I need to create a query that runs against my servers that send logs to Azure Sentinel. I want to get an average say, over the last 7 days, and if the current 24 hour window is below the average by a certain percentage I want an alert sent.
I have Heartbeat alerts setup and those work. But we recently ran into an issue where the server was up and the agent was running, but logs were not being sent, so no heartbeat alert was sent.
Is something like this possible?
I've recently started having a problem where users can no longer log into the RDS server. They get 'Access is denied'.
If I add them to Domain Admins, they are able to get on without issue. I've checked Local Security Policy > Local Policies > User Rights Assignments > All log on through Remote Desktop Services. It has the appropriate groups assigned. I even added Domain Users to include everyone, but the users still get the access denied unless they are in the domain admins group.
I've checked the event log and the only 2 events associated with the security log are 2 4634 events that say An account was logged off. One with Logon Type 3 and the other with Logon Type 10.
Any ideas as to what could be casuing the issue?
So here's an interesting problem that just started happening today. OWA is no longer working on the internal network or Externally. I now get an error in IE saying:
"Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to https://server again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator. "
Yet in IE, TLS is enabled and SSL 2 & 3 have been disabled. I used IISCrypto on my Exchange 2010 server and it shows I am running with best practices.
I've also tried rebuilding my OWA Virtual Directory with no success.
I don't see any obvious errors in Event Viewer.
What could I be missing?
Another note, email is being forwarded to my exchange box from my mailmarshall server but external email is not showing in mailboxes. Only internal emails are.
I have a 3 or 4 users in our company whose emails consistently goes the recipient's spam folder. Whether it's gmail, yahoo, or another email provider.
We run an in house Exchange 2010 server. None of our static IP addresses, email server ip or otherwise is on any blacklist. Reverse DNS also comes back to our domain.
I've also narrowed it down to outlook sending the messages as HTML. If I send a message from outlook as html, it goes to spam. If I send from outlook as plain text, it goes to the inbox. If I use OWA and send it as HTML, it goes to the inbox, if I use OWA and send it as plain text, it goes to the inbox.
I've read that invalid html mark up can flag a message as possible spam.
My question is how do I fix it from an outlook side? Is there a patch update, a known bug or workaround?
The Outlook version in question is Outlook 2016 64 bit (version number: 16.0.4432.1000)
Below are the headers of a message sent straight to spam for a gmail account:
Delivered-To: [email protected]
Received: by 10.36.216.2 with SMTP id b2csp839244itg;
Thu, 8 Sep 2016 08:53:25 -0700 (PDT)
X-Received: by 10.55.121.67 with SMTP id u64mr459190qkc.114.1473350005112;
Thu, 08 Sep 2016 08:53:25 -0700 (PDT)
Return-Path: <>
Received: from morocco.FinkelLaw.local ([65.23.29.10])
by mx.google.com with ESMTPS id t91si29088576qtd.75.2016.09.08.08.53.24
for <[email protected]>
(version=TLS1 cipher=AES128-SHA bits=128/128);
Thu, 08 Sep 2016 08:53:25 -0700 (PDT)
Received-SPF: neutral (google.com: 65.23.29.10 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=65.23.29.10;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 65.23.29.10 is neither permitted nor denied by best guess record for domain of @finkellaw.com) [email protected]
Received: from ALASKA.FinkelLaw.local (Not Verified[192.168.170.245]) by morocco.FinkelLaw.local with MailMarshal (v7,1,1,5205) (using TLS: SSLv23)
id <B57d189740000>; Thu, 08 Sep 2016 11:53:24 -0400
Received: from ALASKA.FinkelLaw.local ([::1]) by ALASKA.FinkelLaw.local
([::1]) with mapi id 14.03.0301.000; Thu, 8 Sep 2016 11:52:51 -0400
From:
To: "[email protected]" <[email protected]>
Subject: Sent from outlook as html
Thread-Topic: Sent from outlook as html
Thread-Index: AdIJ6QkedPv4B7feQXGBQSNfw23Lbg==
Date: Thu, 8 Sep 2016 15:52:50 +0000
Message-ID: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [192.168.170.121]
Content-Type: multipart/alternative;
boundary="_000_BD475DDC50C9284797A8FBEAB175D3895F4D16B2ALASKAFinkelLaw_"
MIME-Version: 1.0
--_000_BD475DDC50C9284797A8FBEAB175D3895F4D16B2ALASKAFinkelLaw_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sent from outlook as html
--------------------------------------------------------
I.T. Manager
Finkel Law Firm LLC
4000 Faber Place Drive, Suite 450
North Charleston, South Carolina 29405
Direct Dial: (843) 576-6352
DISCLAIMER:
The information transmitted is intended only for the person or=20
entity to which it is addressed and may contain confidential=20
and/or legally privileged material. Any review, retransmission,=20
dissemination or other use of this information, directly or=20
indirectly, by persons or entities other than the intended=20
recipient is prohibited. If you are not the intended recipient=20
please contact the sender and delete the material from all=20
computers in which it resides. Internet communications cannot=20
be guaranteed to be secure or error-free as information could=20
be intercepted, corrupted, lost, destroyed, arrive late,=20
incomplete, or contain viruses. Therefore, we do not accept=20
responsibility for any errors or omissions that are present=20
in this message, or any attachments, that have arisen as a=20
result of e-mail transmission. If verification is required,=20
please request a hard-copy version or contact us by phone.=20
Any views or opinions presented are solely those of the author=20
and do not necessarily represent those of the firm.=20
CIRCULAR 230 DISCLOSURE: To comply with Treasury Department=20
regulations, we inform you that, unless otherwise expressly=20
indicated, any tax advice contained in this communication=20
(including any attachments or enclosures) is not intended or=20
written to be used, and cannot be used, for the purpose of=20
(i)avoiding penalties that may be imposed under the Internal=20
Revenue Code or any other applicable tax law, or (ii) promoting,=20
marketing or recommending to another party any entity, investment, plan, =
transaction, arrangement, or other tax related matter.
