Microsoft Sentinel Blog

Options
1,679
Umesh_Nagdev on Apr 19 2024 07:55 AM
1,461
jeffsc on Apr 15 2024 11:17 AM
1,468
jeffsc on Apr 15 2024 11:17 AM
4,027
Preeti_Krishna on Mar 28 2024 02:56 PM
5,030
Matt_Lowe on Mar 14 2024 05:21 PM
3,628
Umesh_Nagdev on Feb 20 2024 07:04 AM
2,978
Josefa-Sepulveda on Feb 08 2024 07:58 AM
5,167
BenjiSec on Feb 06 2024 04:03 AM
4,234
PrateekTaneja on Feb 04 2024 10:22 PM
5,443
madesous on Jan 17 2024 05:27 AM
3,132
GBushey on Jan 16 2024 07:20 AM
3,393
VipulDabhi on Jan 08 2024 11:11 AM
6,070
timurengin on Jan 08 2024 11:10 AM
25.1K
Josefa-Sepulveda on Jan 02 2024 02:24 AM
47.3K
Arjun_Trivedi on Nov 29 2023 10:13 PM
9,818
skochavi on Nov 27 2023 01:21 PM
8,505
ShaharAviv on Nov 20 2023 10:27 PM
6,517
Eric Burkholder on Nov 15 2023 02:26 PM
61.1K
Erez Einav on Nov 15 2023 08:00 AM
5,377
mahmoudmsft on Nov 08 2023 10:02 AM
14.3K
Pete Bryan on Sep 21 2023 03:02 PM
15.9K
lili on Sep 05 2023 12:18 AM
6,975
Tiander Turpijn on Aug 30 2023 04:33 AM
19K
Jeremy Tan on Aug 23 2023 04:30 AM
7,526
Matt_Lowe on Aug 22 2023 09:30 AM
13.4K
Nicolas Lepagnez on Aug 09 2023 04:44 AM
11.7K
MichalShechter on Aug 01 2023 11:02 AM

Latest Comments

@Matt_Lowe Is it possible to use this to prevent certain logs from being ingested? Xpath for DCR is not customization enough for us to drop certain logs. We are currently trying to drop certain WindowsEvent table logs(windows event forwarding). This certain event is very noisy and has no value. We c...
0 Likes
Hello, Very helpful blog thank you. I have a question though , is this way of automation is recommanded rather than using playbooks/logic apps to trigger the notebooks i need in the context of SOAR capabilities of sentinel ? like is it better ? if so how ?
0 Likes
Hi,i've tried implementing this feature and it was working, but now it's failing with error:POST action failedPOST failed. Missing required permissions for Microsoft Sentinel on the playbook resource '/subscriptions/XXXXXXXXX/resourceGroups/XXXXXXX/providers/Microsoft.Logic/workflows/XXXXXXX'ThanksF...
0 Likes
A question can this be setup for tables like the SecurityEvent and SecurityAlert table. I did the following and could not get it to work. {"Name": "Test Windows Security Logs Table Access","Id": null,"IsCustom": true,"Description": "Enable users to monitor WIndows servers Security Events and Alerts"...
0 Likes
GreetingsI was quick to onboard our Sentinel workspace into our Defender tenant but was then just as quick to find the features available from the Defender portal to be lacking, at least from the perspektive of the workflow we have established in Sentinel over the years.The feature most important to...
0 Likes