1,222 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
0 answers

KQL Queries not showing results

No matter what is attempted in KQL, all queries consistently run past 30 minutes. Repeated attempts to recreate the VMs, Sentinels, Workspaces, etc., have not resolved the issue.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
8,379 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-15T20:02:19.6533333+00:00
MTOrion 0 Reputation points
commented 2025-02-18T09:36:55.2533333+00:00
Nagarjuna Reddy Yanna 0 Reputation points Microsoft Vendor
1 answer

Why defender is not correlating the Entra ID protection alerts?

Hi Team, In my environment, Entra ID Protection is generating multiple alerts even when the user, IP address, and sign-in events are the same and occur within seconds. These alerts are forwarded to Microsoft Defender, but they are not being correlated,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
251 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,283 questions
asked 2025-02-17T14:53:42.8366667+00:00
Supriya Nelluri 0 Reputation points
answered 2025-02-18T09:34:32.02+00:00
Pauline Mbabu 595 Reputation points Microsoft Employee
0 answers

Alert XX was added to the incident by Microsoft Defender XDR - alert correlation

Hey, I am sending alarms/incidents from another SIEM to sentinel for centralization. The goal is that sentinel mirrors the alarms/incidents exactly. The data is sent to a custom log table, in the log analytics workspace through an API call, and I have a…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-18T07:01:10.58+00:00
Horne, Lorents Birkeland 0 Reputation points
1 answer

Need help with solution to deploy sentinel in US region and China region

I want to deploy sentinel in US region and China region. is it possible to send logs using DCR rules from China to workspace build in US region or do I need to build 2 workspace separately and send logs from China to US using event Hub . Incase I…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-10T05:52:12.9666667+00:00
sameer khandar 0 Reputation points
commented 2025-02-17T13:37:02.8566667+00:00
Sakshi Devkante 735 Reputation points Microsoft Vendor
1 answer

How to integrate paloalto firewall on-premises and cloud with Microsoft sentinel step by step

How to integrate paloalto firewall on-premises and cloud with Microsoft sentinel step by step

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2024-12-15T09:21:08.1633333+00:00
suraj hirekudi 0 Reputation points
commented 2025-02-17T13:00:57.9566667+00:00
Pavlo Khazov 0 Reputation points
1 answer

Connect data to Microsoft Sentinel using data connectors Salesforce

I need help integrating SaleForce and Wiz into my siem.

Viva Connections
Viva Connections
A Microsoft Viva module that provides a gateway to a modern engagement experience.
106 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,283 questions
asked 2025-02-10T14:57:39.59+00:00
Dunham, Jermey 0 Reputation points
commented 2025-02-17T09:20:33.46+00:00
LiweiTian-MSFT 24,000 Reputation points Microsoft Vendor
0 answers

Data connector buttons are grayed out saying No permissions

cannot enable Microsoft Defender XDR connector in sentinel despite being logged in as owner of tenant, subscription and resource group. My licence is Microsoft 365 Business Premium which I see in documentation is an Microsoft XDR eligible licence

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
251 questions
asked 2025-02-13T12:41:56.3866667+00:00
gutta bachelor 0 Reputation points
commented 2025-02-17T07:24:35.0366667+00:00
Navya 15,465 Reputation points Microsoft Vendor
1 answer

Why use Fortinet Connector instead of a Function App for registering an action group in the Fortinet-FortiGate playbook?

Hello, I am setting up the Fortinet-FortiGate playbook and noticed that for registering an action group in FortiGate, the playbook uses the Fortinet Connector instead of a Function App. Why was the Fortinet Connector chosen for this action instead of a…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-12T05:09:01.1633333+00:00
mara7 166 Reputation points
commented 2025-02-17T01:55:05.46+00:00
mara7 166 Reputation points
1 answer

This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix.

Applied skills Name: Deploy containers by using Azure Kubernetes Service Issue: This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2024-03-24T11:56:12.4166667+00:00
pritam bhor 25 Reputation points
commented 2025-02-14T14:45:49.79+00:00
REZAI Arash 0 Reputation points
3 answers

Problem with Microsoft Sentinel Connector

Hello, for test i have deploy sentinel 2 or 3 time and after that i delete Workpace. Now i have recreted new Workspace and when i try connect connector i recevive the following error: I have just try to find if there are other diagnostics settings but…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-01T09:06:59.5833333+00:00
Guido Imperatore 20 Reputation points MVP
answered 2025-02-13T11:06:33.1466667+00:00
Alex Burlachenko 1,010 Reputation points
1 answer

Issues trying to connect to MITRE ATT&CK STIX 2.1 Feed from Sentinel Threat Intelligence

Hi, I am having issues while trying to connect to the MITRE ATT&CK STIX 2.1 Feed from within Sentinel's Threat Intelligence module. I have the 'Threat Intelligence - TAXII' data connector enabled (with another TAXII server…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-03T04:58:21.01+00:00
WillAngus-6254 0 Reputation points
commented 2025-02-13T11:03:42.4+00:00
Raja Pothuraju 12,985 Reputation points Microsoft Vendor
2 answers One of the answers was accepted by the question author.

