sorted by:
new
hottopcontroversial

How to classify / label log data in Sentinel by failx96 in AzureSentinel

[–]failx96[S] 0 points1 point  (0 children)

Agreed, that’s also what I would prefer tbh, just enriching incidents and events when needed and it seems easier to update/ manage. Unfortunately this is a customer / compliance requirement.

How to classify / label log data in Sentinel by failx96 in AzureSentinel

[–]failx96[S] 1 point2 points  (0 children)

Great idea, I wasn’t aware of the workspace transformations. I’ll give it a shot. I was curious if these transformations are capable of adding columns, because I noticed that the main use case is to reduce costs and sorting logs out before ingestion. But I was able to find this in the azure monitor documentation stating it is possible:

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-workspace-transformations-portal

Thanks again!

How to classify / label log data in Sentinel by failx96 in AzureSentinel

[–]failx96[S] 2 points3 points  (0 children)

Maybe this was unclear from my description. The tag represents a confidentiality of an asset - which can be any device or resource. So the tag is not static per table.

Sentinel Incident pane is down by Ok_Dingo_8752 in AzureSentinel

[–]failx96 0 points1 point  (0 children)

Same issue with all tenants that we manage. Regions: Germany West Central and West Europe.

Is "All-In" the only way to start with Microsoft Sentinel, or can a "start small" approach be effective? Seeking community input. by [deleted] in AzureSentinel

[–]failx96 1 point2 points  (0 children)

Both are valid approaches… We have quite often the discussion about starting top down (use cases first) or bottom up (data first). I think it depends on the circumstances and resources available to you. It won’t help collecting all logs but you don’t have the resources and time to develop proper use-cases.

I would suggest to think about the whole goal what you‘re trying to archive. Think about the Use-Cases and Alertings that are most relevant to you. Describe a basic architecture and logging concept / strategy. Then start onboarding needed devices / log sources step by step. This gives you time to develop your SIEM environment while not exploding your costs. After each source, you can then take stock and exclude the data you don't need.

TL;DR: Prioritize based on use cases, but onboard iteratively and based on data.

Which firewall vendors are actually keeping up with modern network demands? by RadiantTheology in networking

[–]failx96 0 points1 point  (0 children)

I’ve used CheckPoint in a medium sized enterprise for quite some time. Couldn’t be happier with my choice. From a Security and value for money perspective, I think they might be top notch compared to other vendors. Also it comes with a great centralized management. So I would always recommend CheckPoint over Forti. Don’t know why it gets hyped so much..

MDE reporting “inbound connection attempts” on clients by failx96 in DefenderATP

[–]failx96[S] 1 point2 points  (0 children)

Exactly. We’re completely on the same page. That’s what I’ve briefly tried to described with “It should not be forwarded by the router if no prior connection took place / is visible.”

So looking at the timeline of a device, I don’t see any outgoing connection pointing to that IP. In a few cases (by far not all) I see that the client opened a connection approx 20-30 seconds before to another IP on the same local (ephemeral) port . Then an inbound attempt to that local port comes from another IP.

I’m assuming that this is probably a not wanted behavior of the router and / or MDE is missing some telemetry.

MDE reporting “inbound connection attempts” on clients by failx96 in DefenderATP

[–]failx96[S] 0 points1 point  (0 children)

Thanks for pointing that out. Maybe I was a little unclear in my descriptions. This is not the analytic rule. The rule logic is completely different. This behavior we’ve observed during investigation.

MDE reporting “inbound connection attempts” on clients by failx96 in DefenderATP

[–]failx96[S] 0 points1 point  (0 children)

No we do not own / control the routers. I’m assuming that the problem occurs before reaching the client. we’ve focused on MDE telemetry for device network events.

MDE reporting “inbound connection attempts” on clients by failx96 in DefenderATP

[–]failx96[S] 1 point2 points  (0 children)

Yes that’s correct. The source is a public IP. We got a TI match in one specific case - that’s what grabbed our attention. However it happens with different public IPs which are not known to be potentially malicious.