Microsoft Sentinel Blog

Options
1,285
jeffsc on Apr 15 2024 11:17 AM
1,260
jeffsc on Apr 15 2024 11:17 AM
3,854
Preeti_Krishna on Mar 28 2024 02:56 PM
4,863
Matt_Lowe on Mar 14 2024 05:21 PM
3,406
Umesh_Nagdev on Feb 20 2024 07:04 AM
2,917
Josefa-Sepulveda on Feb 08 2024 07:58 AM
5,077
BenjiSec on Feb 06 2024 04:03 AM
4,089
PrateekTaneja on Feb 04 2024 10:22 PM
5,369
madesous on Jan 17 2024 05:27 AM
3,071
GBushey on Jan 16 2024 07:20 AM
3,330
VipulDabhi on Jan 08 2024 11:11 AM
5,970
timurengin on Jan 08 2024 11:10 AM
24.8K
Josefa-Sepulveda on Jan 02 2024 02:24 AM
47K
Arjun_Trivedi on Nov 29 2023 10:13 PM
9,710
skochavi on Nov 27 2023 01:21 PM
8,434
ShaharAviv on Nov 20 2023 10:27 PM
6,453
Eric Burkholder on Nov 15 2023 02:26 PM
60.6K
Erez Einav on Nov 15 2023 08:00 AM
5,332
mahmoudmsft on Nov 08 2023 10:02 AM
14.2K
Pete Bryan on Sep 21 2023 03:02 PM
15.9K
lili on Sep 05 2023 12:18 AM
6,934
Tiander Turpijn on Aug 30 2023 04:33 AM
18.8K
Jeremy Tan on Aug 23 2023 04:30 AM
7,471
Matt_Lowe on Aug 22 2023 09:30 AM
13.3K
Nicolas Lepagnez on Aug 09 2023 04:44 AM
11.6K
MichalShechter on Aug 01 2023 11:02 AM
8,962
Maayan_Magenheim on Jul 25 2023 07:09 AM

Latest Comments

@Matt_Lowe Is it possible to use this to prevent certain logs from being ingested? Xpath for DCR is not customization enough for us to drop certain logs. We are currently trying to drop certain WindowsEvent table logs(windows event forwarding). This certain event is very noisy and has no value. We c...
0 Likes
Hello, Very helpful blog thank you. I have a question though , is this way of automation is recommanded rather than using playbooks/logic apps to trigger the notebooks i need in the context of SOAR capabilities of sentinel ? like is it better ? if so how ?
0 Likes
Hi,i've tried implementing this feature and it was working, but now it's failing with error:POST action failedPOST failed. Missing required permissions for Microsoft Sentinel on the playbook resource '/subscriptions/XXXXXXXXX/resourceGroups/XXXXXXX/providers/Microsoft.Logic/workflows/XXXXXXX'ThanksF...
0 Likes
A question can this be setup for tables like the SecurityEvent and SecurityAlert table. I did the following and could not get it to work. {"Name": "Test Windows Security Logs Table Access","Id": null,"IsCustom": true,"Description": "Enable users to monitor WIndows servers Security Events and Alerts"...
0 Likes
GreetingsI was quick to onboard our Sentinel workspace into our Defender tenant but was then just as quick to find the features available from the Defender portal to be lacking, at least from the perspektive of the workflow we have established in Sentinel over the years.The feature most important to...
0 Likes