> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/yellow-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/yellow-team/training/cloud-academy/azure/azure-sentinel-incident-triage-challenge.md). # Azure Sentinel Incident Triage Challenge Challenge to setup Azure Sentinel, collect logs from a Virtual Machine(VM), create a basic analytics rule and have the rule trigger. ## **Walkthrough** **Create an Azure Sentinel Workspace** Create an Azure Sentinel resource using the existing Log Analytics workspace. * Must use the existing workspace **calabws** Head over to Microsoft Sentinel and create it.
Make sure you have the calabws workspace selected.
**Create a Data Collection Rule in Sentinel** Create a Data Collection Rule to collect Security Events from the Azure VM * Collection Rule name must be *windows-event* * Add the Azure VM **ca-lab-vm** to the data collection rule scope * The data collection must collect at least **Common** event stream First we need to head over to the Log Analytics workspace and make sure that the VM is able to send logs to our workspace.
![](https://2666479439-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBLYaaERPa1yy1Qa8E1NQ%2Fuploads%2F7fZ7tX7JBJLemwPO5lGm%2Fimage.png?alt=media\&token=ba3c7458-7f8b-492f-b8ba-a7dcd924d17f) Shortly after you should see that the VM has connected to the workspace.
Now we start creating our collection rule within Sentinel. Head back to Microsoft Sentinel. Click the data connectors and add Windows Security Events via AMA.
Add the rule name windows-event.
Add the VM we added to the Log Analytics workspace.
Make sure we have Common selected.
**Create an Analytics Rule to Run Scheduled Queries** Create an Analytics Rule to Run Scheduled Queries that satisfies the following: * The rule severity should be **Medium** * Query schedule should be set to run 5 minutes * The log inspection script must check for EventID 4625 to report failed logins * Use the query `SecurityEvent | where EventID == 4625` * Try RDP access into the Azure VM by supplying an incorrect password to generate events We're going to generate our logs first instead of later on so we can see the rule working before we create it.
Enter incorrect credentials a few times to create logs.
Now we can start creating our Analytics rule.
Make sure alert threshold is greater than 0 so it fires if any hits happen.
Leave default settings.
Leave default settings.
Click Create.
**Triage and Close At Lease One Incident** Close at least one incident from the Sentinel Incidents Dashboard * Ensure that you try RDP access into Azure VM using an incorrect password * Wait for about 5 minutes for the analytics rule to run and analyze the data * Close at least one of the incidents generated by analytics rule After a few minutes we can see an incident was created. Nothing left to do except close the incident.