Monthly Archives: November 2021

Quickly test Microsoft Sentinel REST API

Posted on 11/29/2021 by azsec

There are several ways to test Microsoft Sentinel REST API with GET method. You can test directly (from Try It button) on the REST API docs page. Postman is another option. I have developed a simple PowerShell script to help … Continue reading →

Posted in Security Automation | Tagged , | 1 Comment

Create an alert with custom entity mapping using Microsoft Sentinel REST API

Posted on 11/28/2021 by azsec

As you may know the latest stable Microsoft Sentinel Alert API version 2020-01-01 doesn’t allows you to create an analytics rule in which you can add custom entity mapping, custom detail or incident grouping configuration. It isn’t too helpful for … Continue reading →

Posted in Security Automation | Tagged , , | Leave a comment

Migrate alert rules to another Azure Sentinel in the same tenant

Posted on 11/27/2021 by azsec

In a large deployment, having a non-production environment to test Microsoft Sentinel analytics rule is recommended. Now when everything is ready you would need to copy your rules over to the production environment. This article provides you a script to … Continue reading →

Posted in Secure Development, Security Automation | Tagged , | Leave a comment

Azure Sentinel Threat Intelligence API

Posted on 11/25/2021 by azsec

Microsoft Sentinel (formerly aka Azure Sentinel) has a feature that allows you to create and manage custom Threat Intelligence (TI) indicators (aka IoC – Indicators of Compromise). There are requests from avid readers asking AzSec to write something about Microsoft … Continue reading →

Posted in Secure Development, Security Automation | Tagged , , | 2 Comments

Count number of VMs & VMSS by OS type with Resource Graph Explorer

Posted on 11/18/2021 by azsec

As part of SOC work you may want to check in your Azure environment the number of VMs or VM Scalesets  by Operating System type so you can report to InfoSec leader. Moreover that helps plan security patching better. This … Continue reading →

Posted in Governance & Compliance, Security Operation | Tagged , | Leave a comment

Trigger an on-demand Azure Policy evaluation scan at Management Group scope

Posted on 11/15/2021 by azsec

If you are working with Azure Policy you must know about the on-demand Azure Policy evaluation scan that Azure allows you to trigger. Currently, you can only trigger the compliance evaluation at your current subscription context or for a resource … Continue reading →

Posted in Governance & Compliance, Security Automation | Tagged | Leave a comment

Get Vulnerability Assessment Setting of Azure SQL Server in tenant with PowerShell

Posted on 11/13/2021 by azsec

Enabling and configuring vulnerability assessment (VA) feature on Azure SQL Server is needed in an environment where security and compliance is strictly followed. And now you are asked by InfoSec leader to provide status of VA configuration on all of … Continue reading →

Posted in Governance & Compliance, Security Automation | Tagged | Leave a comment

Deploy Microsoft Defender for Servers via VM ARM template

Posted on 11/11/2021 by azsec

Microsoft Defender for Servers  offers you a capability for Azure VMs to help detect threat and to add additional defense. Currently it is supported on both Windows and Linux. In this article, let’s quickly check if we can deploy the … Continue reading →

Posted in Security Automation, Security Operation | Tagged | 6 Comments

Laterally move by abusing Log Analytics Agent and Automation Hybrid worker

Posted on 11/09/2021 by azsec

Azure Automation Hybrid worker is used to manage Azure resources in local environment where compliant connectivity is needed. Normally a hybrid worker needs a certificate installed on it so it can be authorized by Azure AD before it can perform … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | 1 Comment

Harvest credential from Custom Script Extension on Azure VM

Posted on 11/09/2021 by azsec

Custom Script Extension is one of the most commonly used extensions for Azure virtual machine deployment. This extension allows you to execute a bootstrapping script during VM deployment to perform some additional tasks.  Those tasks may include Domain Controller on-boarding … Continue reading →

Posted in Monitoring & Detection | Tagged , | 2 Comments