Mismatch in amount of data received in logs analytics workspace and DCR metrics
I have defined a data collection rule and am using logs ingestion api to send data to 2 custom tables. I have defined diagnostic settings for the DCR such that error logs are sent to logs analytics workspace. For about an hour, I have events ingested…
Got 1 Linux Computers Connected via Log Analytics Linux agnet (legacy) after clean uninstall Azure Arc Machines
I got trouble when want to clean uninstall Arc Machine in Ubuntu 22 because when i run troubleshoot while finised installed omsagent it says it's not support in Ubuntu 22. So i want to make another machine with ubuntu 20, i'm running command for…
Moving Sentinel to a different management group
Hey folks, I know that moving Sentinel from one subscription to a different one is not supported and can break things. Could somebody tell me, whether moving a whole subscription that contains a Sentinel instance from one management group to another…
Retention and archiving cost of non-billable tables
Hey folks I see MS updated this page a few months ago: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-archive?tabs=portal-3%2Cportal-1%2Cportal-2#pricing-model This part has been added to the documentation: "Log data…
How to get additional details about Mitre attacks like(mitre_tactic_id mitre_technique_id mitre_tactic mitre_technique mitre_subTechnique) ?
Hello, Greetings of the day We are using the below endpoint to collect the alerts. These alerts consist of a wide range of data including mitreTechniques. Further, I would like to know if it is possible to extract more information about Mitre Attacks…
Problems with data collectors and syslog
So, i have a task to integrate security logs that are beeing sent via syslog protocol formatted as CEF https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama?tabs=syslog%2Cportal I do have an VM linux It does have the python…
Upgrade GitHub App Azure-Sentinel
We have been using the Azure-Sentinel GitHub App to synchronize our repository to Sentinel. Its been a while since its been installed and lately we have been getting the following error: deploy-content Node.js 16 actions are deprecated. Please update…
Not allowing to connect Sentinel Data connector with Defender XDR
Hello, I was trying to connect the "Microsoft Defender XDR" connector with "Microsoft Sentinel", but I am facing the below error. I am not sure why Sentinel is not allowing to establish the XDR connector. As I am the Owner of the…
Finding classic automation in Sentinel analytics
I have the ability to search through ARM templates for the Sentinel analytics and I'm hoping to find a way to detect the use of classic alert automation. Does anyone know what i should be searching for in the ARM template? We have not used this method,…
Sentinel - Sophos Endpoint Protection (using REST API) (Preview) - Fails due to trying to create a table with a hyphen!
When trying to configure and deploy the new Sophos API connector for Sentinel it fails. Looks like it's trying to create a new table called Custom-SophosEPAlerts_CL but tables cannot contain hyphens so needs changing to CustomSophosEPAlerts_CL…
Azure Activity Log Data Connector Configuration
Hi, Recently, I onboarded Azure activity by following the instructions on the data connector page and completed the configuration successfully. This process involved creating a policy to send the logs to the log analytics workspace. During the setup, I…
Testing Microsoft Defender XDR with Azure Sentinel in a CDX-like Environment
I'm looking to try out Microsoft Defender XDR with Azure Sentinel, but my current setup—a CDX tenant under an E5 subscription—doesn't have an active Azure subscription. Any suggestions for workarounds or similar environments where I can test Microsoft…
Caller is missing required playbook triggering permissions on playbook resource
I have created a custom playbook but I get the error: Failed to trigger playbook Caller is missing required playbook triggering permissions on playbook resource…
Extensions AMA - Impossible to install agent
Hello, I'm trying to deploy an AMA extension but I m stuck in "creating" with the following error messages from the Guestconfig file on a RHEL 9 linux servers: [2024-05-15 15:52:30.135] [PID 1117] [TID 1629] [Pull Client] [INFO] Successfully…
Cisco FTD data connector
Hello, I have a customer that is configuring the CISCO FTD data connector. But they say CISCO FTD documentation shows it support only syslog format. They would like some clarification on the following questions: I. Clarify whether Cisco FTD supports…
How to generate data in Alert, AlertHistory, AlertEvidence and AlertInfo tables in Log Analytics workspace?
We would like to generate the data in the following tables in Azure Monitor and Security categories described in the docs, https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/alert …
Issue with Microsoft Sentinel Connectors
Hello! Prior to May the 7th 2024, There were roughly 20 connectors that were connected and working as expected with respect to the Microsoft Sentinel and the log analytics workspace. On the mentioned date we noticed this anomaly where out of the 20 odd…
Remote Desktop Connection error- Windows 11
A newbie here trying to setup Azure Sentinel (SIEM) & connect it to a live virtual machine that will act as a honeypot. But facing an error with RDP, Windows 11 home edition doesn't support Remote Desktop.…
Sentinel Kusto Query todatetime function does not work with dynamic values.
I have a kusto query to calculate MTTR by client. When an incident is resolved, an analyst comments the resolution time in the format R: time where time is when the incident was resolved and R is to make the comment unique. Example R: Friday, May 10,…
Sentinel bicep deployment : InvalidParameter - Solution product cannot start with 'OMSGallery/' as it is reserved for Microsoft first party solutions.
Hello, i am learning how to script and i wish to deploy Sentinel with bicep. I have created a script from Microsoft templates and have added variables as well as a jsonc parameters file. I use VSC with the bicep extension in order to "easily"…