Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

My current thinking is to keep data in the Analytics tier for 90 days, and once it passes 90 days, Change it into something cheaper for long-term retention / the data lake tier.

As far as I understand, this is done on a single table by setting interactive retention to 90 days and total retention to 1 year (365 days). So on day 91, does that data automatically move into the lower-cost state on its own, while staying in the same table? Is my understanding correct?

Also is there a better way to achieve this that I'm missing? I originally assumed I could age data into the Basic tier, but from what I've read Basic only has a fixed 30-day window and can't be used as a destination for aging data. Please correct me if I'm wrong.

I have been tasked with standing up UBA for our organisation, and the amount of vendor marketing around this makes it difficult to work out where to begin.

From what I can tell, the first real step is establishing a behavioural baseline, normal login times, typical data access patterns, and similar activity, before you can meaningfully identify anomalies. My understanding is that this takes a few weeks or even months of baseline data before the alerts become genuinely useful.

The other thing I keep hearing about is alert fatigue. Every vendor demo shows a handful of high-confidence alerts, but practitioners describe the first year very differently, with plenty of false positives while the baseline matures. If analysts are not expecting that, they quickly lose confidence in the system.

For teams that have already rolled this out, how long did it realistically take before the alerts were reliable enough to investigate without manually validating almost everything?

I have been trying to understand KQL for the last 2 days using the Kusto Detective Agency website, but I am still struggling to understand the concepts properly. I feel like I am missing a proper learning roadmap. My goal is to learn KQL mainly for Cyber Security/SOC purposes and eventually prepare for the Microsoft SC-200 exam (planning to take it after around 1 year).Can anyone recommend some beginner-friendly and free resources, YouTube channels, courses, or a proper roadmap for learning:

Not a Sentinel-only tool, but the KQL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.

dist/sentinel/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.

github.com/zshguy/tyrian-detection-pack

I hope this message finds you well. As I am new to the field, I wanted to inquire about the roadmap for MS Sentinel and KQL, particularly in comparison to Splunk. I chose MS Sentinel due to its future demand and user-friendliness. Could you please provide guidance on resources and materials that would be beneficial for both practical and theoretical understanding? Your assistance would be greatly appreciated.

Hey everyone ! :)

I’m working on a more structured way to handle internal investigation requests from HR, Legal, Security, or management.

The goal is to avoid vague “can you pull everything on this user?” type requests. Instead, I’m trying to build a checkbox-based request form where each option maps to a specific log source / query / limitation.

Environment is mostly Microsoft stack:

* M365 E5, Defender for Endpoint, Defender for Servers, Sentinel, Purview * Some web logs through firewall/proxy

The kind of checkbox structure I’m thinking about:

* Account sign-ins `SigninLogs`, `AADNonInteractiveUserSignInLogs` * First/last observed activity during a period `SigninLogs`, `OfficeActivity`, `DeviceLogonEvents` * Local workstation logons / endpoint activity `DeviceLogonEvents`, `DeviceProcessEvents`, `DeviceFileEvents`, `DeviceEvents` * Web history / access to specific domains firewall/proxy logs, `CommonSecurityLog`, maybe `DeviceNetworkEvents` * Emails sent externally or to personal domains `EmailEvents`, `EmailAttachmentInfo`, `OfficeActivity` * Mailbox rules, forwarding, delegation `OfficeActivity` / Exchange audit operations like `New-InboxRule`, `Set-InboxRule`, `UpdateInboxRules`, `SendAs`, `SendOnBehalf` * SharePoint / OneDrive file access, download, sharing, deletion `OfficeActivity`, `CloudAppEvents`, Purview * Data movement events Purview Activity Explorer / DLP events: USB, clipboard, print, browser upload, cloud upload, network share, RDP copy, etc. * Teams metadata vs Teams content `OfficeActivity` for audit events, Purview eDiscovery for content * Security alerts tied to a user or device `AlertInfo`, `AlertEvidence`, `SecurityAlert`, `SecurityIncident`

What I’m trying to figure out is the best practical mapping between:

**checkbox/request wording → source of truth → KQL/table/portal → limitations → Internal procedure to get those logs in a report.**

For those of you who handle these types of requests:

1. Do you have a standard checklist or request form for HR/security/legal investigations?
2. Which Microsoft logs do you trust most for file access/download/share events?
3. Are there any events or fields you avoid using because they are too noisy or easy to misinterpret?

Just trying to avoid reinventing the wheel and build something clean, scoped, and defensible.

If you think I should have publish in another subreddit, let me know :)

I’m working on an open-source tool called deadair that checks whether SIEM detections still have the telemetry they depend on.

The problem it catches is when a rule is still enabled and scheduled, but the data behind it has gone stale, stopped shipping, changed schema, or arrives too late for the rule window.

