You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/audit-sentinel-data.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ Use the **AzureActivity** table when auditing activity in your SOC environment w
36
36
37
37
**To query the AzureActivity table**:
38
38
39
-
1. Install the **Azure Activity solution for Sentinel** solution and connect the [Azure Activity](./data-connectors/azure-activity.md) data connector to start streaming audit events into a new table called `AzureActivity`.
39
+
1. Install the **Azure Activity solution for Sentinel** solution and connect the [Azure Activity](./data-connectors-reference.md#azure-activity) data connector to start streaming audit events into a new table called `AzureActivity`.
40
40
41
41
1. Query the data using Kusto Query Language (KQL), like you would any other table:
Copy file name to clipboardExpand all lines: articles/sentinel/data-transformation.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -68,7 +68,7 @@ The following table describes DCR support for Microsoft Sentinel data connector
68
68
69
69
| Data connector type | DCR support |
70
70
| ------------------- | ----------- |
71
-
|[**Azure Monitor agent (AMA) logs**](connect-services-windows-based.md), such as: <li>[Windows Security Events via AMA](./data-connectors/windows-security-events-via-ama.md)<li>[Windows Forwarded Events](./data-connectors/windows-forwarded-events.md)<li>[CEF data](connect-cef-ama.md)<li>[Syslog data](connect-cef-syslog.md)| One or more DCRs associated with the agent |
71
+
|[**Azure Monitor agent (AMA) logs**](connect-services-windows-based.md), such as: <li>[Windows Security Events via AMA](./data-connectors-reference.md#windows-security-events-via-ama)<li>[Windows Forwarded Events](./data-connectors/windows-forwarded-events)<li>[CEF data](connect-cef-ama.md)<li>[Syslog data](connect-cef-syslog.md)| One or more DCRs associated with the agent |
72
72
|**Direct ingestion via [Logs ingestion API](/azure/azure-monitor/logs/logs-ingestion-api-overview)**| DCR specified in API call |
73
73
|**Built-in, API-based data connector**, such as: <li>[Codeless data connectors](create-codeless-connector.md)| DCR created for connector |
74
74
|[**Diagnostic settings-based connections**](connect-services-diagnostic-setting-based.md)| Workspace transformation DCR with [supported output tables](/azure/azure-monitor/logs/tables-feature-support)|
Copy file name to clipboardExpand all lines: articles/sentinel/dynamics-365/dynamics-365-finance-operations-security-content.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ This article details the security content available for the Microsoft Sentinel s
25
25
|**F&O – Mass update or deletion of user account records**|Identifies large delete or update operations on Finance and Operations user records based on predefined thresholds. <br><br>Default update threshold: **50**<br>Default delete threshold: **10**|Deletions or modifications in Finance and Operations portal, under **Modules > System Administration > Users**<br><br>Data source: `FinanceOperationsActivity_CL`|Impact |
26
26
|**F&O – Bank account change following network alias reassignment**|Identifies updates to bank account number by a user account which his alias was recently modified to a new value. |Changes in bank account number, in Finance and Operations portal, under **Workspaces > Bank management > All bank accounts** correlated with a relevant change in the user account to alias mapping.<br><br>Data source: `FinanceOperationsActivity_CL`|Credential Access, Lateral Movement, Privilege Escalation |
27
27
|**F&O – Reverted bank account number modifications**|Identifies changes to bank account numbers in Finance & Operations, whereby a bank account number is modified but then subsequently reverted a short time later. |Changes in bank account number, in Finance and Operations portal, under **Workspaces > Bank management > All bank accounts**.<br><br>Data source: `FinanceOperationsActivity_CL`|Impact |
28
-
