User Profile
YanivSh
MicrosoftJoined Sep 01, 2018
User Widgets
Recent Discussions
Re: Get entities for a Sentinel Incidient by API
SanderWannet currently the only way to achieve this is by: 1. Getting the system alert id by running the relation API call get: https://management.azure.com/subscriptions/xxxxx-5731-4780-8f96-2078ddxxxx/resourceGroups/cxp-azuresecurity/providers/Microsoft.OperationalInsights/workspaces/CXP/providers/Microsoft.SecurityInsights/Incidents/803f3d58-a406-4953-a1df-953143313a74/relations?api-version=2019-01-01-preview in my example the system alert id value located here 2. run a POST request on entities API with the system Alert ID based on the first phase where the expansionId is constant for get all entities Post https://management.azure.com/subscriptions/xxxxxxx-5731-4780-xxxx-2078dd96fd96/resourceGroups/cxp-azuresecurity/providers/Microsoft.OperationalInsights/workspaces/CxP/providers/Microsoft.SecurityInsights/entities/fc4faf6f-03b7-3c57-6892-100a0f960f9d/expand?api-version=2019-01-01-preview body { "expansionId": "98b974fd-cc64-48b8-9bd0-3a209f5b944b", } This days product team are debating on how to make this process more user friendly with less calls. happy to share once we will have final decision.Re: Audit-Failed Events not reaching Workspace
Neil2020 if the workspace is shared between ASC and sentinel you can configure the log level ( minimal\command\full) only on one side: ASC or sentinel. https://docs.microsoft.com/en-us/azure/sentinel/connect-windows-security-events can you please share print screen from the defintion on the security event connector (on sentinel side) and the ASC workspace setting (under settings). see relevant pic from sentinel configurationRe: Unable to integrate suse linux (azure VM) on azure sentinel
Jayesh_D123 yes this is the same agent ( MMA\Azure monitor) You can see here the SUSE linux is supported https://github.com/microsoft/OMS-Agent-for-Linux#supported-linux-operating-systems this is the urls that you need to enable in the FW\proxy https://docs.microsoft.com/en-us/azure/azure-monitor/platform/log-analytics-agent#network-firewall-requirementsRe: Integration with WAZUH (OSSEC)
This product support CEF output https://documentation.wazuh.com/3.10/user-manual/reference/ossec-conf/syslog-output.html?highlight=cef So you should use sentinel CEF connector https://docs.microsoft.com/en-us/azure/sentinel/connect-common-event-format https://techcommunity.microsoft.com/t5/Azure-Sentinel/Azure-Sentinel-The-Syslog-and-CEF-source-configuration-grand/ba-p/803891
