Category Archives: Security Automation

Quickly test Microsoft Sentinel REST API

There are several ways to test Microsoft Sentinel REST API with GET method. You can test directly (from Try It button) on the REST API docs page. Postman is another option. I have developed a simple PowerShell script to help … Continue reading

Posted in Security Automation | Tagged , | 1 Comment

Create an alert with custom entity mapping using Microsoft Sentinel REST API

As you may know the latest stable Microsoft Sentinel Alert API version 2020-01-01 doesn’t allows you to create an analytics rule in which you can add custom entity mapping, custom detail or incident grouping configuration. It isn’t too helpful for … Continue reading

Posted in Security Automation | Tagged , , | Leave a comment

Migrate alert rules to another Azure Sentinel in the same tenant

In a large deployment, having a non-production environment to test Microsoft Sentinel analytics rule is recommended. Now when everything is ready you would need to copy your rules over to the production environment. This article provides you a script to … Continue reading

Posted in Secure Development, Security Automation | Tagged , | Leave a comment

Azure Sentinel Threat Intelligence API

Microsoft Sentinel (formerly aka Azure Sentinel) has a feature that allows you to create and manage custom Threat Intelligence (TI) indicators (aka IoC – Indicators of Compromise). There are requests from avid readers asking AzSec to write something about Microsoft … Continue reading

Posted in Secure Development, Security Automation | Tagged , , | Leave a comment

Trigger an on-demand Azure Policy evaluation scan at Management Group scope

If you are working with Azure Policy you must know about the on-demand Azure Policy evaluation scan that Azure allows you to trigger. Currently, you can only trigger the compliance evaluation at your current subscription context or for a resource … Continue reading

Posted in Governance & Compliance, Security Automation | Tagged | Leave a comment

Get Vulnerability Assessment Setting of Azure SQL Server in tenant with PowerShell

Enabling and configuring vulnerability assessment (VA) feature on Azure SQL Server is needed in an environment where security and compliance is strictly followed. And now you are asked by InfoSec leader to provide status of VA configuration on all of … Continue reading

Posted in Governance & Compliance, Security Automation | Tagged | Leave a comment

Deploy Microsoft Defender for Servers via VM ARM template

Microsoft Defender for ServersĀ  offers you a capability for Azure VMs to help detect threat and to add additional defense. Currently it is supported on both Windows and Linux. In this article, let’s quickly check if we can deploy the … Continue reading

Posted in Security Automation, Security Operation | Tagged | Leave a comment

Azure Sentinel near-real-time (NRT) Analytics Rule ARM Template

Microsoft just introduced a new type of analytics rule called near-real-time (NRT). This rule provides the capability to up-to-the-minute detection. It basically means you wouldn’t have to worry about ingestion delay especially the five minutes minimum delay. This article provides … Continue reading

Posted in Security Automation | Tagged , | Leave a comment

Azure Sentinel custom alert named based on detected resource

I got a question from a friend today asking if he could customize alert name based on the detected resource. He was in charge of building rule set for monitoring Azure Key Vault resources. He wanted to see something like … Continue reading

Posted in Security Automation | Tagged | 1 Comment

Azure Sentinel Analytics Rule ARM Template

I have got several people asking if they can develop and deploy Azure Sentinel Analytics rule in form of Azure ARM Template. This article is simply to provide you a sample template so you can quickly deploy a rule in … Continue reading

Posted in Security Automation | Tagged | 1 Comment