Another blog to help expand Security Knowledge
While working on the videos for my series on how to work with Azure workbooks, I have run into a few places where you can access another workbook but you need to know the workbook’s ID. This is not easy to do as there is button anywhere that can provide this information (I am going […]
I am starting a new series on Azure workbooks. The first video is up on YouTube covering an introduction to Azure Workbooks. The videos in the series (that I have planned so far) are Overview Groups Text Parameters Links/Tabs Query Metrics There may be more since Query, for instance, has a LOT to talk about.
I just noticed this morning that one of my queries in Azure Sentinel returned 30,000 results rather than the old 10,000 it used to. Hopefully this is not a bug and will continue.
Introduction As you probably already know, Jupyter notebooks allow for much great threat hunting than you can get using the OOTB Azure Sentinel Threat Hunting queries, especially when you consider that you can run the Azure Sentinel KQL queries from a Jupyter notebook. Most of the articles written about Azure Sentinel and Jupyter notebooks use […]
There is a new agent that will be replacing the Microsoft Monitoring agent that we all know from Azure Sentinel. It is called the Azure Monitor Agent and you can think of it more of a new system to ingest data rather than an upgrade from the current system. To get a better idea of […]
It has been a while since I wrote a blog post. New house and new responsibilities at work kept me kind of tied up for quite a while, but I have some posts I have been wanting to write for a while so here is the first one. Azure Arc. What is Azure Arc? According […]
While looking at the SigninLogs table in Azure Sentinel I noticed there are a lot of dynamic fields that hold JSON data. I was trying to use parse_json to get to the data but it was always returning empty fields. I then realized that parse_json requires a string input, not a dynamic. After some messing […]
Introduction In Ingesting Azure Sentinel Incident information into Log Analytics, I showed you how to create a Log Analytics workflow to ingest Azure Sentinel Incidents into a Log Analytics workspace. In Ingesting Azure Sentinel Incident information into Log Analytics Part II, I fixed some of the issues I ran into while using the instructions from […]
Introduction This is a continuation of the post Ingesting Azure Sentinel Incident information into Log Analytics. There are a few things that I want to clarify/rectify in it. I was working on the output from my last post to make a useful workbook from it and noticed a few things. Misspelling I misspelled “severity” when […]
Introduction Second Edit: Look at the entry Ingesting Azure Sentinel Incident information into Log Analytics Part II for more updates Edit: I forgot to add the image for the Compose section. Also, there is a typo in it. I have serverity when it should be severity (or whatever else you want to call it). If […]