Another blog to help expand Security Knowledge
Introduction I have been asked quite a bit which API does Microsoft Sentinel do to perform X? That is usually followed up with how did I determine that? The answer to that question is very simple. I have delved into my previous life as a developer and used a tool that was incredibly useful when […]
Introduction There may be times when you have a complicated query that you use in your Microsoft Sentinel workbook that you want to re-use and only filter to show one specific row. Rather than re-running the query, I will show you how to use the “merge” data source in a query step to re-use the […]
Introduction This post is in response to a question that was asked on LinkedIn. The person wanted to know how to get the custom hunting queries using the REST API since it didn’t seem that any of the Microsoft Sentinel APIs retrieve that information. That is correct. There are no Microsoft Sentinel REST APIs to […]
Introduction One of the great new features in Microsoft Sentinel is the Content hub which allows you to search for, and activate, solutions. A solution is a self-contained offering inside of Microsoft Sentinel that can contain Data connectors, Analytic rules, Hunting Queries, Parsers, Playbooks, Workbooks, and/or Watchlists. I really hope that sometime in the future, […]
Introduction Did you know you can call a Microsoft Sentinel playbook from a workbook against an existing incident? It is actually quite easy to do, and this post will go into the details a bit more. ARM Actions One of the options available to use when you add a link to the “ARM Action” (currently […]
