1,359 questions with Microsoft Security | Microsoft Sentinel tags

Sort by: Updated
1 answer

Not getting Admin Access on Defender for Sentinel

{"sessionId":"2c67d037623542f7af6d8f5b9f510754","subscriptionId":"","resourceGroup":"","errorCode":"403","resourceName":"","details":"No…

Microsoft Security | Microsoft Sentinel
asked 2025-12-05T11:19:21.0533333+00:00
Guneet Sehgal 0 Reputation points
commented 2025-12-05T12:11:24.69+00:00
Shubham Sharma 3,430 Reputation points Microsoft External Staff Moderator
1 answer

Content Hub in not Accessible

Hey Everyone, Can anyone help me in setting upon my Microsoft Sentinel Account, I am not find to find Content Hub.

Microsoft Security | Microsoft Sentinel
asked 2025-12-05T09:59:25.76+00:00
Guneet Sehgal 0 Reputation points
answered 2025-12-05T09:59:36.9766667+00:00
Q&A Assist
2 answers

how to setup sentinel

I am trying to set up a Microsoft Sentinel demo account for personal training. My aim is to use the live environment to investigate incidents and become familiar with the steps involved in resolving them. Could anyone advise on how to create one?

Microsoft Security | Microsoft Sentinel
asked 2025-12-04T11:02:54.0633333+00:00
commented 2025-12-04T18:09:33.36+00:00
0 answers

Forward Alerts from a Secondary Sentinel to a Primary Sentinel Workspace Using Logic Apps

HI, I am exploring the feasibility of forwarding Microsoft Sentinel alerts from a Secondary sentinel Workspace to a Primary Sentinel Workspace. There are two Sentinels for two LAWs and now we want to forward the alerts in One sentinel (secondary) to…

Microsoft Security | Microsoft Sentinel
asked 2025-12-04T05:12:56.1466667+00:00
Madhan R 0 Reputation points
edited a comment 2025-12-04T06:13:18.37+00:00
Sridevi Machavarapu 7,610 Reputation points Microsoft External Staff Moderator
1 answer

The azure activity connector for Azure sentinel is not working. I've run through the launch wizard and install multiple times and cannot get a connected status.

The azure activity connector for Azure sentinel is not working. I've run through the launch wizard and install multiple times and cannot get a connected status. My CISO who is a owner over all subscription has the same issues.

Microsoft Security | Microsoft Sentinel
asked 2025-11-26T19:13:29.9133333+00:00
Brooks Lowe 0 Reputation points
commented 2025-12-04T03:36:02.69+00:00
Sridevi Machavarapu 7,610 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Failure in creating Sentinel space: Temporary server failure

I get constant failures when creating my first Sentinel workspace . Would you please help me investigate or raise a platform incident? The failure "Encountered a temporary server problem" happens for more then 48 hour whenever I try. The…

Microsoft Security | Microsoft Sentinel
asked 2025-12-03T11:20:56.8666667+00:00
Aleksandar Savovski 20 Reputation points
accepted 2025-12-03T13:21:57.51+00:00
Aleksandar Savovski 20 Reputation points
1 answer

Sentinel wont add my Log analysis workspace it reports Internal server error

Sentinel wont add my Log analysis workspace it reports Internal server error

Microsoft Security | Microsoft Sentinel
asked 2025-10-22T16:08:20.4233333+00:00
Stephen Perchard 0 Reputation points
commented 2025-12-03T11:31:04.1633333+00:00
Aleksandar Savovski 20 Reputation points
1 answer

Sentinel restore refuses to delete forcing charges

We have been asked by an auditor to prove we can restore data in sentinel but when we try and delete it, it refuses to delete and then shows a date issue along side the restore. We are charged for this but cannot find a phone number or a single way to…

Microsoft Security | Microsoft Sentinel
asked 2025-12-02T12:28:26.5066667+00:00
Lee Fowler 0 Reputation points
answered 2025-12-02T17:37:44.8166667+00:00
David Broggy 6,776 Reputation points MVP Volunteer Moderator
1 answer

Microsoft Sentinel does not appear in the Microsoft Defender Portal

Microsoft Sentinel does not appear in the Microsoft Defender portal. The user has Global Administrator permissions as well as the Microsoft Sentinel Contributor role on the workspace. However, when logging into the Defender portal, the Sentinel option is…

Microsoft Security | Microsoft Sentinel
asked 2025-11-26T18:07:52.71+00:00
Ravi Patel 0 Reputation points
answered 2025-11-28T18:12:42.36+00:00
Ahamed Musthafa Careem 471 Reputation points
1 answer

update error for data connector through sentinel or defender portal

I keep getting this error when i try to update a data connector for Defender XDR. It used to work up until azure had an issue. Message- The workspace is enabled through the Microsoft Threat Protection Portal. Changes to the connector in Microsoft…

Microsoft Security | Microsoft Sentinel
asked 2025-10-31T15:55:41.64+00:00
Rod Lewis 5 Reputation points
answered 2025-11-25T16:33:00.1633333+00:00
Prathista Ilango 670 Reputation points Microsoft Employee
1 answer

how affect the integration of sentinel in Defender XDR to partners with GDAP permissions?

how affect the integration of sentinel in Defender XDR?. In my case i'm security partner and my clients give me GDAP permissions to manage his Defender XDR. Now with Sentinel integration we would want to manage all in the unified portal but we see that…

