Azure Sentinel for SIEM - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an Azure Sentinel workspace in Azure.

Azure

az monitor log-analytics workspace create --resource-group myResourceGroup --workspace-name [1] --location eastus

Drag options to blanks, or click blank then click option'

AMyAppService

BMyStorageAccount

CMyVirtualNetwork

DMySentinelWorkspace

Attempts:

3 left

💡 Hint

Common Mistakes

Using a storage account name instead of a workspace name.

Using a virtual network name instead of a workspace name.

The workspace name is required to create an Azure Sentinel workspace. It must be unique within the resource group.

2fill in blank

medium

Complete the code to enable data connectors for Azure Sentinel.

Azure

az sentinel data-connector [1] create --resource-group myResourceGroup --workspace-name myWorkspace

Drag options to blanks, or click blank then click option'

AVirtualMachines

BSecurityEvents

CStorageAccounts

DAppServices

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing VirtualMachines or StorageAccounts which are not data connector types.

Using AppServices which is unrelated to Sentinel data connectors.

SecurityEvents is a common data connector type used to collect security logs into Azure Sentinel.

3fill in blank

hard

Fix the error in the Kusto query to find failed sign-in attempts in Azure Sentinel logs.

Azure

SigninLogs | where ResultType [1] 0

Drag options to blanks, or click blank then click option'

A!=

B==

C>

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' which filters only successful sign-ins.

Using '>' or '<' which may not correctly filter failures.

Failed sign-in attempts have a ResultType not equal to 0, which means failure.

4fill in blank

hard

Fill both blanks to create an alert rule that triggers on multiple failed sign-ins.

Azure

SigninLogs | where ResultType [1] 0 | summarize count() by UserPrincipalName | where count_ [2] 5

Drag options to blanks, or click blank then click option'

A!=

B>

C<

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of '!=' for ResultType.

Using '<' or '==' instead of '>' for count.

The query filters failed sign-ins (ResultType != 0) and triggers when count is greater than 5.

5fill in blank

hard

Fill all three blanks to create a playbook trigger for an Azure Sentinel alert.

Azure

az sentinel alert-rule analytics create --resource-group myResourceGroup --workspace-name myWorkspace --display-name [1] --severity [2] --enabled [3]

Drag options to blanks, or click blank then click option'

AHighAlert

BHigh

Ctrue

DLow

Efalse

FMedium

GCritical

Attempts:

3 left

💡 Hint

Common Mistakes

Using false for enabled disables the alert.

Choosing Low or Medium severity when High is required.

The alert is named HighAlert, has severity High, and is enabled (true) to trigger the playbook.