Getting Started with Microsoft Sentinel - Detect Threats

 

Detect Threats Out-Of-The-Box

Now, Microsoft Sentinel is all set to collect all the data from an organization and it will be required to scan that data for any security threat. Hence, Microsoft Sentinel offers templates to create threat detection rules termed as analytics rules. 

These analytics rule templates are designed by a team of security experts and analysts, according to the known threats, common attack vectors, and suspicious activity escalation chains. so, the rules created from these templates, automatically search for any anomalies in a network environment. These templates can also be customized accordingly. When the alerts are generated, they create incidents that are further investigated. 

View Detections

Firstly, go to Analytics > Rules templates tab, which contains all the installed rule templates. Now, to find more rule templates, go to Content hub, in order to install the related product solutions or standalone content. These detections include:

Rule Type	Description
Microsoft Security	The Microsoft Security templates automatically create Microsoft Sentinel incidents from the generated alerts in real time. The Microsoft Security rules can also be used as a template to create new rules with similar logic.
Fusion	Fusion correlation engine has scalable machine learning algorithms, that can be used to detect advanced multistage attacks by correlating many low-fidelity alerts and events across multiple products into high-fidelity and actionable incidents. It is enabled by default and since its logic is hidden, it cannot be customized. Only one rule can be created with this template.
Machine Learning (ML) behavioral analytics	These templates are based on proprietary machine learning algorithms, with a hidden internal logic of how they work while running. This is also not customizable because of hidden logic, and only one rule can be created from its each template.
Threat Intelligence	It can help in generating high-fidelity alerts and incidents. This rule cannot be customized. Whenever enabled, it can automatically match Common Event Format (CEF) logs, Syslog data or Windows DNS events with domain, IP, and URL threat indicators from Microsoft Threat Intelligence.
Anomaly	These rule templates use machine learning to detect specific types of anomalous behavior. Every rule contains unique parameters and thresholds to analyse any behavior. Since, the configurations of out-of-the-box rules cannot be changed or fine-tuned, a rule can be duplicated, then that duplicate can be changed and fine-tuned. Here, the duplicate is run in Flighting mode and the original in Production mode, simultaneously. The results are then compared and the duplicate is switched to Production accordingly.
Scheduled	These rules are based on queries written by Microsoft security experts. Changes can be made to the query logic. Scheduled rules template can be used to customize the query logic and schedule settings to create new rules. The new scheduled analytics rule templates produce alerts correlated to the Fusion engine to produce high-fidelity incidents.
Near-real-time (NRT)	NRT rules are a set of limited scheduled rules, that are designed to run once every minute and supplies information on per minute basis. Their configuration and functions are similar to that of scheduled rules, with some limitations.

 Use Analytics Rule Templates

1. In Microsoft Sentinel, go to Analytics>Rule templates page.
2. Now, select a template name and click Create rule button on the details pane to create a new active rule according to the template.
3. The template contains a list of required data sources, and they are automatically checked for availability. Hence, the Create rule button may be disabled or show a warning sign, due to an availability issue. 
4. Select Create rule to open rule creation wizard. All the details will be autofilled. 
5. The logic and the other rule settings can be customized with the help of Scheduled or Microsoft security templates. The process can be repeated to create more rules. 
6. Follow the steps in the rule creation wizard till the end, to finish creating a rule based on the template. The new rules will appear in the Active rules tab.

Export Rules to an ARM Template

The rule can be easily exported to an Azure Resource Manager (ARM) template to manage and deploy the rules as code. The rules can also be imported from template files to view and edit them in the user interface.