Microsoft Sentinel this Week - Issue #39

Recently I had a customer, well more than one, that wanted to understand the usage and cost of their ingestion of log data into Sentinel. First, the ingestion cost for Sentinel can be confusing because you also pay for ingestion into Log Analytics. I am hoping this will be made more evident in the future for each data connector. Second, some data is free for ingestion. For example, Azure Activity Logs, Microsoft Defender Alerts, and Office 365 Audit Logs can all be ingested for free. These are free for Sentinel and Log Analytics.

Jupyter Notebooks are a fantastic resource for security analysts, providing a range of powerful and flexible capabilities. Microsoft Sentinel’s

At Microsoft Ignite 2021, there were a slew of important announcements around features. But, one of the bigger, more customer relatable announcements centered around changes in our Sentinel Trial and the Customer benefit. These two offers are key to customers getting introduced to Microsoft Sentinel and then continuing their journey by taking advantage of special…

Microsoft Sentinel is in the last months improved with a lot of new interesting features. One of the announced features is the content hub. In this blog the usage of the content hub and usage of the Teams / Training Lab content. 

After hearing that one of our customers’ largest barriers to using things like Defender, Microsoft Sentinel and even reporting for Intune is KQL, that was a wake-up call for me. And, of course, I want to do something about it. KQL is a simple query language to learn. I feel bad that there’s just not…

For this post, its not yet necessary to utilize the resources provided in Part 1, but make sure you don’t miss those as they’ll be needed in future posts. … To start the journey learning KQL in this Must Learn KQL series, its helpful to understand where the name KQL came from and why the…

A while back I posted a method to capture an RSS link from our Docs platform to monitor when the “What’s New” page had changed. Since then, that method has changed - or, rather, the support for that method in our Docs platform has changed. A colleague and myself have been scrambling to figure out…

How to use Sentinel code snippets to create your own notebooks to supercharge your incident investigation and threat hunting.

The Log Analytics workspace is at the top of the hierarchical pattern it follows and it can be considered as a container for all the individual logs for your instance of Azure Sentinel almost equivalent to a database in SQL. Individual logs called tables are present within each workspace that are equivalent to a table in SQL. These have a set of columns, and zero or more rows of data. There are also columns that can hold different types of data like text, date/time, integers, and others. 

The Tables Pane It contains the list of all the logs that are part of your Log Analytics workspace, grouped together using predefined groups.  After clicking on Tables, some of the logs listed under LogManagement, Office365, SecurityInsights, WindowsFirewall, and the others can be seen. After looking over at all the entries you will notice a star icon and an eye icon on the right of the log’s name. 

While clicking on

The Results Window It is located below the query window and obviously shows the results of your queries. I can also hide or show columns, filter the results as well as change how the results look

In this first episode of Microsoft Sentinel in the Field, Nayef Yassin joins Cristhofer Muñoz and Javier Soriano to talk about how to automate the deployment…

Tuesday, November 16, 2021, 11:00 AM ET / 8:00 AM PT (webinar recording date) Microsoft Sentinel Webinar | Create Your Own Microsoft Sentinel SolutionsPresen…

In this final video of the series you will learn how to export the logic app as code and prep it for deployment for any customer or internal use. We will als…

All sysmon event types and their fields explained

Contribute to rod-trent/SentinelPS development by creating an account on GitHub.

Detects when a user registers MFA details on their account and then completes self service password reset within the timeframe

So after a year, finally I have version v2.0 ready.

There has been a long-standing split between ICS/SCADA (OT) and Corporate (IT) cybersecurity. This split was often driven by significant differences in technology/tooling. Microsoft Defender for IoT’s integration with Azure Sentinel drives convergency by providing a single pane for coverage of both D4IOT (OT) and Azure Sentinel (IT) alerting. This solution includes Workbooks, Analytics rules, and Playbooks providing a guide OT detection, Analysis, and Response.

Summarize the total count of files downloaded by each guest domain in your tenant

Visualize uploads vs downloads in your Office 365 tenant per day

Detects when a user downgrades a label on a file and that file is then emailed outbound

Microsoft Sentinel team has a notebook that will help identify the applications/service principals and their credentials that need rotation. The notebook uses the key credential property of the Microsoft Graph API to find the AppId’s in a tenant and adds them to a watchlist in Microsoft Sentinel. In addition to the notebooks, customers can also find the apps requiring credential rollover using Microsoft Sentinel playbook.

