have an option right now to both save cost + correlating the information from Sentinel end, under the Unified SOC portal. You need to look into the monetary benefits of this integration as well, not only technical feasibility. Hope my 2 cent helps.
Jul 10, 2024 Place Microsoft Sentinel
791Views
1like
1Comment
SentinelHealth - Analytic Rules failed to run
Hi Community, anyone know what is the so call "TemporaryIssuesDelay" ? Code: TemporaryIssuesDelay Description: The rule's running was delayed due to temporary issues. Microsoft documentation didn't explain much on the error https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity
Feb 22, 2024 Place Microsoft Sentinel
analytics
detection
1.2KViews
0likes
1Comment
Re: Inaccurate TimeGenerated value in CommonSecurityLog
BillClarksonAntill We using AMA. The link you posted was for legacy LAA. Any way issue was resolved after the Log Relay Server where the AMA was installed is rotated and started fresh without any localtime under UTC.
Dec 10, 2023 Place Microsoft Sentinel
646Views
0likes
0Comments
Inaccurate TimeGenerated value in CommonSecurityLog
Hi, I'm facing a weird issue where TimeGenerated value is inaccurate when we use the query condition | where TimeGenerated >= ago() See here: As you can see above, the time is in future time compared to my local time at the right bottom. But if i use | where TimeGenerated between() or if i use the portal GUI Time Range, it able to return the correct TimeGenerated value: We notice this issue after the Linux Log Relay server timezone was changed from JST to UTC, then changed back to JST again. The server has been rebooted 3 times, which i believe the rsyslog and the ama services would take effect on the changes of timezone as well. Urgently need advise on this as it will certainly disrupt our Analytic Rule as well as Hunting query.
Dec 05, 2023 Place Microsoft Sentinel
KQL
kusto
Log Data
788Views
0likes
2Comments
Re: Trend Micro XDR Data connector
Clive_Watson How you even get the rest of the table to appear? I'm using the default API role in the TM Vision One, which is the one with SIEM role, generated simulation alert, Workbench can see those alert. But still no logs appeared in the Sentinel after 12 hours. Documentation on the API account is not details and confusing.
Jul 13, 2023 Place Microsoft Sentinel
1.8KViews
0likes
0Comments
Re: How to correlate Security Alert Entities further with a WorkList
Thanks for the pointer, got it working: let domain = "@"; let watchlist = (_GetWatchlist("SuspiciousUser") | project SearchKey); SecurityAlert | extend EntitiesDynamicArray=parse_json(Entities) | mvexpand EntitiesDynamicArray | extend Entitytype = tostring(parse_json(EntitiesDynamicArray).Type) | where Entitytype == "account" | extend username=tostring(parse_json(EntitiesDynamicArray).Name) | extend UPN=tostring(parse_json(EntitiesDynamicArray).UPNSuffix) | extend useraccount = strcat(username, domain, UPN) | where useraccount in (watchlist) | project TimeGenerated, DisplayName, useraccount, Entities
Jan 25, 2022 Place Microsoft Sentinel
1.7KViews
0likes
0Comments
How to correlate Security Alert Entities further with a WorkList
Hi all, Newbie to Sentinel. In old school SIEM, one can easily correlate specific correlated Security Alert entities with a watchlist via data schema mapping. However for Sentinel, i notice that the Entities in Security Alert comes in multiple nested format, where i cannot do a simple 1 to 1 map to watch list to further correlate. I have a request to further correlate any SecurityAlert | where DisplayName == "Create incidents based on ADB2C Identity Protection Risky Signin" with a watchlist containing high suspicious user, Name + UPN The Entities of the event comes in these format: Entities [{"$id":"3","Url":"[\"unfamiliarFeatures\"]","Type":"url"},{"$id":"4","Address":"1.2.3.4","Type":"ip"},{"$id":"5","Name":"someuser","UPNSuffix":"gmail.com","IsDomainJoined":true,"Type":"account"}] TLDR: How to create an analytic rules to alert any SecurityAlert "Create incidents based on ADB2C Identity Protection Risky Signin" with a WatchList?
Solved
Jan 25, 2022 Place Microsoft Sentinel
1.9KViews
0likes
2Comments

Recent Blog Articles

No content to show