KQL query in sentinel for users first activity
Hi all, since I am new to writing queries I would really appreciate your help. I need to write a query that will show a specific users first activity and last activity in a day. I need to also project which activity it was and to sum it all up, I need the results to be in a row for each day. I would really appreciate any suggestions or help. Thank youKusto query question, expanding multi-row, getting values from named keys
I want to query the OfficeActivity table and pull out values from the Parameters field. The field is a JSON string, so i know i need to convert to to Dynamic, and then i need to get values for Identity and User etc. I do not know what position the Identity and User appear so i cannot use normal [0] or [1] indexing. I would like the end result to be something like this. TimeGenerated Operation UserId Paramters.Identity Parameters.User Parameters.AccessRights x/x/x/ Add-MailboxPermission Bob John Peter FullAccess
'MICROSOFT-CORP-MSN-AS-BLOCK' is violating Conditional Access Policy (CAP)
Hello folks, I have a CAP that prevents log-ins from foreign countries. I have excluded 'United States' in the 'Location' condition as well. I am getting a lot of incidents titled "Attempt to bypass conditional access rule in Azure AD" and when I went to investigate the logs, I found two IP addresses: ["40.71.237.118","40.71.238.151"] common for all the users. VirusTotal lists both of them as MICROSOFT-CORP-MSN-AS-BLOCK. Have you guys faced a similar situation or know the remedy for this?
Infoblox and Parsing Questions
Hello, Have Infoblox DNS Query/Response logs been tested with Azure Sentinel ? I am testing it and have found that Infoblox DNS seems to generate only Threat Logs in CEF. The other DNS logging categories, such as DNS Queries/Responses, are logged in some non-CEF format over syslog, like the following: ##<166>Dec 23 12:54:05 infoblox1.localdomain named[12821]: client @0x7fbc3c0cc6e0 192.168.80.1#57296 (server1.fwd1): query: server1.fwd1 IN A + (192.168.80.200) I can't even see these logs in the Sentinel Workspace. The logs arrive at the on-repm Syslog Agent and are forwarded to omsagent process over port 25226, but beyond that i don't see them anywhere. The OMSAgent fluentd parsing checks that the incoming message has "CEF or ASA" keywords before processing the message further. Which seems to be a showstopper for the above mentioned syslog message. Please advise: 1. Should we create a custom parser for Infoblox query/response logs or Microsoft has already addressed them ? 2. Does the syslog message(payload) parsing occur at the OMSAgent side or at the Azure Sentinel Workspace side ? 3. By having a vendor connector listed in Azure Sentinel connector list, such as ASA, Fortigate, .., does this mean having "parser" in the background ? I noticed that vendor connectors do query the CommonSecurityLog with filter of "device vendor" , so i don't fully understand the technical meaning of "having a connector for X vendor". 4. How to troubleshoot logs processing and ingestion after the logs are delivered from the syslog daemon to the omsagent daemon? Any troublehsoot files or tables to look into ? Thanks in advance.
The rule "Attempts to crack distributed passwords in AzureAD" is always detected with the same user.
Hi everyone, I don't know if anyone has had this problem. My problem is that when this rule is detected the same user is always triggered when trying to connect to the "Office 365 Exchange Online" application from a mobile phone and the client application "Exchange ActiveSync". This rule monitors high login attempts from different locations over a period of time of 1 day. We know that this is a false positive, as this is a field technician, and we have checked with the user to verify these actions. As a solution, we have taken the following actions to prevent the alert from being triggered: -Logging out of the application login and logging back in. But the problem persists, I don't know what else to do or what other mitigations I can see with the user. I have looked at the login table and only see that the error is thrown when connecting to the "Office 365 Exchange Online" application. Any ideas? Regards.
