Accelerynt

A leading provider of security, ERP, and IT solutions, Accelerynt is your secure path to business performance. Formerly Arbala

[Speaker 25 @rodtrent]

Analytics Rule: Identifies a match across IOC's related to an actor tracked by Microsoft as SOURGUM https://t.co/NLUTBIMiAf #AzureSentinel

[Accelerynt @arbalasecurity]

@rodtrent And they are editable! 👍

[Accelerynt @arbalasecurity]

Can anyone at @msftsecurity boost the visibility on this? MDATP package for Ubuntu 21.04 seems to be broken @MsftSecIntel #azuresentinel @MSThreatProtect https://t.co/dXr028i9NY

[Accelerynt @arbalasecurity]

Bump

[Accelerynt @arbalasecurity]

Can some at @ThreatConnect please DM me?

[Accelerynt @arbalasecurity]

If you are looking for one of the easiest ways to get IOCs into Azure Sentinel, this is it. The next update being worked on will allow hashes, and IPs to be added. @MsftSecIntel #Security #opensource https://t.co/65nw2wS15N

[Accelerynt @arbalasecurity]

#AzureSentinel *Updated* Arbala Security Multi-Tool browser extension for Azure Sentinel. You can now copy & paste multiple IOCs. Adjust confidence score, TLP level & customize descriptions. Like many of our other offerings, this is free and open source. https://t.co/3A9VBwh8gJ

[Accelerynt @arbalasecurity]

This is extremely useful when a Sentinel Incident identifies a malicious domain communication and you want to quickly add it to your Zscaler Block list.

[Accelerynt @arbalasecurity]

If you use #AzureSentinel - You might find this ARM template useful beyond the #Zscaler purpose because it introduces JavaScript in a Playbook. I hope you enjoy! Feel free to contact any one on our team for questions or assistance. https://t.co/e3ttdQUXUq

[Accelerynt @arbalasecurity]

This ARM template will deploy an Integration Account and a Playbook. It will pull domains from Sentinel Incidents and add them to a Zscaler URL Category of your choice. URL Categories can be configured to Block and Allow domains in the Zscaler Access Policies.