User Profile
MattBurrows
Brass Contributor
Joined 6 years ago
User Widgets
Recent Discussions
New Device Health Reporting showing incorrect status
Hi, Just been looking into the new reporting and ive come across the below: On the new AV health reports, it shows in the "Antivirus Mode" that I have a bunch of Devices that are in "Other Modes". when you run get-mpcomputerstatus, on the devices in question, everything is up to date, and matches that of a device that is in "Active" Mode. When you check on the Defender portal, on the device itself, in the new section "Device health Status" everything is unknown and the AV mode is "Other" along with the Title "Defender Antivirus Not active", which I can confirm it is active and updated. The Devices are able to communicate out to Defender so its not a networking issue, so im a little lost why some I'm getting irregular reporting Has anyone noticed the same thing from their side?Re: Azure Sentinel how to clear Threat Intelligence Indicator table
Funny enough I have this exact problem, DShield throws so many FP when mapping to signin events etc. I couldn’t find a way to bulk delete sadly, after searching high and low. I ended up editing the query to basically != DShield and then wait for the retention to kick in and remove. Will be interested if someone comes with an answer to bill delete though!5.2KViews0likes0CommentsLimitations with Watchlists in logic apps
Has anyone tried using the action within Logic Apps " Watchlist - Get all watchlist items for a giver watchlist" and come across the below issue? Currently I have a Watchlist with around 500 entries, when I try and get all the results, it will only pick the first 100 from the Watchlist. Assuming there is a limitation that only gets the first 100, does anyone know how to increase this?677Views0likes0CommentsRe: how to get the URL requested by the user in a browser?
Also to add ontop of this, and not knowing your set up, you could also link this with your firewall logs if you have connected them. Link below for basic reference. https://azurecloudai.blog/2021/03/15/how-to-azure-sentinel-watchlist-kql-basics/4.6KViews1like0CommentsRe: Delete devices from Inventory in Defender Security Portal
Microsoft doesn't provide the ability to remove devices because it's extremely dangerous. If an attacker would get permissions on your cloud instances, he could remove all his tracks. The devices are retained for forensic purposes. Best option is to tag an offboarded machine and create an 'Inactive' machine group for it Or run the offboarding script on the device if possible.14KViews0likes0CommentsRe: What is the difference between alerts reported by Azure AD Identity Protection in Sentinel and MCAS
Hi Chris, I believe there really is no difference here. Its the same logic across both. I ended up disabling the sign in alerts in MCAS (or Defender for Cloud Apps now) due to duplicate alerts being pinged in Sentinel both from MCAS and AADIP. If you don't have Sentinel then of course keep those alerts turned on in MCAS. The added value Sentinel brings is that you can do multiple stuff to these alerts, from running playbooks, Entity behaviour, linking in Threat Intel and much more.959Views0likes0CommentsAPI GET for Defender TVM
Hi Guys, I am running GET on "https://api-eu.securitycenter.windows.com/api/vulnerabilities" to pull all my vulnerabilities. What I am noticing is there is a lot of results with Exposed Machines that equal 0, while I only want to show Vulns that is equal to or greater than 1 (so shows all vulns on any of my machines). In theory I should be able to do this via the below ("ge" = ">=") https://api-eu.securitycenter.windows.com/api/vulnerabilities?$filter=exposedMachines ge 1 But I am getting the below error: "error": { "code": "BadRequest", "message": "Filter parameter is invalid", I have tried various other ways that is mentioned online but nothing seems to work. No doubt its something so simple. Cheers.3.2KViews1like2CommentsRe: Remove Duplicates from query
AmjadGov I believe you may need to use MountTime in a Arg_max for this. Arg_max removes duplicates and you need to use a number time or date for this unfortunately. The Arg_max would work below, so it will show the last MountTime for that FileName going to a specific USB. You may see duplicate FileNames but thats because its being saved to multiple USB devices. then create a project with the fields you want and in what order. Snippet of code to replace your join in the code you pasted. FileCreation | lookup kind=inner (UsbDriveMount) on DeviceId | where FolderPath startswith DriveLetter | where Timestamp >= MountTime | summarize arg_max(MountTime, *) by FileName, tostring(ProductName), tostring(SerialNumber) | project Timestamp, DeviceId, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName,InitiatingProcessAccountUpn, FileName, FolderPath, SHA256, SensitivityLabel, IsAzureInfoProtectionApplied, DriveLetter, MountTime, ProductName, SerialNumber, Manufacturer | order by DeviceId asc, Timestamp desc Hope this helps, as I know you wanted it without using MountTime.5.2KViews0likes1CommentRe: Sentinel Cost Workbook
