Microsoft Sentinel Blog

Options
1,254
jeffsc on Apr 15 2024 11:17 AM
1,222
jeffsc on Apr 15 2024 11:17 AM
3,846
Preeti_Krishna on Mar 28 2024 02:56 PM
4,853
Matt_Lowe on Mar 14 2024 05:21 PM
3,400
Umesh_Nagdev on Feb 20 2024 07:04 AM
2,913
Josefa-Sepulveda on Feb 08 2024 07:58 AM
5,074
BenjiSec on Feb 06 2024 04:03 AM
4,082
PrateekTaneja on Feb 04 2024 10:22 PM
5,366
madesous on Jan 17 2024 05:27 AM
3,068
GBushey on Jan 16 2024 07:20 AM
3,327
VipulDabhi on Jan 08 2024 11:11 AM
5,964
timurengin on Jan 08 2024 11:10 AM
24.8K
Josefa-Sepulveda on Jan 02 2024 02:24 AM
46.9K
Arjun_Trivedi on Nov 29 2023 10:13 PM
9,699
skochavi on Nov 27 2023 01:21 PM
8,431
ShaharAviv on Nov 20 2023 10:27 PM
6,449
Eric Burkholder on Nov 15 2023 02:26 PM
60.6K
Erez Einav on Nov 15 2023 08:00 AM
5,328
mahmoudmsft on Nov 08 2023 10:02 AM
14.2K
Pete Bryan on Sep 21 2023 03:02 PM
15.9K
lili on Sep 05 2023 12:18 AM
6,933
Tiander Turpijn on Aug 30 2023 04:33 AM
18.8K
Jeremy Tan on Aug 23 2023 04:30 AM
7,470
Matt_Lowe on Aug 22 2023 09:30 AM
13.3K
Nicolas Lepagnez on Aug 09 2023 04:44 AM
11.6K
MichalShechter on Aug 01 2023 11:02 AM
8,961
Maayan_Magenheim on Jul 25 2023 07:09 AM

Latest Comments

@Matt_Lowe Is it possible to use this to prevent certain logs from being ingested? Xpath for DCR is not customization enough for us to drop certain logs. We are currently trying to drop certain WindowsEvent table logs(windows event forwarding). This certain event is very noisy and has no value. We c...
0 Likes
Hello, Very helpful blog thank you. I have a question though , is this way of automation is recommanded rather than using playbooks/logic apps to trigger the notebooks i need in the context of SOAR capabilities of sentinel ? like is it better ? if so how ?
0 Likes
Hi,i've tried implementing this feature and it was working, but now it's failing with error:POST action failedPOST failed. Missing required permissions for Microsoft Sentinel on the playbook resource '/subscriptions/XXXXXXXXX/resourceGroups/XXXXXXX/providers/Microsoft.Logic/workflows/XXXXXXX'ThanksF...
0 Likes
A question can this be setup for tables like the SecurityEvent and SecurityAlert table. I did the following and could not get it to work. {"Name": "Test Windows Security Logs Table Access","Id": null,"IsCustom": true,"Description": "Enable users to monitor WIndows servers Security Events and Alerts"...
0 Likes
GreetingsI was quick to onboard our Sentinel workspace into our Defender tenant but was then just as quick to find the features available from the Defender portal to be lacking, at least from the perspektive of the workflow we have established in Sentinel over the years.The feature most important to...
0 Likes