How to Add Geographical Data for IP Addresses to an Azure Sentinel Incident

We have a Playbook out on the official GitHub Repo that queries the IP-API.com website with IP addresses and then writes the geographical information to an Incident's Tags. This is useful, but it's been found to be too limiting based on the amount of information IP-API returns versus how little data a Tag can hold. … Continue reading How to Add Geographical Data for IP Addresses to an Azure Sentinel Incident

How to Query HaveIBeenPwned Using an Azure Sentinel Playbook

I've known Troy Hunt for a number of years and his contributions to the security and privacy industry have been hugely valuable and much appreciated by the masses. HaveIBeenPwned is a great resource developed and maintained by Troy. It provides the ability to query against its database to expose domains or user accounts that have … Continue reading How to Query HaveIBeenPwned Using an Azure Sentinel Playbook

Modified IP Address to GEO to Tags Azure Sentinel Playbook

One of my favorite Playbooks is the one created by Nicholas DiCola that provides GEO information for IP Addresses that are associated with an Azure Sentinel Incident. Once the information is obtained, it's placed in the Incident's Tags for easy readability and quick-glance information about where the connections are coming from. I run this Playbook … Continue reading Modified IP Address to GEO to Tags Azure Sentinel Playbook

Using Microsoft To-do as a Simple Ticketing System for Azure Sentinel

A customer recently wanted me to suggest a very simple, cost-worthy service ticketing system they could use with Azure Sentinel. The following ended up serving the customer's needs. Microsoft To-do can be a powerful tool for those that like to separate their schedule items from their task lists. For many Office 365 customers, they may … Continue reading Using Microsoft To-do as a Simple Ticketing System for Azure Sentinel