Connect Threat Indicators to Azure Sentinel

By Ashwin Venugopal -

 



Plan for threat intelligence connectors

Azure Sentinel readily allows you to import the threat indicators your organization uses, which can enhance your security analysts ability to detect and prioritize known threats. Several features from Azure Sentinel then become available or are enhanced are as follows:

  • Analytics includes a set of scheduled rule templates you can enable to generate alerts and incidents based on matches of log events from your threat indicators.

  • Workbooks provide summarized information about the threat indicators imported into Azure Sentinel and any alerts generated from analytics rule that match your threat indicators.

  • Hunting queries allow security investigators to use threat indicators within the context of common hunting scenarios.

  • Notebooks can use threat indicators when you investigate anomalies and hunt for malicious behaviors.   

There are two types of Threat Intelligence Connectors- the TAXII Connector and the Threat Intelligence Platforms Connector. Both of which writes to the ThreatIntelligenceIndicator table and have different configuration procedures.

Connect the threat intelligence TAXII connector

Azure Sentinel is adjoined with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence and can be used to send threat indicators from TAXII servers to Azure Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. To view the connector page:

  1. Select Data connector page.
  2. Select Threat intelligence- TAXII. 
  3. Select the Open connector page on the preview pane.
  4. Specify the required and optional information in the text boxes. 

  • Friendly name (for server)
  • API root URL
  • Collection ID
  • Username
  • Password          

     5. Select Add to enable the connection.

The list of configure TAXII servers shows the currently connector TAXII servers and the last indicator received time. 

Connect the threat intelligence platforms connector

Azure Sentinel integrates with the Microsoft Graph Security API data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send threat indicators to Azure Sentinel from your Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MindMeld, MISP, or other integrated applications. Threat indicators can include IP addresses, domains, URLs, and file hashes.

Connect Azure Sentinel to your threat intelligence platform

  • Register an application in Azure Active Directory to get an application ID, application secret, Azure Active Directory tenant ID. 

  • Configure API permissions for the registered application- Add the Microsoft Graph Application permission ThreatIndicators.ReadWrite.OwnedBy to your registered application.

  • Ask your Azure AD tenant administrator to grant admin consent to the registered application for your organization. From the Azure portal- Azure Active Directory- App registrations- app name- View API permissions- Grant admin consent for tenant name.

  • Configure your TIP product or app that uses direct integration with Microsoft Graph Security tiIndicators API to send indicators to Azure Sentinel by specifying the following:
  • The values for the registered application's ID, secret, and tenant ID.
  • For the target product, specify Azure Sentinel.
  • For the action, specify alert.

  • In the Azure portal, navigate to Azure Sentinel then Data connectors and then select the Threat Intelligence Platforms (Preview) connector.

  • Select Open connector page, and then connect.

  • To view the threat indicators imported into Azure Sentinel, navigate to Azure Sentinel Logs then SecurityInsights, and lastly expand ThreatIntelligenceIndicator.          

View your Threat Indicators

The indicators are located in the ThreatIntelligenceIndicator table which is the basis for queries performed by other Azure Sentinel features such as Analytics and Workbooks. To view your threat indicators with KQL, select Logs from the General section of the Azure Sentinel menu and then run a query on the ThreatIntelligenceIndicator.














Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more