1,234 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
0 answers

Microsoft Sentinel API - "triggerRuleRun" ExecutionTimeUtc Always Invalid

Issue Summary We are trying to manually trigger a Microsoft Sentinel Scheduled Analytics Rule using the triggerRuleRun API, but it always fails with the following error: { Even when using the correct timestamp format, the API never accepts…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-19T10:13:34.1966667+00:00
Shafiq Aziz (Admin Account) 0 Reputation points
edited a comment 2025-02-28T04:52:04.1+00:00
Rukmini 1 Reputation point Microsoft Vendor
1 answer

microsoft sentinel data connectors not visualised in overview dashboard(GCP audit log connector)?

i have configured a GCP audit log data connector & GCP firewall data connector to my Microsoft sentinel , the connectors fetch the metrics from the source , but in the overview page of Microsoft sentinel shows no data connectors,

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-26T11:11:48.39+00:00
Aswath A 0 Reputation points
commented 2025-02-28T04:48:35.0733333+00:00
Aswath A 0 Reputation points
1 answer

Legacy Data Connectors being updated to use Content Hub

We've inherited a Sentinel setup using Data Connectors not connected to the content hub packages. Examples are Azure KeyVault, XDR, Entra etc. If we were to install these content hub packages to utilise the content provided what happens to the existing…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-27T11:37:41.95+00:00
sam.holmes 0 Reputation points
answered 2025-02-28T02:02:20.15+00:00
Navya 15,800 Reputation points Microsoft Vendor
1 answer One of the answers was accepted by the question author.

Azure Activity Sentinel Data Connector

Hi, I'm trying to enable Azure Activity Sentinel Data Connector. I've manage to install it and when I follow the 'Launch Azure Policy Assignment Wizard' it completes successfully, however the Azure Activity Data Connector never shows 'green/connected'…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-27T09:28:56.4766667+00:00
Rondo Huang (SOS Group Limited) 0 Reputation points
accepted 2025-02-28T01:44:57.46+00:00
Rondo Huang (SOS Group Limited) 0 Reputation points
1 answer

Sentinel Analytics Rule not creating incident

I have worked with Microsoft Support and created an Analytics rule to raise an incident when 5 or more failed login attempts are detected, followed by a success. This worked originally but has now stopped working. Nothing has changed. I cannot figure out…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-26T14:51:55.7166667+00:00
Conor Bateman (Alcom IT) 0 Reputation points
answered 2025-02-27T12:45:43.73+00:00
Andrew Blumhardt 9,871 Reputation points Microsoft Employee
0 answers

Jamf Protect Push Sentinel Connector retention error

Hi, While deploying Jamf Protect Push Connector in sentinel Workspace, I'm getting this error. Is it because the retention period is set to 90 day? Do we need to change the retention period in order to deploy this connector?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-27T12:27:04.18+00:00
Pradeep Kumar 20 Reputation points
commented 2025-02-27T12:40:34.4766667+00:00
Pradeep Kumar 20 Reputation points
2 answers

GitHub Analytics rule is not reflecting back to Sentinel

Hello, I configured and connected GitHub repository with Sentinel but the analytics rules which I created in GitHub after commit are not reflecting back to Sentinel. Please advise! Thank you!

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-25T08:54:06.2733333+00:00
Gurpreet Singh Suhi 0 Reputation points
answered 2025-02-26T21:43:49.7533333+00:00
Sándor Tőkési 251 Reputation points
1 answer

Microsoft Sentinel: System Assigned Managed Identity can't find location

I'm trying to connect Azure Activity to Microsoft Sentinel. It requires creating a Managed Identity. When creating a System Assigned Managed Identity, a location is required but there's no location options to select. Any idea what could be causing this?…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-01-10T15:58:49.0066667+00:00
alfalfa 20 Reputation points
answered 2025-02-26T15:54:13.5666667+00:00
John Fedor 0 Reputation points
1 answer

Sentinel Data Connectors Not Loading (CSP Access)

Errors loading Data Connectors on Microsoft Sentinel

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-25T11:21:52.7433333+00:00
JW231 0 Reputation points
edited the question 2025-02-26T15:40:31.13+00:00
Alison A 650 Reputation points Microsoft Vendor
0 answers

Workspace transformation cost for native Entra ID connector

Hey team! I want to apply workspace transformation to the native Entra ID connector and it's log types to filter logs only for specific domain. While from KQL perspective this is not difficult, I'm doubting if the cost reduction effect will be applied…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-24T08:53:51.25+00:00
Iliyan Karakashev 0 Reputation points
commented 2025-02-26T09:14:48.1333333+00:00
Sándor Tőkési 251 Reputation points
2 answers