Warning Over the top explanation, scroll to the bottom for the answer Just to give a break down what the workbook does: The section in the workbook you are on about basically creates a table assigning the Data types logs into the correct naming solutions, for example a snippet from the code: "Datatype Logs" Are apart of the solution "AAD", and then you get a costing for the solution AAD rather than individual logs. "AuditLogs", "Azure Active Directory", "SigninLogs", "Azure Active Directory", "AADNonInteractiveUserSignInLogs", "Azure Active Directory", "AADServicePrincipalSignInLogs", "Azure Active Directory", "AADManagedIdentitySignInLogs", "Azure Active Directory", "AADProvisioningLogs","Azure Active Directory", Then it Joins this and any Custom Logs you are ingesting (| where DataType contains "_CL") Anything labelled as other is because again, snipping the relevant code, basically saying if the result is empty in Log Type, mark it as "Other" | project ['Log Type'] = DataType | project ['Log Type'] = iif(isnotempty( Category),Category,"Other") So any logs that arnt captured under the categories at the start / anything that does not have CL will be marked as Other. Looking at a table that is flagged as Other in my environment "ContainerLog" is captured so is flagged as Other Answer: Long story Short This should give you a good view of everything cost wise: Usage | where TimeGenerated > ago(7d) | where StartTime >= startofday(ago(7d)) and EndTime < startofday(now()) | where IsBillable == true | summarize BillableDataGB = sum(Quantity) / 1000. by Solution, DataType | order by BillableDataGB desc Other Documents to assist https://docs.microsoft.com/en-gb/azure/azure-monitor/logs/manage-cost-storage#troubleshooting-why-usage-is-higher-than-expected4.9KViews0likes1CommentRe: Defender for 365 Ingestion: Duplicate values
I have the same issue, I never raised with Microsoft as the connector is still in preview and the EmailEvents have only recently been added, so assume some teething problems. I did ping my contact in MS a message, who said the Engineer teams are aware. So I would say keep an eye out as the problem should be resolved in the near future.1.3KViews0likes1CommentRe: Log data for connecting and disconnecting Sentinel Data Connectors
gcorsini Without physically testing my self the AAD connector, going off the link below I would assume the logs should be in the Azure Activity Table. Ive made changes to the DNS connector recently which involved turning off/on and I could see the events in the logs. Hope this helps. https://docs.microsoft.com/en-us/azure/sentinel/audit-sentinel-data MICROSOFT SENTINEL DATA INCLUDED IN AZURE ACTIVITY LOGS Operation: Deleted Information types: Alert rules Bookmarks Data connectors Incidents Saved searches Settings Threat intelligence reports Watchlists Workbooks Workflow Operation: Updated Information types: Alert rules Bookmarks Cases Data connectors Incidents Incident comments Threat intelligence reports Workbooks Workflow2.3KViews0likes0CommentsUnfamiliar sign-in properties, alert flagged in AAD Identity protection but not MCAS?
Hi Guys, First time post so apologies if anything is in correct with the below. I have an alert being picked up in AAD IP for a Risky Sign-in under the detection type, Unfamiliar Sign-in Properties. Usually i would see the same alert being triggered in MCAS but for what ever reason the alert hasn't been triggered. Has anyone seen anything similar before, or know why it wouldn't flag in MCAS but its does in AAD IP? Had this occur a few times now. AAD IP triggered this alert at 2/26 7:22AM but in MCAS the first activity from this user was 2/26 7:50AMSolved27KViews1like1CommentUnknown User!
Hi Everyone, A bit of a strange one, had a user who requested a colleague to join a team. The owner who approves members has reported that a request came in for both The User and an Unknown User at the same time. Has anyone seen anything similar? Apparently its not the first time this has happened! Cheers.1.6KViews0likes1Comment
Recent Blog Articles
No content to show