Azure Sentinel - Query help

Dear All, I need to write query to hunt for OS Credential Dumping: NTDS. T1003.003, kindly help if you got any information

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2022-02-15T14:33:19.247+00:00
karthik palani 1,036 Reputation points
commented 2025-02-13T02:44:17.5833333+00:00
useR 0 Reputation points
2 answers

Need kql to query purview sensitive, not-encrypted, externally sent data

Hi there, I'm trying to understand if I can use kql to query the following about Purview events. Here's a 'hypothetical' kql query that works logically, but I'm struggling to create a Purview policy that matches this. I've created a 'sensitive' label,…

Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,396 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-06T17:19:01.5233333+00:00
David Broggy 6,101 Reputation points MVP
commented 2025-02-12T19:00:16.4033333+00:00
Oury Ba-MSFT 20,341 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

No access to DeviceTvmSoftwareVulnerabilities table in Sentinel?

There is an XDR analytic rule in Sentinel named "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863" However the kql query used by this rule requires access to the DeviceTvmSoftwareVulnerabilities table. But according to…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-07T20:06:08.39+00:00
David Broggy 6,101 Reputation points MVP
edited a comment 2025-02-12T12:25:12.1+00:00
Jonathan James 0 Reputation points
1 answer

Inound connection identified as Outbound by Microsoft Sentinel

I have noticed that there are several outbound connections in the overview page. However, having analyzed the traffic, I realized that inbound traffic labeled as outbound traffic. Note: I have removed the destination IPs as they are…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2022-10-27T03:53:39.813+00:00
Nimantha Deshappriya 21 Reputation points
edited an answer 2025-02-11T16:30:45.8033333+00:00
Luis Arias 7,861 Reputation points
1 answer

What is the size limit of rawContent of watchlist when bundled in solution package?

We are using watchlists to upload data via csv files and using it in worksbook. As per the document, there is a size limit of 3.8MB while creating watchlist using local csv files. So, we have created csv files of size 2.5MB, using which we are able to…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-01-31T06:30:59.1833333+00:00
Nirali Shah 151 Reputation points
commented 2025-02-11T15:42:35.7733333+00:00
Raja Pothuraju 12,985 Reputation points Microsoft Vendor
1 answer

Cannot read data from Cloudflare in Azure Sentinel

I already setting logpush from Cloudflare to Azure sentinel. it only show test log only

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-11T01:11:01.3066667+00:00
amir rachman 0 Reputation points
answered 2025-02-11T14:05:52.92+00:00
Luis Arias 7,861 Reputation points
1 answer

Microsoft public IP scanning my app services IP

We recevied an alert on defender for cloud stating vulnerability scanner detected. while checking the owner of the IP, it's MICROSOFT-CORP-MSN-AS-BLOCK and it is scanning for world press related stuffs on my azure app services. Is it some sort of intenal…

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,497 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-02-06T07:34:03.2566667+00:00
AzureGladiator 0 Reputation points
commented 2025-02-10T08:49:19.5233333+00:00
Sakshi Devkante 735 Reputation points Microsoft Vendor
1 answer

Data Connector - Api Restriction

Dear Prisma Cloud Support Team, I am experiencing an issue with the integration between Microsoft Sentinel and Prisma Cloud using the Data Connector described in your documentation (Integrating Prisma Cloud with Azure Sentinel using the Data…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
asked 2025-01-22T12:16:32.56+00:00
Jakub Wierzchowski 0 Reputation points
edited the question 2025-02-06T14:14:01.0533333+00:00
Raja Pothuraju 12,985 Reputation points Microsoft Vendor
1 answer

How to find out which of several authenticators was used in a sign-in?

We are using MFA with Microsoft Authenticator for user sign-ins to our tenant. Many of our users have registered more than one Microsoft Authenticator instance. Sometimes this is deliberate, in order to have a backup in case the primary smartphone is…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,222 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,283 questions
asked 2025-01-13T13:20:23.8366667+00:00
Tilman Schmidt 50 Reputation points
commented 2025-02-04T23:36:25.2333333+00:00
James Hamil 26,996 Reputation points Microsoft Employee