{"id":4712,"date":"2020-08-24T10:33:19","date_gmt":"2020-08-24T08:33:19","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=4712"},"modified":"2020-08-24T10:33:20","modified_gmt":"2020-08-24T08:33:20","slug":"sending-sms-notification-of-azure-sentinel-alerts-through-azure-monitor","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=4712","title":{"rendered":"Sending SMS notification of Azure Sentinel alerts, through Azure Monitor"},"content":{"rendered":"\n

In Azure Sentinel, all alert responses are driven by Playbooks. Playbooks are Azure Logic Apps, that allow everything automation from simple send e-mail to complex integration scenarios.
Last week we were working in a scenario where we needed to send alert notification as text messages (SMS). There are several 3rd party connectors available in Logic Apps, but Azure Monitor provides this capability out of the box, without the need for additional agreements. Without any experience, I would personally guess that the 3rd party connects have more features, for example, the possibility for engineers on duty to confirm alert notification by a test message. But in this example, we only need to send text messages.
All alerts raised within Azure Sentinel, as well as Azure Security Center, are written into the SecurityAlert table in the Azure Monitor Logs workspace. You can use the following query to view which products have raised alerts into this table in the last 60 days:<\/p>\n\n\n\n


SecurityAlert
| where TimeGenerated between (ago(60d) .. ago(5m))
| summarize by ProductName<\/code><\/p>\n\n\n\n

If you have connected products like Microsoft Cloud App Security or Microsoft Defender ATP, you may also see these listed as a product:<\/p>\n\n\n\n

\"\"<\/a><\/figure><\/div>\n\n\n\n

Alerts raised by the analytics rules in Azure Sentinel will have the ProductName property set to Azure Sentinel. As the alert data is stored in the SecurityAlert table in the Azure Monitor Logs workspace, it is possible to leverage built-in capabilities in Azure Monitor Alerts for responses.
<\/p>\n\n\n\n

In this example, we will use Azure Monitor to raise alerts from the Sentinel data for \u00e2\u20ac\u0153Failed logon attempts within 10 mins\u00e2\u20ac\u009d. This is a default rule in Azure Sentinel.<\/p>\n\n\n\n

\"\"<\/a><\/figure><\/div>\n\n\n\n

The following query show the alerts we want to be notified about. This query is executed in the workspace that Azure Sentinel is using. Once we test the query in Logs, we can use it to configure an alert rule in Azure Monitor.<\/p>\n\n\n\n

SecurityAlert
| where ProductName == \"Azure Sentinel\"
| where ProviderName == \"ASI Scheduled Alerts\"
| where AlertName == \"Failed logon attempts within 10 mins\"<\/code><\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

In this example we create a new action group to send out the notification, by text message.<\/p>\n\n\n\n

\"\"<\/a><\/figure><\/div>\n\n\n\n
\"\"<\/a><\/figure><\/div>\n\n\n\n
\"\"<\/a><\/figure><\/div>\n\n\n\n

Once the action group is configured, and the alert rule, the phone number we included will get a SMS saying welcome to the action group. When a new alert is raised a text message notification will be sent out, as shown in the image below.<\/p>\n\n\n\n

\"\"<\/a><\/figure><\/div>\n","protected":false},"excerpt":{"rendered":"

In Azure Sentinel, all alert responses are driven by Playbooks. Playbooks are Azure Logic Apps, that allow everything automation from simple send e-mail to complex integration scenarios.Last week we were working in a scenario where we needed to send alert notification as text messages (SMS). There are several 3rd party connectors available in Logic Apps, … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[64],"tags":[77,72,96,95,94],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4712"}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4712"}],"version-history":[{"count":2,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4712\/revisions"}],"predecessor-version":[{"id":4724,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4712\/revisions\/4724"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4712"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}