1,225 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
1 answer

Filtering Logs

We have a rsyslog server on prem that we are sending on premise firewall, switch and load balancer logs to. We are using the Cisco FTD connector for our firewalls and the regular syslog on for everything else. Problem I am having is that the FTD logs are…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-21T01:46:21.6366667+00:00
Gary S 0 Reputation points
edited a comment 2025-02-21T20:34:37.0833333+00:00
Gary S 0 Reputation points
2 answers

Why defender is not correlating the Entra ID protection alerts?

Hi Team, In my environment, Entra ID Protection is generating multiple alerts even when the user, IP address, and sign-in events are the same and occur within seconds. These alerts are forwarded to Microsoft Defender, but they are not being correlated,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
251 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,339 questions
asked 2025-02-17T14:53:42.8366667+00:00
Supriya Nelluri 0 Reputation points
commented 2025-02-21T16:42:32.9133333+00:00
Sakshi Devkante 925 Reputation points Microsoft Vendor
0 answers

Data connector buttons are grayed out saying No permissions

cannot enable Microsoft Defender XDR connector in sentinel despite being logged in as owner of tenant, subscription and resource group. My licence is Microsoft 365 Business Premium which I see in documentation is an Microsoft XDR eligible licence

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
251 questions
asked 2025-02-13T12:41:56.3866667+00:00
gutta bachelor 0 Reputation points
commented 2025-02-21T10:50:00.04+00:00
Navya 15,715 Reputation points Microsoft Vendor
0 answers

KQL Queries not showing results

No matter what is attempted in KQL, all queries consistently run past 30 minutes. Repeated attempts to recreate the VMs, Sentinels, Workspaces, etc., have not resolved the issue.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
8,406 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-15T20:02:19.6533333+00:00
MTOrion 0 Reputation points
commented 2025-02-21T00:41:43.34+00:00
Nagarjuna Reddy Yanna 0 Reputation points Microsoft Vendor
1 answer

Azure Activity Data connector not getting delelet from MS Sentinel

I'm not able to delete Azure Activity data connector from MS Sentinel. I had deleted the Azure policy the one created by connector and also removed IAM role on subscription for the managed identities created by connector while adding it. After all…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-19T12:09:04.6233333+00:00
Muhammad Rizwan 0 Reputation points
commented 2025-02-20T21:51:35.6466667+00:00
Venkata Jagadeep 170 Reputation points Microsoft Vendor
1 answer

Connect data to Microsoft Sentinel using data connectors Salesforce

I need help integrating SaleForce and Wiz into my siem.

Viva Connections
Viva Connections
A Microsoft Viva module that provides a gateway to a modern engagement experience.
106 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,339 questions
asked 2025-02-10T14:57:39.59+00:00
Dunham, Jermey 0 Reputation points
commented 2025-02-20T04:52:13.6366667+00:00
Chaithra E 480 Reputation points Microsoft Vendor
1 answer

Cannot read data from Cloudflare in Azure Sentinel

I already setting logpush from Cloudflare to Azure sentinel. it only show test log only

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-11T01:11:01.3066667+00:00
amir rachman 0 Reputation points
commented 2025-02-19T21:25:31.0833333+00:00
Raja Pothuraju 13,795 Reputation points Microsoft Vendor
0 answers

Microsoft Sentinel API - "triggerRuleRun" ExecutionTimeUtc Always Invalid

Issue Summary We are trying to manually trigger a Microsoft Sentinel Scheduled Analytics Rule using the triggerRuleRun API, but it always fails with the following error: { Even when using the correct timestamp format, the API never accepts…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-19T10:13:34.1966667+00:00
Shafiq Aziz (Admin Account) 0 Reputation points
edited the question 2025-02-19T15:40:09.0566667+00:00
Rakesh Gurram 12,385 Reputation points Microsoft Vendor
0 answers

Alert XX was added to the incident by Microsoft Defender XDR - alert correlation

Hey, I am sending alarms/incidents from another SIEM to sentinel for centralization. The goal is that sentinel mirrors the alarms/incidents exactly. The data is sent to a custom log table, in the log analytics workspace through an API call, and I have a…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-18T07:01:10.58+00:00
Horne, Lorents Birkeland 0 Reputation points
1 answer

Need help with solution to deploy sentinel in US region and China region

I want to deploy sentinel in US region and China region. is it possible to send logs using DCR rules from China to workspace build in US region or do I need to build 2 workspace separately and send logs from China to US using event Hub . Incase I…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-10T05:52:12.9666667+00:00
sameer khandar 0 Reputation points
commented 2025-02-17T13:37:02.8566667+00:00
Sakshi Devkante 925 Reputation points Microsoft Vendor
1 answer

How to integrate paloalto firewall on-premises and cloud with Microsoft sentinel step by step

How to integrate paloalto firewall on-premises and cloud with Microsoft sentinel step by step

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2024-12-15T09:21:08.1633333+00:00
suraj hirekudi 0 Reputation points
commented 2025-02-17T13:00:57.9566667+00:00
Pavlo Khazov 0 Reputation points
1 answer

Why use Fortinet Connector instead of a Function App for registering an action group in the Fortinet-FortiGate playbook?

