Category Archives: Security Automation

Notes on Azure SQL Server Auditting should be enabled policy

Posted on 07/28/2021 by azsec

Recently I was asked to help a colleague of mine on a policy named “Azure SQL Server auditing should be enabled“. He deployed an ARM template to enable auditing but the deployment didn’t reflect the setting in Azure Portal. In … Continue reading →

Posted in Secure Development, Security Automation | Tagged | Leave a comment

Create an Azure Role Assignment Watchlist in Azure Sentinel

Posted on 07/13/2021 by azsec

Watchlist in Azure Sentinel allows you to build your own data from external data sources for correlation with analytics or hunting rules in your Azure Sentinel environment. In this article, what we are going to do is explore Azure Sentinel … Continue reading →

Posted in Security Automation, Security Operation | Tagged , | 3 Comments

Notes in Azure Storage Network Restriction

Posted on 06/20/2021 by azsec

By default,  when creating a new Azure storage account it accepts connections from clients on any network. To limit that, Azure allows you to add a trusted list of virtual network subnets or IP ranges. This article is not going … Continue reading →

Posted in Security Automation | Tagged , | Leave a comment

Get Alert Relation from an Incident using Azure Sentinel Incident Relation API

Posted on 07/15/2020 by azsec

I have a few questions recently asking if we can get an associated alert for an incident. The idea is to know which alert that caused an incident so SecOps team could better investigate the issue. In this article, let’s … Continue reading →

Posted in Security Automation | Tagged , , | Leave a comment

Transform Azure Sentinel incident to Log Analytics Workspace with Logic App

Posted on 07/08/2020 by azsec

As a SOC Analyst or Manager who are working on Azure Sentinel you would like to have a view of how productive your team is (response time, resolution..). As being familiar with Log Analytics query, you might wish to do … Continue reading →

Posted in Security Automation | Tagged , , | 1 Comment

Be careful when you have escape char in Key Vault secret value

Posted on 06/12/2020 by azsec

I recently had some works that required to use Azure Key Vault. Specifically a secret that stored a service principal’s password that contained some special characters (escape ones). This article just shows you my finding and how to fix it … Continue reading →

Posted in Security Automation | Tagged | Leave a comment

Quick look at new Azure Sentinel Incident API

Posted on 03/18/2020 by azsec

I got some questions from people who worked with Microsoft product team about the new incident API they were introduced. I took a glance at it and thought I would need to write something about it, especially wrote a new … Continue reading →

Posted in Security Automation | Tagged , | 8 Comments

Quick notes in deploying Guest Configuration Extension on Azure VM

Posted on 03/14/2020 by azsec

Azure Policy Guest Configuration allows you to audit configuration inside host. It sounds very much similar to Azure Automation Account Desired State Configuration (DSC). In fact the concept is similar to DSC but Azure Policy uses a dedicated agent called … Continue reading →

Posted in Security Automation | Tagged , | Leave a comment

Enable Microsoft Defender ATP integration in Azure Security Center programmatically

Posted on 01/30/2020 by azsec

If you have worked with Azure Security Center and Microsoft Defender ATP (Advanced Threat Protection) you may know a setting in Azure Security Center called Threat Detection where you can allow Microsoft Cloud App Security (MCAS) or Microsoft Defender ATP … Continue reading →

Posted in Azure Security Center, Security Automation | Tagged , | Leave a comment

Get all comments in an Azure Sentinel incident programmatically

Posted on 01/27/2020 by azsec

For any kind of report you may want to get all comments in an Azure Sentinel in order to archive as an forensic or incident artifact in an incident case before it is closed. Even comments in Azure Sentinel is … Continue reading →

Posted in Security Automation | Tagged , , | Leave a comment