Getting Started with Microsoft Sentinel - Detect Threats

By Ashwin Venugopal -

 









Detect Threats Out-Of-The-Box

Now, Microsoft Sentinel is all set to collect all the data from an organization and it will be required to scan that data for any security threat. Hence, Microsoft Sentinel offers templates to create threat detection rules termed as analytics rules. 

These analytics rule templates are designed by a team of security experts and analysts, according to the known threats, common attack vectors, and suspicious activity escalation chains. so, the rules created from these templates, automatically search for any anomalies in a network environment. These templates can also be customized accordingly. When the alerts are generated, they create incidents that are further investigated. 

View Detections

Firstly, go to Analytics > Rules templates tab, which contains all the installed rule templates. Now, to find more rule templates, go to Content hub, in order to install the related product solutions or standalone content. These detections include:

Rule Type

Description

Microsoft Security

The Microsoft Security templates automatically create Microsoft Sentinel incidents from the generated alerts in real time. The Microsoft Security rules can also be used as a template to create new rules with similar logic.

Fusion

Fusion correlation engine has scalable machine learning algorithms, that can be used to detect advanced multistage attacks by correlating many low-fidelity alerts and events across multiple products into high-fidelity and actionable incidents. It is enabled by default and since its logic is hidden, it cannot be customized. Only one rule can be created with this template.

Machine Learning (ML) behavioral analytics

These templates are based on proprietary machine learning algorithms, with a hidden internal logic of how they work while running. This is also not customizable because of hidden logic, and only one rule can be created from its each template.

Threat Intelligence

It can help in generating high-fidelity alerts and incidents. This rule cannot be customized. Whenever enabled, it can automatically match Common Event Format (CEF) logs, Syslog data or Windows DNS events with domain, IP, and URL threat indicators from Microsoft Threat Intelligence.

Anomaly

These rule templates use machine learning to detect specific types of anomalous behavior. Every rule contains unique parameters and thresholds to analyse any behavior.

Since, the configurations of out-of-the-box rules cannot be changed or fine-tuned, a rule can be duplicated, then that duplicate can be changed and fine-tuned. Here, the duplicate is run in Flighting mode and the original in Production mode, simultaneously. The results are then compared and the duplicate is switched to Production accordingly.

Scheduled

These rules are based on queries written by Microsoft security experts. Changes can be made to the query logic. Scheduled rules template can be used to customize the query logic and schedule settings to create new rules. The new scheduled analytics rule templates produce alerts correlated to the Fusion engine to produce high-fidelity incidents.

Near-real-time (NRT)

NRT rules are a set of limited scheduled rules, that are designed to run once every minute and supplies information on per minute basis. Their configuration and functions are similar to that of scheduled rules, with some limitations.

 Use Analytics Rule Templates

  1. In Microsoft Sentinel, go to Analytics>Rule templates page.
  2. Now, select a template name and click Create rule button on the details pane to create a new active rule according to the template.
  3. The template contains a list of required data sources, and they are automatically checked for availability. Hence, the Create rule button may be disabled or show a warning sign, due to an availability issue. 
  4. Select Create rule to open rule creation wizard. All the details will be autofilled. 
  5. The logic and the other rule settings can be customized with the help of Scheduled or Microsoft security templates. The process can be repeated to create more rules. 
  6. Follow the steps in the rule creation wizard till the end, to finish creating a rule based on the template. The new rules will appear in the Active rules tab.

Export Rules to an ARM Template

The rule can be easily exported to an Azure Resource Manager (ARM) template to manage and deploy the rules as code. The rules can also be imported from template files to view and edit them in the user interface. 

















































Comments

Post a Comment

Popular posts from this blog

Query, Visualize, & Monitor Data in Azure Sentinel

By Ashwin Venugopal -
Image
  Azure Sentinel Workbooks Several ready for use templates are provided by the Azure Sentinel that can be used to create your own workbook and then modify them as needed for Contoso. Most of the data connectors it uses to ingest data come with their own workbooks, but better insight can be obtained by simply looking into the data that is being ingested by using tables and visualizations, including bar and pie charts. You can also make your own workbook easily by using this data from the beginning instead of using the predefined templates. Workbook Page You can easily access the workbook page from the Azure Sentinel from the navigation pane which consists of the: Workbook header- You can add a new workbook and review the saved workbooks as well as templates that are available on the workbook page. Templates section- You can access existing workbook templates on the Templates tab. You can save some of the workbooks for quick access and they will appear on the My Workbooks tab.  From the
Read more

Planning for Implementing SAP Solutions on Azure (Part 2 of 5)

By Ashwin Venugopal -
Image
  To read part 1 please click  here To read part 3 please click  here To read part 4 please click  here To read part 5 please click  here Load Balancing The load balancer uses probe ports to determine as well as route the traffic to an active DBMS node, but of there's any failover then the most common SAP application architecture can automatically reconnect against the private virtual IP address without the need for the SAP application to reconfigure it, while the load balancer redirect the traffic against the private virtual IP address without any need for the SAP application to reconfigure. The loaf balancer also offers an option of DirectServerReturn which if configured, can help in directing the traffic from the DBMS VM to the SAP application layer directly to the application layer without routing through the load balancer. But, if it isn't configured, then the return traffic to the SAP application layer is routed through the load balancer. You can also use Azure Load Balan
Read more

Work with String Data Using KQL Statements

By Ashwin Venugopal -
Image
  Extract Data from Unstructured String Fields Unstructured string fields often contains the Security log data and requires parsing to extract data. There are multiple ways of pulling information from string fields in KQL and the two primary operators used are extract and parse.  Extract It gets a match for a regular expression from a text string. You can convert the extracted substring to the indicated type.  Arguments regex- A regular expression. captureGroup- A positive int constant indicating the capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, 2 or more for subsequent parenthesis.  text- A string to search. typeLiteral- An optional type literal. If provided, the extracted substring is converted to this type.  Returns If regex finds a match in text- the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral. If there's no mat
Read more