Today it only supports Elastic Security and OpenSearch Security Analytics. There is no Microsoft Sentinel adapter yet. I don’t want to build one from docs and toy KQL and then pretend it works.

For Sentinel, I’m trying to understand what a useful read-only model would need to handle before anyone would trust the output.

The rough model is:

analytic rule -> KQL dependencies -> tables/functions/watchlists/workspaces -> table freshness/schema/volume health

The parts I’m unsure about are real-world Sentinel details:

- KQL that hides table dependencies behind functions

- ASIM parsers

- watchlists

- custom tables

- cross-workspace and cross-tenant queries

- scheduled vs near-real-time rule behavior

- what read-only permissions a SOC or MSSP would actually approve

I’m looking for Sentinel operators, detection engineers, or MSSP folks who can sanity-check the design. Best case would be someone willing to run an early build later in a test workspace or limited-scope tenant. Redacted examples of rule/query patterns would also help.

Current repo, for context: https://github.com/Big-Comfy/deadair

Sentinel design issue: https://github.com/Big-Comfy/deadair/issues/3

If you run Sentinel day to day, what would this need to understand before you’d trust a “this detection has no usable telemetry” finding?

Hi,

We have one subscription that has our Azure Arc enabled machines with the Defender for Cloud P2 applied.

Sentinel is deployed in another subscription. Defender isn't enabled for the log workspace.

My understanding is that if we use the Windows Security Events via AMA to collect events from the Arc Machines, the 500mb benefit won't apply?

I have to enable Data Collection on the Sentinel Workspace in Defender for Cloud, but the sentinel workspace doesn't have those servers reporting to them?

Does that make sense? This is very confusing for me but maybe I'm over complicating it

I ma planned to do sc 200 certification. Any materials or study guide links to help me clearing the exam

I’m looking for recommendations on CTF-style threat hunting datasets that integrate well with Microsoft Sentinel. I recently finished a massive investigative threat hunt project using the Splunk BOTSv3 dataset and absolutely loved it. Even though I only uncovered about 60% of the adversary's full execution tree, the sheer scope, deep technical challenge, and open-ended nature of the hunt made it an incredibly rewarding project.

I published my investigative logs and Splunk detection playbooks from that project to my GitHub, put it on my resume, got a Splunk cert, and now I want to do the same exact thing, but with Sentinel. My initial plan was to use BOTSv2, but I've recently discovered the amount of work it would require to get the Splunk logs normalized to the KQL schema, so I'm looking for a backup option.

This upcoming project is designed to serve three distinct goals:

1. Portfolio & Resume Evidence: Documenting the end-to-end hunt, ingestion engineering, and playbook creation.
2. SC-200 Prep: Gaining proficiency with KQL syntax to prepare for the SC-200 exam.
3. Methodology Refinement: Sharpening vendor-agnostic threat hunting and detection engineering methodologies that easily transfer across SIEM platforms.

What I am specifically looking for in a dataset:

• Open-Ended/Full Scope: I want to avoid datasets that are hand-holding or strictly oriented around a single, pre-mapped MITRE ATT&CK technique with no deviations. I want a true "needle in a haystack" investigative challenge. Ideally I'd like a full scoped attack starting from the reconnaissance/initial access phases and ending with exfiltration.
• Realistic White Noise: It needs to contain benign baseline background traffic so I encounter realistic false positives, forcing me to actively tune my KQL detections just like in a real world environment.
• Data Cap Friendly: Because this is for a cloud home lab, I would like to respect a 10GB daily data ingestion limit to keep my Azure workspace under the free trial allocation. I am open to drip-feeding a larger dataset across multiple days or spending a small amount of money, but ingesting a full 300gb dataset like BOTSv2 isn't an option.

Every Sentinel dataset I’ve stumbled across so far seems incredibly limited in scope or feels too "on rails" (e.g., executing one isolated script and immediately querying the single resulting alert).

Does anyone have recommendations for datasets that fit this open-ended criteria while respecting the 10GB daily ingestion cap? Are there any viable options outside of Mordor? Because of how modular it is, I'm concerned it'll lack the broader, interconnected scope I'm looking for.

Are Microsoft still limiting when Data Lakes can be created? It seems incredible that this very useful service can only be setup depending on Microsoft.

Hi everyone, I'm trying to set up Sentinel in a homelab for Soc Learning but I've hit a weird issue in the Defender Portal and I can't figure out if its a bug, or misconfiguration.

​

Setup:

Azure subscription : Free Trial

Tenant : Azure personal account

Sentinel enabled on Log Analytics workspace

Workspace shows as Connected+ Primary in Defender

I have Owner permissions and also added Sentinel Contributor Permissions in Resource Group

​

Problem - In the Defender Portal, everything under Microsoft Sentinel dropdown is broken and whenever I click on any of the dropdowns like ContentHub, it loops me back to the workspace selection page. I've already waited more than 24 hours and tried incognito/different browsers.

