User Profile
Rod_Trent
MicrosoftJoined 6 years ago
User Widgets
Recent Discussions
Re: KQL Queries
I cheated by asking Copilot for Security for the KQL query, but try the following: DeviceInfo | where SensorHealthState == 'Active' and OnboardingStatus == 'Onboarded' | join kind=inner (DeviceTvmSoftwareVulnerabilities) on DeviceId | summarize by DeviceId, DeviceName, OSPlatform, RecommendedSecurityUpdateRe: Data Base Integration with Sentinel
Sentinel utilizes its own data and data structure (Log Analytics) which is more efficient and better performant than legacy database types. You can ingest data from various sources to Sentinel to enable Sentinel to analyze and alert on security indicators. See the following which includes ingesting custom data types: https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources?tabs=azure-portal You can migrate Splunk and ArcSight to Sentinel. See the following for Splunk: https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-detection-rules See the following for ArcSight: https://learn.microsoft.com/en-us/azure/sentinel/migration-arcsight-detection-rulesRe: Seeking Guidance on Best Practices for Ingesting Azure Diagnostics Logging into Sentinel
Most generally, you can avoid Azure Diagnostics as most of the data there is health and performance for Azure services. However, there are unique cases. For example, Azure Cognitive services (all the AI stuff) only logs to the Azure Diagnostics log right now.Re: Hi Community!, I'm looking how to apply IA and ML on SOC , for cybersecurity, thanks
And of course, don't forget Microsoft Sentinel has been using ML since day one to help sift through the unnecessary alerts to free efficiency for security teams. 😉 This is built in, i.e., the ML stuff. For AI, its easy to implement using the APIs. In Sentinel we do this currently through the use of Logic Apps. There's several good blogs out there that showcase this. Here's one example: https://rodtrent.substack.com/p/generating-kql-from-microsoft-sentinel I started a series on my blog recently (aka.ms/RodsBlog) to show how to build your own Security Copilot using Azure Cognitive services and Azure OpenAI.Re: Looking for KQL query when high volume of USB writes happens by a user
The default is usually 24 hours, but you can set it in the query. Here it is for the past 2 days... DeviceFileEvents | where Timestamp > ago(2d) | where ActionType == "FileModified" | summarize USBWriteCount = count() by InitiatingProcessAccountName | where USBWriteCount > 1 | order by USBWriteCount descRe: Looking for KQL query when high volume of USB writes happens by a user
I don't have a lot of USB data in my tenant and KQLSearch.com doesn't have much for this. Try the following (filemodified instead of filewrite): DeviceFileEvents | where ActionType == "FileModified" | summarize USBWriteCount = count() by InitiatingProcessAccountName | where USBWriteCount > 1 | order by USBWriteCount descRe: Looking for KQL query when high volume of USB writes happens by a user
In Microsoft Defender for Endpoint, you can use the following KQL query to show a high volume of USB writes by a single user. Modify the Threshold value to define what you consider a "high volume" of USB writes. DeviceFileEvents | where ActionType == "FileWrite" and InitiatingProcessFileName == "explorer.exe" and FileName contains ".usb" | summarize USBWriteCount = count() by AccountName | where USBWriteCount > Threshold // Replace Threshold with a specific value to define "high volume" | order by USBWriteCount descRe: Analytic rules, KQL queries and UEBA pricing
There's not cost to run queries. Sentinel costs are at the base level ingestion and data retention. There's other things that factor in like Logic Apps, etc. but for the most part it's just the ingestion and data retention. UEBA consists of four tables: BehaviorAnalytics, IdentityInfo, UserAccessAnalytics, and UserPeerAnalytics. You can look at how much each will cost based on ingestion and data retention using the following query: https://github.com/rod-trent/SentinelKQL/blob/master/UEBACosts.txt And, if you ever want to know which tables do or do not factor into cost, you can use the following query to show the isBillable flag: https://github.com/rod-trent/SentinelKQL/blob/master/TableUsageandCost.txt