Pre-Release: RiskIQ, Sentinel Incident Explorer, Kusto and MS Defender

Visualize Active Directory accounts created, disabled and deleted per day over the timerange

Collection of KQL queries. Contribute to reprise99/Sentinel-Queries development by creating an account on GitHub.

Detects first time internal to external Teamviewer access not seen for the previous timeframe

Detects when a BitLocker key is read in Azure AD and retrieves the device and key ids

Recordings of past webinars are below. To register for upcoming webinars visit aka.ms/SecurityCommunity . Also, explore the Microsoft Security Technical

Use the AWS connector to delegate Microsoft Sentinel access to AWS resource logs, creating a trust relationship between Amazon Web Services and Microsoft Sentinel.

Insider risk solutions are often based on singular User Entity Behavior Activity (UEBA) capabilities which are greatly dependent on complex configurations

This article displays the Microsoft Sentinel Network Session normalization schema.

As a blue team, we won’t believe that the attackers can stay a long time on the user’s machine by attaining the user’s passwords without the user’s knowledge by not executing any malicious scripts or bypassing password spraying attempts, or by phishing attempts. But it’s highly possible by stealing AD FS server token-signing certificate to access Azure/Office365. This certificate is valid for a year by default, and it allows an attacker to log into Azure/Office365 as an AD user, despite password resets or MFA. As a result, the attacker maintains persistence and has a method of re-entering the environment yet avoiding detection

When you are building out different Logic Apps (or Microsoft Sentinel Playbooks) it’s a best practice to never expose your passwords or API Keys in plain text within your Logic Apps. If you do, every user/administrator with read access to your environment will have access to your keys. In order to better protect your environment,…

Learn about the retiring Azure AD Graph, the comprehensive Microsoft Graph and when you’d use the Azure Resource Graph.

Microsoft 365 E5 customers benefit from free Azure credits (up to 100MB per month) of data ingestion into Microsoft Sentinel under a new permanent offer.

SANTA CLARA, Calif., November 16, 2021–Arista Joins Microsoft Intelligent Security Association for Integration with Microsoft Azure Sentinel to Help Improve Customer Security

Iranian threat actors are increasing attacks against IT services companies as a way to access their customers’ networks. This activity is notable because targeting third parties has the potential to exploit more sensitive organizations by taking advantage of trust and access in a supply chain. Microsoft has observed multiple Iranian threat actors targeting the IT services sector in attacks that aim to steal sign-in credentials belonging to downstream customer networks to enable further attacks. The Microsoft Threat Intelligence Center (MSTIC) and Digital Security Unit (DSU) assess this is part of a broader espionage objective to compromise organizations of interest to the Iranian regime.

Every day, Microsoft is committed to maintaining comprehensive security for all across our interconnected global community. With that purpose in mind, we recently sponsored the 2021 Gartner Security and Risk Summit and 2021 Forester Security and Risk Forum, where we discussed ongoing changes in the security landscape. As a Leader in five Gartner® Magic Quadrant™ reports and eight Forrester Wave™ categories, our team was keen to share insights about new threats, the evolution of Zero Trust security, managing compliance, risk, and privacy, and building tomorrow’s talent.

Open Systems’ award-winning Managed Detection and Response (MDR) executes repeatable security missions that protect enterprises in real-time and levels up their security posture for tomorrow. The company’s customers are typically mid-market organizations—enterprise or small-to-medium corporations (SMC)—that are looking for all-day threat detection and response but also aspire to improve their security posture and resilience against attack. Open Systems noticed that many of these customers lean heavily on Microsoft for IT and cloud infrastructure, and can unlock the value of these investments to consolidate and operationalize their security tools. Open Systems accomplishes this by providing a Microsoft Azure cloud-native Managed Detection and Response (MDR) service built for Microsoft Sentinel (formerly known as Microsoft Azure Sentinel), Microsoft Security best practices, and Microsoft 365 E5 (M365 E5).

SOC Prime, the world’s largest threat detection marketplace, today announced the availability of Quick Hunt, a cutting-edge module powered by SOC Prim