Sentinel Demo environment setup
Hello All, I have been trying to set up a sentinel demo lab. I saw an article in the community hub which explains how to set up sentinel lab using ARM templates. However, when I am uploading the template, it is throwing me an error. Can someone please help me with this issue? Article I referred: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-to-go-part1-a-lab-w-prerecorded-data-amp-a-custom/ba-p/1260191 Template used: https://gist.github.com/Cyb3rWard0g/27b32e085607fb84816d24831f03a17eKusto query question, expanding multi-row, getting values from named keys
I want to query the OfficeActivity table and pull out values from the Parameters field. The field is a JSON string, so i know i need to convert to to Dynamic, and then i need to get values for Identity and User etc. I do not know what position the Identity and User appear so i cannot use normal [0] or [1] indexing. I would like the end result to be something like this. TimeGenerated Operation UserId Paramters.Identity Parameters.User Parameters.AccessRights x/x/x/ Add-MailboxPermission Bob John Peter FullAccess
Integration of Microsoft Sentinel & Microsoft TEAMS for integration of alerts
What are some of the best methods and strategies to start implementing an integration between Sentinel and TEAMS where when there are certain instances or alerts occurring, said alerts can be pinged to certain members on Microsoft TEAMS like through the use of playbooks, automations and setting up a API connection to integrate the two.
Salesforce to Sentinel Integration
Hello Tech community, With one of our customers, we are working on an integration of Salesforce with Sentinel and everything seems to work well but there are a few doubts. Has anyone worked on such integration? Is it worth ingesting Salesforce logs into Sentinel (asking because currently, we see only Login and Logout logs)? Do you know if we need to configure anything on Salesforce or Sentinel (Azure) side to get more logs?
Integrate on-premise windows syslog server with Sentinel
Hi Our on-premise environment is totally Windows based, no linux systems or skill and we want to integrate our Sentinel environment with our on-premise Windows syslog server - kiwi - is it possible to set up the log forwarders on a windows box rather than a linux one, as it would be the only linux vm we would have Thanks Alistair
Data Collection Rules and Xpath Queries Issue
Testing out the AMA to create custom filters for certain events. Still new to Xpath so have testing out some queries I've created. One query doesn't seem to work in sentinel the way I expect. Even though I tested in PowerShell and it works perfectly. Kind stuck as I am not sure exactly what is wrong with the query. Sample of the query I am testing: "*[System[EventID=4663] and EventData[Data[@Name='ProcessName']!='Path to a process'] and EventData[Data[@Name='SubjectUserName']!='Username']]" (Removed the actual path to the process and username) Basically I am looking to pull in all eventID 4663 events that do not contain a specific ProcessName and SubjectUsername. Both need to match in a single event. Testing that in Powershell works perfectly (Get-WinEvent cmdlet). When I add that to my DCR rule it just brings in all Events for EventID 4663. Tried modifying the query to: "*[System[(EventID=4663)]] and *[EventData[Data[@Name='ProcessName']!='Path to a process'] and *[EventData[Data[@Name='SubjectUserName']!='Username']]" This partially worked but instead it filtered out all events (eventID4663) that matched on ProcessName value or on SubjectUserName. Basically matching on each instead of both. I was under the assumption the and boolean would indicate both values need to match. I've read Xpath tutorials, Microsoft Docs and community blog posts about it but there's nothing about how queries actually work within the DCR. Any help would be appreciated. Thanks!