Azure Activity Data connector not getting delelet from MS Sentinel

I'm not able to delete Azure Activity data connector from MS Sentinel. I had deleted the Azure policy the one created by connector and also removed IAM role on subscription for the managed identities created by connector while adding it. After all…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-19T12:09:04.6233333+00:00
Muhammad Rizwan 5 Reputation points
commented 2025-02-26T05:25:56.4266667+00:00
Alex Burlachenko 1,665 Reputation points
1 answer

Sentinel unexpected error

Hi! I have an issue with Microsoft Sentinel. Every now and then I get this "unexpected error". When this happens all connectors show as not connected, I can't run any queries nor see any logs. I still receive incidents based on some analytic…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2024-09-26T06:28:42.5+00:00
Sebastian Enström 0 Reputation points
answered 2025-02-25T11:36:34.9966667+00:00
Grogu-5582 0 Reputation points
0 answers

Categories AdvancedHunting-IdentityLogonEvents are not supported.

Hi All, I am getting this error ( Server error - Categories AdvancedHunting-IdentityLogonEvents are not supported) when trying to onboard the Identity tables to sentinel. I checked the clients Defender portal and they have the IdentityLogonEvents table,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-25T10:08:02.3966667+00:00
Shahani Silva 0 Reputation points
edited the question 2025-02-25T10:09:25.7866667+00:00
Shahani Silva 0 Reputation points
2 answers

Why defender is not correlating the Entra ID protection alerts?

Hi Team, In my environment, Entra ID Protection is generating multiple alerts even when the user, IP address, and sign-in events are the same and occur within seconds. These alerts are forwarded to Microsoft Defender, but they are not being correlated,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
251 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,423 questions
asked 2025-02-17T14:53:42.8366667+00:00
Supriya Nelluri 0 Reputation points
commented 2025-02-24T14:56:23.62+00:00
Supriya Nelluri 0 Reputation points
1 answer

Alert XX was added to the incident by Microsoft Defender XDR - alert correlation

Hey, I am sending alarms/incidents from another SIEM to sentinel for centralization. The goal is that sentinel mirrors the alarms/incidents exactly. The data is sent to a custom log table, in the log analytics workspace through an API call, and I have a…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-18T07:01:10.58+00:00
Horne, Lorents Birkeland 0 Reputation points
answered 2025-02-24T14:44:03.8633333+00:00
Sakshi Devkante 1,240 Reputation points Microsoft Vendor
1 answer

Filtering Logs

We have a rsyslog server on prem that we are sending on premise firewall, switch and load balancer logs to. We are using the Cisco FTD connector for our firewalls and the regular syslog on for everything else. Problem I am having is that the FTD logs are…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-21T01:46:21.6366667+00:00
Gary S 0 Reputation points
edited a comment 2025-02-21T20:34:37.0833333+00:00
Gary S 0 Reputation points
0 answers

Data connector buttons are grayed out saying No permissions

cannot enable Microsoft Defender XDR connector in sentinel despite being logged in as owner of tenant, subscription and resource group. My licence is Microsoft 365 Business Premium which I see in documentation is an Microsoft XDR eligible licence

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
251 questions
asked 2025-02-13T12:41:56.3866667+00:00
gutta bachelor 0 Reputation points
commented 2025-02-21T10:50:00.04+00:00
Navya 15,800 Reputation points Microsoft Vendor
0 answers

KQL Queries not showing results

No matter what is attempted in KQL, all queries consistently run past 30 minutes. Repeated attempts to recreate the VMs, Sentinels, Workspaces, etc., have not resolved the issue.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
8,432 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-15T20:02:19.6533333+00:00
MTOrion 0 Reputation points
commented 2025-02-21T00:41:43.34+00:00
Nagarjuna Reddy Yanna 10 Reputation points Microsoft Vendor
1 answer

Connect data to Microsoft Sentinel using data connectors Salesforce

I need help integrating SaleForce and Wiz into my siem.

Viva Connections
Viva Connections
A Microsoft Viva module that provides a gateway to a modern engagement experience.
106 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,423 questions
asked 2025-02-10T14:57:39.59+00:00
Dunham, Jermey 0 Reputation points
commented 2025-02-20T04:52:13.6366667+00:00
Chaithra E 480 Reputation points Microsoft Vendor
1 answer

Cannot read data from Cloudflare in Azure Sentinel

I already setting logpush from Cloudflare to Azure sentinel. it only show test log only

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,234 questions
asked 2025-02-11T01:11:01.3066667+00:00
amir rachman 0 Reputation points
commented 2025-02-19T21:25:31.0833333+00:00
Raja Pothuraju 14,990 Reputation points Microsoft Vendor