New SOC Process Framework workbook

You may have noticed a new blog post about a new SOC Process Framework workbook (What’s New: Azure Sentinel – SOC Process Framework Workbook – Microsoft Tech Community). But what does really mean? First, the workbook is very awesome. It provides a great framework for setting up your own SOC processes. It was meant to […]

Using PowerShell & C# with Jupyter Notebooks

Introduction As you probably already know, Jupyter notebooks allow for much great threat hunting than you can get using the OOTB Azure Sentinel Threat Hunting queries, especially when you consider that you can run the Azure Sentinel KQL queries from a Jupyter notebook. Most of the articles written about Azure Sentinel and Jupyter notebooks use […]

Nice shortcut in KQL to get JSON data in a dynamic column.

While looking at the SigninLogs table in Azure Sentinel I noticed there are a lot of dynamic fields that hold JSON data. I was trying to use parse_json to get to the data but it was always returning empty fields. I then realized that parse_json requires a string input, not a dynamic. After some messing […]

Ingesting Azure Sentinel Incident information into Log Analytics Part III – Using the data

Introduction In Ingesting Azure Sentinel Incident information into Log Analytics, I showed you how to create a Log Analytics workflow to ingest Azure Sentinel Incidents into a Log Analytics workspace. In Ingesting Azure Sentinel Incident information into Log Analytics Part II, I fixed some of the issues I ran into while using the instructions from […]

Ingesting Azure Sentinel Incident information into Log Analytics Part II

Introduction This is a continuation of the post Ingesting Azure Sentinel Incident information into Log Analytics. There are a few things that I want to clarify/rectify in it. I was working on the output from my last post to make a useful workbook from it and noticed a few things. Misspelling I misspelled “severity” when […]