Manage Alerts & Incidents (part 3 of 3)

By Ashwin Venugopal -

 


To read part 1 please click here
To read part 2 please click here


Perform Advanced Hunting

Advanced Hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data while allowing you to proactively inspecting the events in your network to locate threat indicators as well as entities which enables unconstrained hunting for both the known and potential threats.

Data freshness and update frequency

Advanced hunting data can be categorized into two different types, each consolidated differently:

  • Event or activity data- it populates tables about alerts, security events, system events, and routine assessments. Advanced hunting receives this data almost immediately after the sensors that collects them successfully transfer them to the Defender for Endpoint.

  • Entity data- it populates tables with consolidated information about the users and the devices and to provide fresh data, tables are updated with any new information in every 15 minutes, adding rows that might not be fully populated. Every 24 hours, the data is consolidated ti insert a record that contains the latest, most comprehensive data set about each entity.    

Custom Detection

The custom detection helps you to proactively monitor for and respond to various events as well as system states, including suspected breach activity and misconfigured devices while working with the advanced hunting, which provides a powerful, flexible query language that covers a broad set of event and system information from your network. You can also set them to run at regular intervals, generate alerts, and take response actions whenever there are matches.

Custom detection provides:

  • Alerts for rule-based detection built from advanced hunting queries
  • Automatic response actions that apply to the files and devices

Consult Microsoft Threat Expert

Microsoft Threat Expert is a managed threat hunting service that provides Security Operations Center (SOCs) with expert level monitoring and analysis to ensure critical threats in their unique environments are not missed.

Microsoft Defender for Endpoint need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with the experts on demand. Experts on demand are an add-on service and Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Expert managed threat hunting service.

Targeted Attack Notification

Microsoft threat experts offers a proactive hunting for the most important threats to your network, including human adversary intrusion, hands-on-keyboard attacks, or advanced attacks like cyberespionage. The managed hunting service includes:

  • Threat monitoring and analysis, reducing dwell time and risk to the business.
  • Hunter-trained artificial intelligence to discover as well as prioritize both the known and unknown attacks.
  • Identifying the most important risks, helping SOCs to maximize the time and energy. 
  • Scope of compromise and as context as can be quickly delivered to enable fast SOC response.

Collaborate with experts, on demand

Experts provides the insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised devices, root cause of a suspicious network connection, to more threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can:

  • Get more clarification on the alerts including the root cause or scope of the incident.
  • Gain clarity into the suspicious device behavior and next steps if faced with an advanced attacker.
  • Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques.
  • Seamlessly transition to Microsoft Incident Response (IR) or the other third-party Incident Response services when necessary.   

The option to consult with a threat expert is available with several places in the portal so that you can engage with the experts in the context of your investigation:

  • Help and support menu
  • Device page actions menu
  • Alerts page actions menu
  • File page actions menu 


To read part 1 please click here
To read part 2 please click here









Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more