1,123 questions with Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
1 answer

integrating Snowflake with Microsoft Sentinel

i need to integrating Snowflake with Microsoft Sentinel what grants the role needs for this integration?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-08-07T14:08:46.7+00:00
Ali Salem Panah 0 Reputation points
answered 2024-08-12T08:50:42.5633333+00:00
Sandeep G-MSFT 18,766 Reputation points Microsoft Employee
0 answers

'Microsoft Community v2' in the SigninLogs Table

Hi all, Would anyone be able to explain what 'Microsoft Community v2' is under the AppDisplayName within the SigininLogs table in Sentinel. Does anyone know what this is used for and why it would be triggered failed sign-in attempts for users? Thanks,

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-08-09T12:46:42.1166667+00:00
Steven Henwood 0 Reputation points
edited a comment 2024-08-09T14:18:51.3033333+00:00
Andrew Blumhardt 9,856 Reputation points Microsoft Employee
3 answers One of the answers was accepted by the question author.

Not allowing to connect Sentinel Data connector with Defender XDR

Hello, I was trying to connect the "Microsoft Defender XDR" connector with "Microsoft Sentinel", but I am facing the below error. I am not sure why Sentinel is not allowing to establish the XDR connector. As I am the Owner of the…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
192 questions
asked 2024-05-08T12:07:43.2433333+00:00
Karan Bhatt 47 Reputation points
accepted 2024-08-09T09:22:01.3433333+00:00
Karan Bhatt 47 Reputation points
2 answers

Tenable Nessus Data Connector Not working on Microsoft Sentinel

Hello good day, I deploy the Tenable Nessus Data connector to Sentinel using the ARM Template. I have gone over this setup several times without fail. All my settings are right. I see even see the Function App and other dependent components. Everything…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-08-05T11:25:30.8266667+00:00
Evidence Monday 0 Reputation points
answered 2024-08-08T22:24:34.21+00:00
Marilee Turscak-MSFT 36,821 Reputation points Microsoft Employee
3 answers

In Logic apps how to pass a single backslash (\) as string in another action?

Hello there, I am making an logic app which has one http request action. Inside that http body I want to pass a variable which has a string with backslash But when I tried every single backslash was transformed into two backslash Can…

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
3,087 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2022-07-14T04:33:25.483+00:00
Bharvi Bhut 181 Reputation points
answered 2024-08-08T20:57:44.18+00:00
Robert 0 Reputation points
1 answer One of the answers was accepted by the question author.

Does anybody know if or when new Cisco Meraki connector that supports AMA for Sentinel will be published?

I would like to find out if Microsoft or Cisco are planning to release updated connector for Sentinel for Cisco Meraki to support AMA agent? Any idea when? Thanks

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-03-08T02:00:05.3666667+00:00
AdamKlocek-3110 40 Reputation points
commented 2024-08-08T08:31:14.0266667+00:00
pemontto 0 Reputation points
1 answer One of the answers was accepted by the question author.

How to parse CSV data in Data Collection Rule?

Hello, I can parse CSV data with this KQL in LAW: parse_csv(RawData) However, when I use it in the Transform section of the Data Collection Rule, I get the following error: Update Error - Error occurred while compiling query in query:…

Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,174 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-08-06T23:24:13.02+00:00
Yusuf KUYRUKÇU 20 Reputation points
accepted 2024-08-08T05:50:55.8466667+00:00
Yusuf KUYRUKÇU 20 Reputation points
0 answers

Postgre SQL DB logs

I am trying to connect PostgreSQL DB Events to Microsoft Sentinel using the PostgreSQL Events built in data connector. All the configurations are done properly, heartbeat is there from the machine where this PostgreSQL is installed, but no logs. We are…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,371 questions
asked 2024-07-25T05:14:21.27+00:00
Praveen Ayyasamy 40 Reputation points
edited the question 2024-08-06T03:36:12.6933333+00:00
Givary-MSFT 32,311 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

Scaling your CICD pipeline - Default parameter file is not being used

I am currently working on a CICD pipeline in combination with MS Sentinel content. I just got in touch with the repository and the process of handling parameter files. I am just asking myself why the default parameter file is not being used. All of my…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-16T09:17:24.5566667+00:00
Wagner Nico 20 Reputation points
accepted 2024-08-05T10:22:58.7566667+00:00
Wagner Nico 20 Reputation points
2 answers One of the answers was accepted by the question author.

Microsoft Sentinel, Azure Policy

I am having a greater number of Azure Databricks, I need to integrate the audit logs of Data Bricks to Sentinel. Currently there is no in-built Data Connector. Manually going to each Data Bricks and adding Diagnostic settings is not possible. There is an…

Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
868 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-25T05:11:00.2766667+00:00
Praveen Ayyasamy 40 Reputation points
accepted 2024-07-31T02:00:20.6666667+00:00
Praveen Ayyasamy 40 Reputation points
1 answer One of the answers was accepted by the question author.

