Login

r/AzureSentinel

Sentinel diagnostic settings
▲ 3 r/AzureSentinel

Sentinel diagnostic settings

Hi

Curious how you utilize the SentinelHealth table? One scenario at the top of my mind - our connector monitoring is queries dependend on the tables to the actual connectors, but we are especially curious to monitor connector health with these diagnostic settings.

As far as diagnostic settings go, there are three categories, 'Analytics', 'Automation' and 'Data Collection - Connectors'. As per my understandings, these won't generate cost and are not billable. Is that correct? Ref. https://learn.microsoft.com/en-us/azure/sentinel/health-audit

u/Historical-Ear7543 — 1 day ago
▲ 2 r/AzureSentinel

Exporting a list of all incidents from Sentinel

I'm trying to export a csv of all the incidents ever registered in Sentinel in my org. This covers 2+ years of Sentinel usage. I did some digging and it turns out you cannot export data from the Threat Mgmt > Incidents tab. You can however export a table of incidents from Log Analytics by SecurityIncident query (set the time frame to the earliest data possible).

So I did exactly that and set the display count to "max limit". Each time, the query only outputs a list going back 90 days in time. Is there a data retention limit in Log Analytics that doesn't allow you to view or export incidents longer than 90 days?

Is there any other way I can go about exporting ALL incidents registered in Sentinel?

Thanks!

reddit.com
u/Nice_Bag3423 — 7 days ago
▲ 4 r/AzureSentinel

Deploying Multiple Pre-Built Connectors (Workday, Salesforce, etc)

My organization has multiple tenants for Workday, Salesforce, and other similar apps. Unfortunately, most pre-built connectors only allow connecting to one environment per app. Is there any way around this? Any way to deploy duplicate connectors?

reddit.com
u/Lazy_Pianist5413 — 8 days ago
▲ 18 r/AzureSentinel

Identify which MFA methods your users actually use.

A simple KQL query against Sign-in logs gives you visibility into the MFA methods users are actually using:

SigninLogs
| where TimeGenerated > ago(90d)
| where ResultType == 0
| mv-expand AuthDetails = todynamic(AuthenticationDetails)
| extend AuthMethod = tostring(AuthDetails.authenticationMethod)
| where isnotempty(AuthMethod)
| where AuthMethod !in ("Previously satisfied")
| summarize AuthEvents = count(), Users = dcount(UserPrincipalName) by AuthMethod
| order by AuthEvents desc

https://preview.redd.it/nk9rrwqozj0h1.png?width=2664&format=png&auto=webp&s=7b6fab415cec249205902a39a05dd13f8c96e7fe

reddit.com
u/EduardsGrebezs — 11 days ago