Before
An analyst likely had to run a complex Log Analytics search, review the returned data, and determine which security alert it belonged to. The analyst then had to copy or apply the relevant information to the alert manually, switching between the search results and the security alert record.
How it works
- Receive a query and search Log Analytics for Azure Sentinel alerts or other relevant security logs.
- Convert the returned data into JSON so the results can be used consistently.
- Update the corresponding security alert with the additional Log Analytics information.
Workflow details
- Query initiation: The workflow receives a query and submits it to Log Analytics to search Azure Sentinel alerts or other available logs using complex KQL statements.
- Data retrieval: Log Analytics returns the results of the query for further processing within the workflow.
- Data normalization: The returned content is converted from XML into JSON so it can be used consistently in the next operational step.
- Alert enrichment: The normalized information is applied to the relevant security alert, adding context retrieved from Log Analytics.
- Operational result: Azure Sentinel security alerts are updated automatically, giving the alert record additional information without requiring a separate manual lookup and edit.
What changed
The search, data conversion, and alert update now occur as one automated sequence after a query is received. Security alerts receive the retrieved context without requiring an analyst to move information manually between Log Analytics results and the alert record.
Work removed
Running the recurring Log Analytics search manually, converting or reformatting returned data, locating the corresponding security alert, copying relevant findings, and manually updating the alert record.
Expected outcome
For each processed alert, the workflow can remove at least one manual search-and-update cycle and provide consistently enriched security alert records.
