Query Logs in Azure Sentinel

 

Query Logs in Logs Page

In Azure Sentinel, the logs page provides access to the query window while allowing you to run queries, save queries, run saved queries, create a new alert rule, and export.  If  you want to run a query, first of all enter a query text and then press the run button. The query results can be seen at the bottom section of the form.

Understand Azure Sentinel Table

Azure Sentinel consists of Analytic Rules that will generate alerts and incidents based on querying the tables within Log Analytics while simultaneously providing tables to be a repository of indicators and watchlists. Some of the Sentinel Data Connectors are capable of ingesting alerts directly. The table below is the Azure Sentinel feature related tables:

Table	Description
SecurityAlert	Contains alerts generated from Sentinel Analytical Rules. Also, it includes alerts created directly from Sentinel Data Connector.
SecurityIncident	Alerts can generate incidents. Incidents are related to alert(s).
ThreatIntelligenceIndicator	Contains user-created or data connector ingested indicators such as File Hashes, IP Addresses, Domain.
Watchlist	An Azure Sentinel watchlist contains imported data.

 Understand Common Tables

When Sentinel ingests data from the Data Connectors, the following table lists the most commonly used tables:

Table	Description
AzureActivity	Entries from the Azure Activity log that provides insights into any subscription-level or management group level events that have occurred in Azure.
AzureDiagnostics	Stores resource logs for Azure Services that use Azure Diagnostics mode. Resource logs describes the internal operation of Azure resources.
AuditLogs	Audit Logs for Azure Active Directory includes system activity information about user and group management managed applications as well as directory activities.
CommonSecurityLog	Syslog messages using the Common Event Format (CEF).
McasShadowltReporting	Microsoft Cloud App Security logs.
OfficeActivity	Audit logs for Office 365 tenants collected by Azure Sentinel. Including Exchange, SharePoint, and Teams Logs.
SecurityEvent	Security events collected from Windows machines by Azure Security Center or Azure Sentinel.
SigninLogs	Azure Active Directory Sign in logs.
Syslog	Syslog events on Linux computers using the Log Analytics agent.
Event	Sysmon Events collected from a Windows host.
WindowsFirewall	Windows Firewall Events.

 Understand Microsoft 365 Defender Tables

The Microsoft 365 Defender Sentinel Data Connector can populate tables with raw data collected from the Microsoft 365 Defender solutions. Microsoft Defender for Endpoint tables:

Table	Description
DeviceEvents	The miscellaneous device events table contains information about various event types including, events triggered by security controls, such as Microsoft Defender Antivirus and exploit protection.
DeviceFileEvents	This table contains information about file creation, modification, and other file system events.
DeviceImageLoadEvents	This table contains information about DLL loading events.
DeviceInfo	This table contains information about devices in the organization, including their OS version, active users, and computer name.
DeviceLogonEvents	This table contains information about user logons and other authentication events.
DeviceNetworkInfo	This table contains information about networking configuration of devices, including network adapters, IP and MAC addresses, and connected networks or domains.
DeviceProcessEvents	This table contains information about process creation and related events.
DeviceRegistryEvents	This table contains information about the creation and modification of registry entries.
DeviceNetworkEvents	This table contains information about network connection and related events.