Create Detections & Perform Investigations using Azure Sentinel

 

Threat Detection with Azure Sentinel Analytics

What is Azure Sentinel Analytics?

Azure Sentinel Analytics offers several functionalities that can be used to implement security for the data and resources at Contoso. 

Historical data  collected from your workstations, servers, networking devices, firewalls, intrusion prevention, sensors, and so on can be analyzed from various sources to identify correlations and anomalies.

Analytics rules can trigger alerts based on the attack techniques that are used by known malicious actors and these rules can be easily set up to help ensure your SOC is alerted to potential security incidents in your environment regularly.

Why use analytics rules for security operations?

Azure Sentinel Analytics plays a vital part in the overall detection of the security threat by correlating and matching the signals that impact the presence of a cybersecurity threat. You can easily get insights into where an attack originated from, what resources were compromised, potential data lost, along with the timeline for the incident, with the help of a proper analytics rule. Common security analytics use cases include:

• Identification of compromised accounts
• User behavior analysis to detect potentially suspicious patterns
• Network traffic analysis to locate trends indicating potential attacks
• Detection of data exfiltration by attackers
• Detection of insider threats
• Investigation of incidents
• Threat hunting  

Certain threats can go undetected for months but Combining the data gathered by multiple tools and products, with the power of threat intelligence can help to detect, analyze, and mitigate insider threat.  Analytics rules can also create custom alerts that use indicators of attack as well as help the Contoso SOC team to improve the efficiency of their complex investigation and detect threats faster.

Types of Analytics rules

Azure Sentinel Analytics rules helps in the configuration of notification and alerts based on the data coming from the sources that are connected to Azure Sentinel and search for the potential threats by using the built-in analytics rules that Azure Sentinel Analytics provides. There are currently four types of analytics rules:

• Fusion
• Microsoft Security
• Machine Learning (ML) behavior analytics
• Scheduled alerts

Fusion Alerts

Fusion alerts identifies anomalous behaviors and suspicious activities at various stages of the cyber kill chain. By default, fusion detection is enabled in Azure Sentinel for which following data connectors must be configured:

• Azure AD Identity Protection
• Microsoft Cloud App Security
• Microsoft Defender Advanced Threat Protection
• Palo Alto Networks

Some of the common attack scenarios that Fusion alerts identify includes:

• Data Exfiltration- Suspicious activity detected, such suspicious forwarding rule in Microsoft 365 mailbox, after a suspicious sign-in to Azure AD account can indicate compromised user account.
• Data Destruction- Anomalous number of unique files that were deleted after a suspicious sign-in to Azure AD account can signal that a compromised user account was used to destroy data. 
• Denial of Service- Significant number of Azure VMs deleted after a suspicious sign-in to Azure AD account can signal a compromised user account that can be used to destroy the organization's assets.
• Lateral Movement- Significant number of impersonation actions that occur after a suspicious sign-in to Azure AD account can indicate a compromised user account that was used for malicious purposes.
• Ransomware- After a suspicious sign-in to an Azure AD account, unusual user behavior used to encrypt data can trigger a ransomware execution alert.

Microsoft Security

Microsoft Security solutions that are connected to Azure Sentinel can be configured to automatically create incidents from all the alerts generated in the connected service. The following security solutions can be configured to pass their alerts to Azure Sentinel:

• Microsoft Cloud App Security
• Azure Defender for Server
• Azure Defender for IoT
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Azure AD Identity Protection
• Microsoft Defender for Endpoint

Note- Microsoft unifies SIEM and eXtended Detection and Response (XDR) terminology across their security product. 

Machine Learning Behavioral Analytics

Azure Sentinel analytics consists of machine learning behavioral analytics rules which uses the Microsoft machine learning algorithms to detect suspicious activity and correlates several low-fidelity incidents into a high-fidelity security incident thus saving hours that might be otherwise spend manually analyzing numerous alerts from different products as well as correlating them. Machine learning algorithms used by analytics rules, also help reduce the noise around alerts by quickly ingesting and connecting important data.

Scheduled Alerts

Scheduled alerts analytics rules provide you the highest level of customization and helps in defining your own expression using Kusto Query Language (KQL) to filter the security events, and set up a schedule for the rule to run.

Manage Analytics Rules

Noise and filter can be adjusted as the more important threats detected, by managing the analytics rules on an ongoing basis which helps to ensure that your rules remain useful and efficient in detecting potential security threats. You can easily perform the following four actions on the existing active rules:

• Edit Rules- You can modify the existing rules by selecting Edit in the details pane. To edit a rule, you can navigate the same pages that you did in creating the rule. The previous inputs that you used to create the rule are preserved. You can change any properties of the rule to further tune the result of the threat detection. 

• Disable Rules- You can disable the rule when you are performing an activity that can trigger the rule alert. Disabled rules retained their configuration, and you can enable them again at a later time.

• Duplicate Rules- When you duplicate a rule, the rule contains all the configuration provided by the original rule. You can further modify the configuration based on your requirements. You should not forget to change the name of the duplicated rule because by default, the duplicate rule has the same name as the original rule with the string Copy appended to it. 

• Delete Rules- Deleting the rules prompts you for confirmation before Azure Sentinel Analytics removes it from the set of active rules. For example, you can delete a rule about a service or a resource that isn't in use, which eliminates the need for the rule. Be aware the deleting a rule is permanent, and there isn't an undo feature. Therefore, we recommend you first disable the rule for a period of time until you are sure you don't need it.