Microsoft Security | Microsoft Sentinel
asked 2025-10-29T10:24:57.3633333+00:00
Jose Luis Extremeiro Varela 1 Reputation point
answered 2025-11-25T15:48:07.86+00:00
Prathista Ilango 670 Reputation points Microsoft Employee
0 answers

HOw to resolve the error'where' operator: Failed to resolve table or column expression named 'Okta_CL' for Analytics rule User Session Impersonation(Okta)

Name is User Session Impersonation(Okta) Logic is : Okta_CL | where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS" // Expand the JSON array in 'target_s' field to extract detailed information…

Microsoft Security | Microsoft Sentinel
asked 2025-10-22T17:46:51.8866667+00:00
John Tyson 0 Reputation points
commented 2025-11-25T11:09:31.0566667+00:00
Pauline Mbabu 1,710 Reputation points Microsoft Employee
0 answers

401 UnauthorizedAccess when calling STIX Threat Intelligence Upload API

We are calling the Threat Intelligence Upload API (Preview) using a registered Microsoft Entra app. We’ve followed all required steps: App is registered in Entra ID with correct permissions client_credentials flow is used with scope…

Microsoft Security | Microsoft Sentinel
asked 2025-07-24T02:40:00.4933333+00:00
vinayakshastri 25 Reputation points
commented 2025-11-25T07:47:42.68+00:00
Pauline Mbabu 1,710 Reputation points Microsoft Employee
1 answer

How can I integrate Azure Cognitive Services into a .NET application?

I am currently learning about Azure on Microsoft Learn and want to integrate Azure Cognitive Services (like Text Analytics or Computer Vision) into a .NET 6 application. I am looking for guidance on: Setting up the Azure resources needed. …

Microsoft Security | Microsoft Sentinel
asked 2025-11-21T17:23:56.55+00:00
Phil Salt 0 Reputation points
commented 2025-11-25T06:04:33.33+00:00
Praneeth Maddali 2,355 Reputation points Microsoft External Staff Moderator
0 answers

Change path on Linux for Azure AMA and CEF Collectors

I'm setting up Azure Monitoring Agents on Linux with CEF Collector. I would like to change the cache directories to a separate drive. Can anyone point me to where these paths are configured?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,819 questions
Microsoft Security | Microsoft Sentinel
asked 2024-09-20T12:23:12.28+00:00
Jody Spoor 5 Reputation points
commented 2025-11-24T12:25:33.4+00:00
Anthony Edwards 36 Reputation points
1 answer

Unable to configure Microsoft XDR connector in Sentinel

Hi Currently, it is not possible to configure the Microsoft Defender XDR connector via browser from Switzerland. Access to the URL https://partnersgw.securitycenter.windows.com/api/mdgw/sentinel/workspaces/isOnboarded is blocked unless a Microsoft…

Microsoft Security | Microsoft Sentinel
asked 2025-10-31T11:02:33.64+00:00
Reeno 0 Reputation points
answered 2025-11-21T14:12:12.2533333+00:00
Prathista Ilango 670 Reputation points Microsoft Employee
2 answers One of the answers was accepted by the question author.

How to Correlate Defender XDR Signals with Non-Microsoft Logs in Microsoft Sentinel?

I am exploring advanced threat detection scenarios in Microsoft Sentinel and trying to correlate high-fidelity signals from Microsoft Defender XDR with non-Microsoft telemetry such as firewall logs, DNS logs, identity events from third-party providers,…

Microsoft Security | Microsoft Sentinel
asked 2025-11-20T17:20:35.1233333+00:00
Mark Den 20 Reputation points
accepted 2025-11-20T17:56:38.4666667+00:00
Mark Den 20 Reputation points
1 answer

Failed to add Microsoft Sentinel to workspace 'hn-ws-sentinel'. Internal server error

Tried adding microsoft sentinel, already created new workspace, selected said workspace but : tried again a few minutes later but still failed. please advise

Microsoft Security | Microsoft Sentinel
asked 2025-10-22T16:30:46.38+00:00
Marc Perry 0 Reputation points
answered 2025-11-20T17:05:03.2933333+00:00
Prathista Ilango 670 Reputation points Microsoft Employee
2 answers

Unable to deploy "Atlassian Confluence Audit (via Codeless Connector Platform)" data connector on Microsoft Sentinel

I am unable to deploy "Atlassian Confluence Audit (via Codeless Connector Platform)"data connector on Azure Sentinel. Getting following error message: Connectivity check failed. ConnectorId: ConfluenceAuditCCPPolling, Status code:Unauthorized,…

Microsoft Security | Microsoft Sentinel
asked 2025-11-10T21:12:26.5366667+00:00
Hasan 0 Reputation points
answered 2025-11-18T10:55:35.3266667+00:00
Praveen Chivarla 2,005 Reputation points Microsoft External Staff Moderator
2 answers

how can participate for Advanced KQL for SecOps?

how can participate for Advanced KQL for SecOps? Best Regards. Ignacio.

Microsoft Security | Microsoft Sentinel
asked 2025-11-14T15:11:09.19+00:00
Nacho 0 Reputation points
answered 2025-11-17T09:49:49.6033333+00:00
Monalisha Jena 4,070 Reputation points Microsoft External Staff Moderator