Azure Sentinel

Do you have an idea or suggestion based on your experience with Azure Sentinel? We would love to hear it! 

Please take a few minutes to submit your ideas or vote up an idea submitted by another customer. All of the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure Sentinel. Remember that this site is only for feature suggestions and ideas!

For further reading on Azure Sentinel, see our documentation. For general discussion, use our discussion forum. For technical support, take advantage of these support options.
  1. Allow custom flexible Security events filtering

    Security solution now allows filter security events: https://blogs.technet.microsoft.com/msoms/2016/11/08/filter-the-security-events-the-oms-security-collects/

    It will be good if this solution also support a "Custom" option to allow customers to specify what events to collect (in addition to pre-configured lists). Also it will be good if the customer supplied filter supports wildcards and RegEx support.

    49 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    7 comments  ·  Flag idea as inappropriate…  ·  Admin →
  2. Single pane of glass

    Sentinel should enable the aggregation of ASC, WDATP, CloudApp Security and all other sources of information that are Azure / O365 native - this is required for Incident Responders and Threat Hunters to do our job

    34 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    planned  ·  1 comment  ·  Flag idea as inappropriate…  ·  Admin →
  3. Could we have an Umbrella connector please.

    Getting logs from Cisco Umbrella would be great. They do allow outputting of logs to an AWS S3 instance and I believe they have an API as well.

    26 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Flag idea as inappropriate…  ·  Admin →
  4. Make Sentinel support multiple tenants and directories

    As for now, Sentinel only supports a single tenant (and multiple subscriptions, as long as they belong to the same tenant).

    If Sentinel could support multiple tenants, then we can throw out our existing Q-Radar and support multiple organizations from one console, instead of having one console for each organization.

    23 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Flag idea as inappropriate…  ·  Admin →
  5. Add a connector for Carbon Black.

    Carbon Black is a popular end point security tool where a native connector would be very welcomed.

    20 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  6. kusto for incidents information

    I want incident information, including comments and status, be able to retrieved by kusto query in Sentinel.
    If this is possible I would be able to analyze the incident investigation.
    Thus, I can understand how long you need for what types of incident, and FP rate for certain incidents.
    Moreover when new alert happens, you could check similar incidents investigation data and more smoothly investigate for the new alert.

    18 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  7. Create a logic app trigger "When an Azure Sentinel Incident is Created"

    It would be great to have a trigger in the Azure Sentinel connector when a new Azure Sentinel incident is created.
    This way we could integrate and automate with the other Microsoft security products (MCAS,WDATP,Azure ATP, etc.) and also with an ITSM tool like Service Now.
    The idea is to have a playbook run automatically whenever a new incident is created in Sentinel to:
    - create an incident in Service Now
    - send an email notification
    further we could expand to automatically close the SNOW incident and the corresponding alert in whichever product (MCAS,WDATP, etc.) when the Azure Sentinel incident's…

    18 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    5 comments  ·  Flag idea as inappropriate…  ·  Admin →
  8. Integration with M365 ATP & EOP

    It will be better if it is integrated with M365 ATP & EOP previously O 365 ATP so that we can get the data & reports here in single place

    17 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    4 comments  ·  Flag idea as inappropriate…  ·  Admin →
  9. Full text search for incidents information

    Currently, you need to check each incidents to see comments, however it would be more convenient if you could search comments from the incident list page.

    14 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Flag idea as inappropriate…  ·  Admin →
  10. Yara rules

    Sentinel should adopt Yara rules support to enable industry collaboration and improvement

    13 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Flag idea as inappropriate…  ·  Admin →
  11. Automatic execution of Threat Hunting rules

    We love threat hunting! but the fact that we can't simply automate them from the dashboard is incredibly complicated. There should be an option to "turn this rule into an automatic alert"

    13 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  12. Updating resolution records from Sentinel to MCAS, ATP

    When an alert has been resolved in Sentinel, it has to be resolved in the respective source from where the alert is triggered(MCAS,ATP), or vice versa. As of now, we do not have that option. If we add an additional step of sending the records to SNOW, the alert needs to be closed in 3 places(SNOW, Sentinel and the Source)

    12 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Flag idea as inappropriate…  ·  Admin →
  13. Pull logs from AWS S3

    Pull (and parse) custom logs from an AWS S3 bucket.
    There is a whole ecosystem of exchanging log data like that. Access should be governed by an AWS IAM Role and the logs should be json files in gzip archives.

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  14. Pull API - data connector

    3rd party cloud providers that support pull log files can be integrated with Azure Sentinel.
    Syslog is not an option that 100% covers our needs for cloud-era.

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    3 comments  ·  Flag idea as inappropriate…  ·  Admin →
  15. View incidents assigned to me only

    Hello, it would be nice to be able to filter the Owner column in Incidents so each SOC member could view only what was assigned to them. Right now I can only sort that column. Is this something in the roadmap or are there other ways people can be notified as soon as an incident is assigned to them?

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Flag idea as inappropriate…  ·  Admin →
  16. Connector for Windows Defender

    Create a Windows Defender connector for Azure sentinel.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  17. DNS Connectors

    Upon enabling the DNS connector it only sends particular event logs up to Sentinel. Is/there should be a way to customise the logs that the connectors capture, or further information on how they work and the logs they are setup to send to Sentinel by default.

    Please assist with getting DNS analytical logs for DNS onto Sentinel.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  18. Connector Automation

    Some connectors require that you periodically check their connector page to see if any new subscriptions have been created and then the admin must manually connect those subscriptions (Ex: Azure Activity or Azure Security Center). If there was a way to say "Enable this connector for all subscriptions (current and future) under this Management Group" or even just a blanket "Enable this connector (current and future) wherever I'm authorized to" that would reduce the amount of time that Security Analysts/Engineers would have to focus making sure that they have the appropriate coverage and allow them to do stuff like hunting.

    8 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  19. Allow for selection of playbooks to multiple rules at the same time

    When i have a playbook that applies to all rules, such as email incident notification, currently I have to open each rule individually in the portal and select the playbook. I should be able to select the playbook and associate it with as many selected (or all) rules as I want in one operation.

    7 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  20. Can you please add Juniper SRX Firewalls as a connected data source for Azure Sentinel?

    Can you please add Juniper Firewalls as a connected data source?

    6 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Flag idea as inappropriate…  ·  Admin →
← Previous 1 3 4
  • Don't see your idea?

Azure Sentinel

Categories

Feedback and Knowledge Base