Hello, I am setting up the Fortinet-FortiGate playbook and noticed that for registering an action group in FortiGate, the playbook uses the Fortinet Connector instead of a Function App. Why was the Fortinet Connector chosen for this action instead of a…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-12T05:09:01.1633333+00:00
mara7 166 Reputation points
commented 2025-02-17T01:55:05.46+00:00
mara7 166 Reputation points
1 answer

This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix.

Applied skills Name: Deploy containers by using Azure Kubernetes Service Issue: This assessment is currently disabled due to a technical issue. Explore our other Applied Skills while we work on a fix.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2024-03-24T11:56:12.4166667+00:00
pritam bhor 25 Reputation points
commented 2025-02-14T14:45:49.79+00:00
REZAI Arash 0 Reputation points
3 answers

Problem with Microsoft Sentinel Connector

Hello, for test i have deploy sentinel 2 or 3 time and after that i delete Workpace. Now i have recreted new Workspace and when i try connect connector i recevive the following error: I have just try to find if there are other diagnostics settings but…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-01T09:06:59.5833333+00:00
Guido Imperatore 20 Reputation points MVP
answered 2025-02-13T11:06:33.1466667+00:00
Alex Burlachenko 1,190 Reputation points
1 answer

Issues trying to connect to MITRE ATT&CK STIX 2.1 Feed from Sentinel Threat Intelligence

Hi, I am having issues while trying to connect to the MITRE ATT&CK STIX 2.1 Feed from within Sentinel's Threat Intelligence module. I have the 'Threat Intelligence - TAXII' data connector enabled (with another TAXII server…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-03T04:58:21.01+00:00
WillAngus-6254 5 Reputation points
commented 2025-02-13T11:03:42.4+00:00
Raja Pothuraju 13,795 Reputation points Microsoft Vendor
2 answers One of the answers was accepted by the question author.

Azure Sentinel - Query help

Dear All, I need to write query to hunt for OS Credential Dumping: NTDS. T1003.003, kindly help if you got any information

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2022-02-15T14:33:19.247+00:00
karthik palani 1,036 Reputation points
commented 2025-02-13T02:44:17.5833333+00:00
useR 0 Reputation points
2 answers

Need kql to query purview sensitive, not-encrypted, externally sent data

Hi there, I'm trying to understand if I can use kql to query the following about Purview events. Here's a 'hypothetical' kql query that works logically, but I'm struggling to create a Purview policy that matches this. I've created a 'sensitive' label,…

Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,406 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-06T17:19:01.5233333+00:00
David Broggy 6,101 Reputation points MVP
commented 2025-02-12T19:00:16.4033333+00:00
Oury Ba-MSFT 20,346 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

No access to DeviceTvmSoftwareVulnerabilities table in Sentinel?

There is an XDR analytic rule in Sentinel named "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863" However the kql query used by this rule requires access to the DeviceTvmSoftwareVulnerabilities table. But according to…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-02-07T20:06:08.39+00:00
David Broggy 6,101 Reputation points MVP
edited a comment 2025-02-12T12:25:12.1+00:00
Jonathan James 0 Reputation points
1 answer

Inound connection identified as Outbound by Microsoft Sentinel

I have noticed that there are several outbound connections in the overview page. However, having analyzed the traffic, I realized that inbound traffic labeled as outbound traffic. Note: I have removed the destination IPs as they are…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2022-10-27T03:53:39.813+00:00
Nimantha Deshappriya 21 Reputation points
edited an answer 2025-02-11T16:30:45.8033333+00:00
Luis Arias 7,861 Reputation points
1 answer

What is the size limit of rawContent of watchlist when bundled in solution package?

We are using watchlists to upload data via csv files and using it in worksbook. As per the document, there is a size limit of 3.8MB while creating watchlist using local csv files. So, we have created csv files of size 2.5MB, using which we are able to…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,225 questions
asked 2025-01-31T06:30:59.1833333+00:00
Nirali Shah 151 Reputation points
commented 2025-02-11T15:42:35.7733333+00:00
Raja Pothuraju 13,795 Reputation points Microsoft Vendor