Microsoft Sentinel
Fixing the "Excessive Number of Failed Connections from a Single Source" Analytic Rule
Alright class.
Today we pull apart "Excessive number of failed connections from a single source" from the Network Session Essentials solution. The YAML behind it is
Topic
Analytic Rules
Microsoft Sentinel analytic rules taken apart and rebuilt: why the templates misfire in production, how to tune them, and KQL rules you can deploy.
33 posts
Microsoft Sentinel
Fixing the "Excessive Number of Failed Connections from a Single Source" Analytic Rule
Alright class.
Today we pull apart "Excessive number of failed connections from a single source" from the Network Session Essentials solution. The YAML behind it is
KQL
Would You Know If Someone Cancelled Your Azure Subscription?
Alright class.
Yet another lesson in this series, and this one breaks the format. There is no Microsoft rule to fix today, because Microsoft does not ship one.
Microsoft Sentinel
Fixing the "Application URL" Analytic Rules, All Three of Them
Alright class.
Another lesson, first one fixing three rules at once. The content hub ships "Changes to Application Logout URL", "Application Redirect URL Update"
KQL
Fixing the "Guest Users Invited to Tenant by New Inviters" Analytic Rule
Alright class.
Today we are looking at "Guest Users Invited to Tenant by New Inviters", a content hub rule that promises to spot guest account abuse
KQL
Fixing the "Excessive Windows Logon Failures" Analytic Rule
Alright class.
A close cousin to one of the previous lessons - that rule counted failures in a 10 minute burst. This one takes a whole day and tries
Microsoft Sentinel
Fixing the "Failed Logon Attempts by Valid Accounts within 10 mins" Analytic Rule
Alright class.
On-premises this time, back in the Windows security log. The rule watches event 4625, a failed logon, and fires when a valid account fails 20
Microsoft Sentinel
Fixing the "Microsoft Entra ID PowerShell accessing non-Entra ID resources" Analytic Rule
Alright class.
Today's rule is "Microsoft Entra ID PowerShell accessing non-Entra ID resources", which alerts when the old Azure AD PowerShell client obtains
Microsoft Sentinel
Fixing the "Mass Cloud resource deletions Time Series Anomaly" Analytic Rule
Alright class.
Today we are looking at Mass Cloud resource deletions Time Series Anomaly, a content hub rule that promises to catch an adversary tearing down your Azure
KQL
Fixing the "Suspicious granting of permissions to an account" Analytic Rule
Alright class.
Today's patient is "Suspicious granting of permissions to an account", the content hub rule that promises an alert "when a previously
KQL
Conditional Access, Part Six: Turning Twenty-Five Queries Into an Operating Model
All right class.
Five posts, twenty-five queries. If you have been following along, you now have a folder of KQL that describes your Conditional Access estate better
Microsoft Sentinel
Fixing the "Rare Subscription-level Operations in Azure" Analytic Rule
Alright class.
Back on the Azure control plane, and a rule with a good nose for targets. It watches AzureActivity for sensitive subscription operations, and the description picks
KQL
Fixing the "Multiple Password Reset by User" Analytic Rule
Alright class.
Another rule from the content hub today: "Multiple Password Reset by user". It gathers password change and reset events from five data sources, Windows
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.