question

ChaudharyPrernaRIEPL-0186 avatar image
0 Votes"
ChaudharyPrernaRIEPL-0186 asked ChaudharyPrernaRIEPL-0186 answered

Does sentinel has any in-bulit function for Shannon's entropy like we have one in Splunk (ut_shannon())??

I am trying to work on a use-case for DGA and was thinking of using Shannon's entropy to get randomness in domain name. Splunk has a function for this but couldn't find anything similar in Sentinel. Would be of great help if we Sentinel has something similar.

microsoft-sentinel
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@ChaudharyPrernaRIEPL-0186 As fas as I know there is no default function for it. We have one example from our expert for process name entropy at :
https://techcommunity.microsoft.com/t5/azure-sentinel/identifying-threat-hunting-opportunities-in-your-data/ba-p/915721

i will check internally to see if we can help you something concrete. Will update soon.

0 Votes 0 ·

1 Answer

ChaudharyPrernaRIEPL-0186 avatar image
0 Votes"
ChaudharyPrernaRIEPL-0186 answered

@vipulsparsh-MSFT Thanks for your response. I did go through the detailed article and the query which is pretty nice but tweaking it to our needs might be difficult. So, was just wondering if something like Splunk's entropy function/macro can be done with Sentinel.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.