|**F&O – Unusual sign-in activity using single factor authentication**|Identifies successful sign-in events to Finance & Operations and Lifecycle Services using single factor/password authentication. <br><Br>Sign-in events from tenants that aren't using MFA, coming from a Microsoft Entra ID trusted network location, or from geographic locations seen in the last 14 days are excluded.<br><br>This detection uses logs ingested from Microsoft Entra ID and you must enable the [Microsoft Entra data connector](../data-connectors/microsoft-entra-id.md). |Sign-ins to the monitored Finance and Operations environment.<br><br>Data source: `Signinlogs`|Credential Access, Initial Access |
28
+
|**F&O – Unusual sign-in activity using single factor authentication**|Identifies successful sign-in events to Finance & Operations and Lifecycle Services using single factor/password authentication. <br><Br>Sign-in events from tenants that aren't using MFA, coming from a Microsoft Entra ID trusted network location, or from geographic locations seen in the last 14 days are excluded.<br><br>This detection uses logs ingested from Microsoft Entra ID and you must enable the [Microsoft Entra data connector](../data-connectors-reference.md#microsoft-entra-id). |Sign-ins to the monitored Finance and Operations environment.<br><br>Data source: `Signinlogs`|Credential Access, Initial Access |
Copy file name to clipboardExpand all lines: articles/sentinel/fusion.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -77,9 +77,9 @@ When the Fusion engine's correlations result in the detection of an emerging thr
77
77
Microsoft Sentinel's Fusion engine generates an incident when it detects multiple alerts of different types from the following data sources, and determines that they might be related to ransomware activity:
78
78
79
79
-[Microsoft Defender for Cloud](connect-defender-for-cloud.md)
80
-
-[Microsoft Defender for Endpoint](./data-connectors/microsoft-defender-for-endpoint.md)
81
-
-[Microsoft Defender for Identity connector](./data-connectors/microsoft-defender-for-identity.md)
82
-
-[Microsoft Defender for Cloud Apps](./data-connectors/microsoft-defender-for-cloud-apps.md)
80
+
-[Microsoft Defender for Endpoint](./data-connectors-reference.md#microsoft-defender-for-endpoint)
81
+
-[Microsoft Defender for Identity connector](./data-connectors-reference.md#microsoft-defender-for-identity)
82
+
-[Microsoft Defender for Cloud Apps](./data-connectors-reference.md#microsoft-defender-for-cloud-apps)
83
83
-[Microsoft Sentinel scheduled analytics rules](scheduled-rules-overview.md). Fusion only considers scheduled analytics rules with tactics information and mapped entities.
84
84
85
85
Such Fusion incidents are named **Multiple alerts possibly related to Ransomware activity detected**, and are generated when relevant alerts are detected during a specific time-frame and are associated with the **Execution** and **Defense Evasion** stages of an attack.
Copy file name to clipboardExpand all lines: articles/sentinel/prepare-multiple-workspaces.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,7 +47,7 @@ When determining how many tenants and workspaces to use, consider that most Micr
47
47
48
48
In case of an MSSP, many if not all of the above requirements apply, making multiple workspaces, across tenants, the best practice. Specifically, we recommend that you create at least one workspace for each Microsoft Entra tenant to support built-in, [service to service data connectors](connect-data-sources.md#service-to-service-integration-for-data-connectors) that work only within their own Microsoft Entra tenant.
49
49
50
-
- Connectors that are based on diagnostics settings can't be connected to a workspace that isn't located in the same tenant where the resource resides. This applies to connectors such as [Azure Firewall](./data-connectors/azure-firewall.md), [Azure Storage](./data-connectors/azure-storage-account.md), [Azure Activity](./data-connectors/azure-activity.md) or [Microsoft Entra ID](connect-azure-active-directory.md).
50
+
- Connectors that are based on diagnostics settings can't be connected to a workspace that isn't located in the same tenant where the resource resides. This applies to connectors such as [Azure Firewall](./data-connectors-reference.md#azure-firewall), [Azure Storage](./data-connectors-reference.md#azure-storage-account), [Azure Activity](./data-connectors-reference.md#azure-activity) or [Microsoft Entra ID](connect-azure-active-directory.md).