​

Any solution would be greatly appreciated.

So we have successfully onboarded our Sentinel to Defender.
It states its connected but every click in the portal like "search", "tables", "Data connectors" etc leads us to "Settings > Microsoft Sentinel" and the "SIEM workspaces".

Its been over 24h, from what i can tell all XDR is configured correctly, even tried a admin role that grants it all along with all workspaces etc. Global admin role is being used, owner on the subscription where Sentinel resides but still the defender integration does not seem to work.

From the Azure sentinel perspective XDR seems onboarded, UEBA configured etc.. Any advice?

Hey everyone,

I’ve been deep in the data infrastructure and security space for a while now, and I keep hitting a fundamental wall with how we handle incident response and triage. I wanted to put this architectural concept out here to see how you all are solving this, or if you can poke some holes in a design I’m working on.

The Problem: SIEMs think in "Rows," not "Graphs"

Every major SIEM on the market (Splunk, Sentinel, Elastic, etc.) treats machine data as discrete, point-in-time entries. When a security alert fires saying a user account read a highly sensitive file, that log is stateless.

If that user then moves that data across platforms, or worse—performs a text state-transformation (like copying the text content over an RDP session clipboard to their local laptop and saving it as a text file), the chain breaks.

To map out the actual blast radius during a triage, a Tier 2/3 analyst has to spend anywhere from 45 minutes to 3 hours running manual, exhausting KQL/SPL pivots across EDR schemas, Active Directory lookup tables, and cloud provider logs. We are trying to track a dynamic relationship using a flat spreadsheet model, leading to massive MTTR delays.

The Proposed Concept: An In-Memory Taint-Graph Middleware

Instead of trying to force a SIEM database to run heavy, expensive, quadratic ($O(N^2)$) pairwise comparisons on a live log stream, what if we treat data drift as a stateful graph using an ephemeral Taint-Inheritance pipeline?

The rough blueprint looks like this:

1. The Ingestion Layer: A lightweight, containerized microservice sits next to the SIEM log forwarders, consuming standard OCSF (Open Cybersecurity Schema Framework) streams (specifically Category 2: File Activity, Class 2001).
2. Canonical Identity Swapping: Using the SIEM’s native asset/identity lookup tables, it instantly resolves fragmented usernames (e.g., DOMAIN\jdoe, [jdoe@company.com](mailto:jdoe@company.com), and local endpoint SIDs) into a single unique Actor node in memory.
3. Temporal Sliding Windows & Taint Propagation:
   • When an event shows a sensitive file is read, that specific Actor node is marked as "Tainted" in an in-memory cache with a 5-minute sliding TTL.
   • If that same Actor node triggers a local file write or an outbound network connection within that 5-minute window, the destination node automatically inherits the data lineage token.
   • This bridges the air-gap. Even if text is copied via an RDP clipboard handshake, the engine uses the network session metadata to pass the taint token from the remote VM to the host endpoint file write.

The output isn't another dashboard screaming new alerts. It’s a pure Forensic Storyteller UI—an interactive, chronologically stitched visual movie of the data's journey that pops up via a deep link inside your existing SIEM alerts.

My questions for the Blue Team / Architecture folks here:

1. The Telemetry Gap: When you are triaging a data leak incident today, where do your lineage chains usually fracture? How are you currently proving that a file created on an endpoint contains the data read from a cloud bucket 5 minutes prior?
2. The RDP/Clipboard Problem: Has anyone successfully mapped remote desktop clipboard or memory-drop telemetry inside Sentinel or Splunk without triggering an absolute avalanche of false-positive noise?
3. UX Preference: If you were using an investigation tool like this, would you prefer to see this path represented as a left-to-right topological node graph, or an interactive vertical swimlane timeline split by environment (On-Prem, Endpoint, Cloud)?

Keen to hear your thoughts, constraints, or if you think this is a solved problem via some tool configuration I’m missing.

Hi all,

I’m looking for guidance from anyone who has dealt with monitoring Copilot Studio / Power Automate connector usage, specifically around the account used to configure or authenticate connectors.

Scenario:

We are evaluating a Copilot Studio DEV environment where makers can use built-in Power Platform connectors. Some connectors, such as SharePoint, Dataverse, SQL, HTTP/custom connectors, etc., could potentially access production data depending on the account used during connector setup.

What we would like to determine:

Is there any audit log that shows when a Power Platform connection/connector is created or modified?

Can the logs show the account used to authenticate the connector, not just the user who created the flow?

Can this be monitored in Microsoft Sentinel, for example through OfficeActivity, CloudAppEvents, PowerAutomate or another table?