Based on the Microsoft documentation it is possible to query external data via KQL using "externaldata". I wanted to test it out and created a storage account and then simple table within (the table is in "Tables" not in "Containers")…
Below is an example syslog message coming into Sentinel from Cisco Secure Workload (formerly Tetration): Alert[11]: [WARNING] {"keyId":"SEN::u0mvypu37b9fwimpr4zn168c2ht159n6xdhwtaanm-upgrade_srv_check_in","eventTime":"1684974923000","alertTime":"1684974949559","alertText":"Agent Inactive: centos7","severity":"MEDIUM","tenantId":"000457","type":"SENSOR","alertDetails":"{"details":{"AgentType":"ENFORCER","Bios":"57D84D56-0000-0000-7E3C-9DD10F02AFD5","CurrentVersion":"3.7.1.40-enforcer","DesiredVersion":"","HostName":"centos7","IP":"1.1.1.1 (Gateway IP)","LastConfigFetchAt":"2023-05-03 15:47:53 +0000 UTC","Platform":"CentOS-7.9"},"agent_uuid":"u0mvypu37b9fwimpr4zn168c2ht159n6xdhwtaanm","scope_name":"MYLAB","scope_id":"f5qeybblv5oktpnte4ccrf5pw","vrf_id":700457}","rootScopeId":"f5qeybblv5oktpnte4ccrf5pw"} Need assistance in parsing this as there is currently no existing parsers for this product.…
I have a basic azure alert where it looks at the windows logs of a VM, and determines whether it should fire an alert upon detecting a specific event ID Event | where EventID == "500" | summarize arg_max(TimeGenerated, *)…
I have a 3-instance high availability redis deployed. On each server I have redis and sentinel installed. I am trying to set a password so that it requests it at the moment of entering with the command "redis-cli". I am…
i have a three node redis and 3 node sentinel, everything is ok and all master and slaves are verified and sentinel config file is updated with all redis and sentinel nodes, but the problem is when redis master is…