51
51
52
52
-[Partner data connectors](data-connectors-reference.md) are often based on API or agent collections, and therefore are not attached to a specific Microsoft Entra tenant.
Copy file name to clipboardExpand all lines: articles/sentinel/sentinel-content-centralize.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,7 +54,7 @@ The key to experiencing the updated behavior is to start in **Content hub**. For
54
54
55
55
For more information on the new solution content behavior, see [Discover and deploy OOTB content](sentinel-solutions-deploy.md#enable-content-items-in-a-solution).
56
56
57
-
If there was a particular sample query for a third party data connector you are looking for, we still publish them in our **All connectors** index. For example, here are the sample queries for the [Jamf Protect connector](data-connectors/jamf-protect.md).
57
+
If there was a particular sample query for a third party data connector you are looking for, we still publish them in our **All connectors** index. For example, here are the sample queries for the [Jamf Protect connector](data-connectors-reference.md#jamf-protect).
|**[Microsoft Defender for IoT](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot?tab=Overview)**|[Analytics rules, playbooks, workbook](iot-advanced-threat-monitoring.md)| Internet of Things (IoT), Security - Threat Protection | Microsoft |
50
50
|**[Maturity Model for Event Log Management M2131](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-maturitymodelforeventlogma?tab=Overview)**|[Analytics rules, hunting queries, playbooks, workbook](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)| Compliance | Microsoft|
Copy file name to clipboardExpand all lines: articles/sentinel/top-workbooks.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ The following table includes workbooks we recommend and the solution or standalo
36
36
|**Identity & Access**| Provides insight into identity and access operations by collecting and analyzing security logs, using the audit and sign-in logs to gather insights into use of Microsoft products. |Windows Security Events|
37
37
|**Incident Overview**| Designed to help with triage and investigation by providing in-depth information about an incident, including general information, entity data, triage time, mitigation time, and comments. <br><br>For more information, see [The Toolkit for Data-Driven SOCs](https://techcommunity.microsoft.com/t5/azure-sentinel/the-toolkit-for-data-driven-socs/ba-p/2143152). |SOC Handbook|
38
38
|<aname="investigation-insights"></a>**Investigation Insights**| Provides analysts with insight into incident, bookmark, and entity data. Common queries and detailed visualizations can help analysts investigate suspicious activities. |SOC Handbook|
39
-
|**Microsoft Defender for Cloud Apps - discovery logs**| Provides details about the cloud apps that are used in your organization, and insights from usage trends and drill-down data for specific users and applications. <br><br>For more information, see [Microsoft Defender for Cloud Apps connector for Microsoft Sentinel](./data-connectors/microsoft-defender-for-cloud-apps.md).|Microsoft Defender for Cloud Apps|
39
+
|**Microsoft Defender for Cloud Apps - discovery logs**| Provides details about the cloud apps that are used in your organization, and insights from usage trends and drill-down data for specific users and applications. <br><br>For more information, see [Microsoft Defender for Cloud Apps connector for Microsoft Sentinel](./data-connectors-reference.md#microsoft-defender-for-cloud-apps).|Microsoft Defender for Cloud Apps|
40
40
|**Microsoft Entra Audit Logs**| Uses the audit logs to gather insights around Microsoft Entra ID scenarios. Learn about user operations, including password and group management, device activities, and top active users and apps.<br><br>For more information, see [Quickstart: Get started with Microsoft Sentinel](get-visibility.md). |Microsoft Entra ID|
41
41
|**Microsoft Entra Sign-in logs**| Provides insights to sign-in operations, such as user sign-ins and locations, email addresses, and IP addresses of your users, failed activities, and the errors that triggered the failures. |Microsoft Entra ID|
42
42
|**MITRE ATT&CK Workbook**| Provides details about MITRE ATT&CK coverage for Microsoft Sentinel. |SOC Handbook|
0 commit comments