How to ingest NetFlow into Sentinel

Is there a Sentinel connector for Cisco NetFlow ?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-18T13:32:34.2833333+00:00
Chad Hutchings 20 Reputation points Microsoft Employee
accepted 2024-07-30T13:35:08.76+00:00
Chad Hutchings 20 Reputation points Microsoft Employee
1 answer

A logic app Get-VirusTotalIPReport is not working

I am trying to automate IP enrichment using the Virus Total API. I have set up a logic app and tied it to a respective analytical rule but I am getting the following error. This is a test instance and we have only few resources running on it.

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
3,087 questions
Azure Automation
Azure Automation
An Azure service that is used to automate, configure, and install updates across hybrid environments.
1,241 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-30T11:07:58.4133333+00:00
Bhupender Singh 0 Reputation points
answered 2024-07-30T11:33:30.39+00:00
Sedat SALMAN 13,740 Reputation points
1 answer

Add Microsoft Sentinel to Log Analytics Workspace using Ansible

I am trying to create a Log Analytics Workspace with Microsoft Sentinel using Ansible following this module: https://docs.ansible.com/ansible/latest/collections/azure/azcollection/azure_rm_loganalyticsworkspace_module.html - name: Create a workspace…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-25T19:02:15.28+00:00
Ravalia Krutika Harishbhai 40 Reputation points
edited an answer 2024-07-29T12:28:00.28+00:00
Andrew Blumhardt 9,856 Reputation points Microsoft Employee
3 answers

Syslog through AMA connector not showing in the content hub list.

Hi, Trying to set up a syslog ingestion into Sentinel for testing. The setup consists of AMA on a on-prem syslog server. The legacy agent is soon not supported, and the requirement of AMA on-prem is according to Microsoft guides to have the following…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-06-03T09:40:15.5033333+00:00
Bl()e 25 Reputation points
answered 2024-07-29T10:15:01.2733333+00:00
Bl()e 25 Reputation points
3 answers

Microsoft Sentinel Threat Indicators API - nextLink returns same page

Hello, I have an issue where the nextLink is always returning the first page of the Threat Indicators in Sentinel. I'm using the following API-Uri to retrieve all Threat Indicators in a Sentinel Workspace…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-03-23T21:12:01.4666667+00:00
Benedict Schmieder 0 Reputation points
answered 2024-07-26T08:28:23.0733333+00:00
Fabian Bader 0 Reputation points
1 answer

Trend Micro Deep Security Data Connector in AMA

I am deploying and configuring Sentinel for a new customer. To my surprise today I found that the data connector used for the integration of TrenMicro DeepSecurity only supports integration via OMS/MMA. This agent will be decommissioned in August and I…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-19T09:56:51.57+00:00
Eduardo Vilar 0 Reputation points
commented 2024-07-26T03:12:57.3133333+00:00
Givary-MSFT 32,311 Reputation points Microsoft Employee
2 answers

Syslog through AMA (CEF) Connector

Hi, Follwing up on my last question: https://video2.skills-academy.com/en-us/answers/questions/1690671/syslog-through-ama-connector-not-showing-in-the-co I have now installed Arc, and the machine is showing up on Azure Arc. The AMA is installed and is…

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,196 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-06-11T10:30:54.9766667+00:00
Bl()e 25 Reputation points
answered 2024-07-25T20:11:20.5233333+00:00
Kaspars Ročāns 10 Reputation points
1 answer

How to install Content Hub solutions via Bicep?

We are trying to deploy Sentinel as IaC and we'd like to install various different content hub solutions via Bicep, we are getting no errors, and inside Content Hub we can see the Solution is installed - but no connector is showing. Below is Bicep I am…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-23T23:13:25.9533333+00:00
Matthew Jensen 20 Reputation points
answered 2024-07-24T17:34:01.4966667+00:00
Iheanacho Chukwu 745 Reputation points
1 answer One of the answers was accepted by the question author.

Trying to give a user rights to MS Sentential but nothing else inside of Aure

Right now I am trying to give a user rights to MS Sentential to customize it but not give admin access to Azure. Here is what I have created so far but Still getting issues. { "properties": { "roleName": "MS Azure…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-24T10:27:54.5866667+00:00
Peter Wilcox 21 Reputation points
accepted 2024-07-24T12:28:54.46+00:00
Peter Wilcox 21 Reputation points
2 answers

Cloudflare Data Connector Error: `Provided WorkspaceResourceId is invalid (Code: BadRequest)`

I am trying to deploy the Cloudflare (preview) (using Azure Functions) Microsoft Sentinel | Data Connector. I have installed the connector and select Option 1 - Deploy to Azure button. I have provided the following parameters: To obtain the App Insights…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
asked 2024-07-23T09:19:37.23+00:00
Ben Smith 0 Reputation points
answered 2024-07-24T10:59:55.67+00:00
Shweta Mathur 29,741 Reputation points Microsoft Employee