--_000_BD475DDC50C9284797A8FBEAB175D3895F4D16B2ALASKAFinkelLaw_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-mi=
crosoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:wo=
rd" xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D=
"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-asci=
i">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">=
<style><!--
/* Font Definitions */
@font-face
=09{font-family:"Cambria Math";
=09panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
=09{font-family:Calibri;
=09panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
=09{margin:0in;
=09margin-bottom:.0001pt;
=09font-size:11.0pt;
=09font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
=09{mso-style-priority:99;
=09color:#0563C1;
=09text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
=09{mso-style-priority:99;
=09color:#954F72;
=09text-decoration:underline;}
span.EmailStyle17
=09{mso-style-type:personal-compose;
=09font-family:"Calibri",sans-serif;
=09color:windowtext;}
.MsoChpDefault
=09{mso-style-type:export-only;
=09font-family:"Calibri",sans-serif;}
@page WordSection1
=09{size:8.5in 11.0in;
=09margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
=09{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Sent from outlook as html<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">--------------------------------------------------=
------<o:p></o:p></p>
<p class=3D"MsoNormal">Jo<o:p></o:p></p>
<p class=3D"MsoNormal">I.T. Manager<o:p></o:p></p>
<p class=3D"MsoNormal">Finkel Law Firm LLC<o:p></o:p></p>
<p class=3D"MsoNormal">4000 Faber Place Drive, Suite 450<o:p></o:p></p>
<p class=3D"MsoNormal">North Charleston, South Carolina 29405<o:p></o:p><=
/p>
<p class=3D"MsoNormal">Direct Dial: (843) 576-6352<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
<P align=3Dleft><FONT size=3D1><FONT face=3DArial>DISCLAIMER: The informa=
tion=20
transmitted is intended only for the person or entity to which it is addr=
essed=20
and may contain confidential and/or legally privileged material. Any revi=
ew,=20
retransmission, dissemination or other use of this information, directly =
or=20
indirectly, by persons or entities other than the intended recipient is=20
prohibited. If you are not the intended recipient please contact the send=
er and=20
delete the material from all computers in which it resides. Internet=20
communications cannot be guaranteed to be secure or error-free as informa=
tion=20
could be intercepted, corrupted, lost, destroyed, arrive late, incomplete=
, or=20
contain viruses. Therefore, we do not accept responsibility for any error=
s or=20
omissions that are present in this message, or any attachments, that have=
=20arisen=20
as a result of e-mail transmission. If verification is required, please r=
equest=20
a hard-copy version or contact us by phone. Any views or opinions present=
ed are=20
solely those of the author and do not necessarily represent those of the =
firm.=20
</FONT></FONT></P>
<P align=3Dleft><FONT size=3D1><FONT face=3DArial>CIRCULAR 230 DISCLOSURE=
: To comply=20
with Treasury Department regulations, we inform you that, unless otherwis=
e=20
expressly indicated, any tax advice contained in this communication (incl=
uding=20
any attachments or enclosures) is not intended or written to be used, and=
=20cannot=20
be used, for the purpose of (i)avoiding penalties that may be imposed und=
er the=20
Internal Revenue Code or any other applicable tax law, or (ii) promoting,=
=20
marketing or recommending to another party any entity, investment, plan, =
transaction, arrangement, or other tax related matter.</FONT>=20
</FONT></P>
</body>
</html>
--_000_BD475DDC50C9284797A8FBEAB175D3895F4D16B2ALASKAFinkelLaw_--