I am a 3 x Microsoft Security MVP with over 16 years experience in IT.
I specialise in Microsoft Cybersecurity Solutions.
I have started this RU-vid channel to help the IT Community on working with various technologies within Microsoft Azure, I’ll be uploading tutorials, troubleshooted problems I’ve ran into, quick fixes, as well as tips and hints what I’ve come across so far also trying to make it "fun" and enjoyable and anything that doesn’t quite add up, please feel free to leave a comment 🙂
🔴 Check out my blog 🔴 craigclouditpro.wordpress.com/
Hi Craig, first of all, thank you so much for your videos, they really help me understand a lot on the SC-200 course and exam I am currently studying for! If I understand correctly, for parsers there are (generally speaking) the following types: _Im_<schema> = Built-in UNIFYING parser Im<schema> = Built-in WORKSPACE DEPLOYED parser _Im_<schema>_<source> = Built-in SOURCE-SPECIFIC parser vim<schema> = WORKSPACE-DEPLOYED SOURCE SPECIFIC parser A corresponding set of parsers that use _ASim_<schema> and ASim<Schema> are also available. It is not completely clear to me when to use these last parsers, actually. Could you (or someone else of course) help me out please? Thank you :)
Hi Olaf, Thank you for your kind words! I’m glad my videos have been helpful to you in your SC-200 course and exam preparation. To clarify your understanding of parsers in Microsoft Sentinel: • Im: Built-in UNIFYING parser. • Im: Built-in WORKSPACE DEPLOYED parser. • Im_: Built-in SOURCE-SPECIFIC parser. • vim: WORKSPACE-DEPLOYED SOURCE SPECIFIC parser. When to use ASIM parsers: • Use ASim when you need a built-in unifying parser for a specific schema across different sources. This helps in normalizing data from various sources into a common schema. • Use ASim for workspace-deployed parsers that are customized for your specific environment and use cases. These are useful when you have specific log sources that require customized parsing rules. These ASIM parsers are especially valuable when dealing with complex environments with multiple data sources, as they help in unifying and simplifying the analysis process. I hope this helps! Let me know if you have any more questions.
Hats off to you Craig! It was mindblowing the way you simplified the whole jargon, I feel so rich with the knowledge you shared here, I was so poor before this class
@Progod, yes this is true, which is why i recommend using free enrichment for TI, using RDAP, Virus Total, RiskIQ etc, I'm hoping this bring the cost of Defender for TI down, because alot of my customers are just objecting it because of the costs
Hi mate, I’ve not worked with qualys before, I just did a quick google and the process looks relatively straight forward, so there’s plenty of documentation for you online :)
Get-NetTCPConnection -State Established | Select LocalAddress, LocalPort, OwningProcess, RemoteAddress, @{n="Path";e={(gps -Id $_.OwningProcess).Path}},@{n="Hash";e={(gps -Id $_.OwningProcess|gi|filehash).hash}}, @{n="User";e={(gps -Id $_.OwningProcess -IncludeUserName).UserName}}|sort|gu -AS | FT -no type information Hopefully this works for you :)
Your videos are fantastic!! Thanks so much for sharing you have a true talent for making the complex simple, entertaining, and practical. Keep up the great work-- Cheers!!!
Hi, thanks for your comment, there are a lot of videos on phishing emails on Sentinel on RU-vid :) if there is anything specific you cannot find, let me know and I’ll see what I can do
How do you find hash values from AD joined devices? For some reason, I only see VMs like softbox but not any of the "hardbox" like actual endpoint that's joined to company intune.
hi milkteaboba, what is the goal you're trying to achieve here? there are multiple ways to extract data from AD and deploying said data into TI, but i don't really understand your use case?
Disclaimer - I am a Splunk Account Manager so keep that in mind while reading my comments. I find this comparision to be extremely misleading. You compare Sentinel to a Splunk BYOL (bring your own license)) Cloud deployment. To put this in Microsoft terms you are comparing O365 to Exhange running in Azure. Not a fair comparison. I would recommend a redo on this video comparing Sentinel to Splunk Cloud with Mission Control which is a more comparable deployment model. This is not an apples to apples comparision, it is more like an Apples to Walnuts......
I work with both Splunk and Sentinel and would consider myself vendor agnostic (worked with LogRythm, ArcSight and Elastic Stack too). There are a few comments I would like to make. 1. I agree Sentinel is very easy to initially set up vs Splunk / Splunk Cloud. Especially Microsoft and large vendor sources (Cisco, Fortinet, etc etc) 2. In addition to an ingest licence Splunk provide a compute based licence too. I would argue this is much easier to budget for vs ingest cost (even with Committment Tiers). I've worked with plenty of organisations (Universities for example) whose throughput massively changes from month to month 3. I would say Splunk is much more mature for non-Microsoft integrations - just look at the number of TAs available on Splunkbase. With Sentinel, you may need a developer (not a typical security engineer) to develop Function Apps to ingest into Custom Tables. 4. Skills. I would argue that Splunk, having been around 20 years, with a robust training offer - skills are much more common. Sentinel is new, and there isn't yet a specific training programme for this (Splunk Ninja Training is good though!) 5. Sentinel scheduled rules can only look back 14 days. 6. Mention of ADX for archiving. Actually Sentinel now has the very good Archive Tier. Splunk very similar (DDAA and DDSS). 7. Developing integrations for sources not yet available in Splunkbase (a rare thing) is super easy using Splunk's Add-on builder. I find with Sentinel you will need to employ someone comfortable with developing Python, Poweshell etc for developing Function Apps. These have to be maintained. Growing list of course open source on GitHub, but catching up. 8. Log source monitoring. Sentinel has some work to do to catch up with Splunk's "TrackMe" app which uses ML to detect outliers, throughput etc. 9. Licence. Sentinel is kinda similar to Splunk ES in the licence model. Sentinel (Splunk ES) is charged on the ingest volume on top of the ingest +storage cost of the underlying Log Analytics Workspace (Splunk Enterprise/Cloud) 10. Learning Microsoft KQL is required, much in the same way as the need to learn Splunk SPL. I like both, and coming from an Oracle background I kind of prefer the KQL language which is more similar and query optimisation is performed transparently. That said Splunk accelerated data is much much quicker. I also like Splunk's "schema on the fly" way of doing things. 11. A Splunk Deployment Server (or supported Ansible, Puppet, Chef, SCCM, ...) isn't mandatory, but useful for configuration of a large number of agents (if only collecting API sources, not needed for example). This is similar to Sentinel's data collection rules (DCR) now available with the AMA agent. Until AMA it hasn't been easily possible to fine tune what is collected (thinking the 4 built-in filters for Windows Security Event collection).
this is a very useful and helpful video, currently doing my MSc dissertation research on how sentinel can help mitigate ransomware attack. This video has come to the rescue; I will surely reference your work. Thank you
Hey Craig, really good video. For writing analytic rules in Sentinel, I was wondering if you knew of a place of reference to go to in order to check for an extensive list of names of programs, extensions, directories and other indicators to put in KQL queries for the contains, !contains, has, !has, and so on fields for different types of analytic rules we may be writing. Basically for the filtering part of any analytics rule.
Thanks for the video.. It was very informative... I just want to know if we use Azure Blob storage for data retention you said we cant use KQL queries.. but can we connect Blob storage to sentinel using data connector and run KQL on that data..? Thanks in advance..
Hi IAm, you won’t be able to use the SAME queries as if the data were in Sentinel, it’s more difficult and tedious to navigate inside each data folder in a blob storage :)
