Blogs by Ashwin

 Access Azure Sentinel Data with External Tools Azure Sentinel's foundation is based on the Log Analytics Data Store, which is capable of combining the high-performance querying, dynamic schema, and scales to massive data volumes. The Azure portal and all the other Azure Sentinel tools always uses a standard API to access this data store which is also available for external tools such as Python and PowerShell. There are two libraries that can be used to simplify API access: kqlmagic msticpy kqlmagic The kqlmagic library provides the easy to implement API wrapper to run KQL queries. msticpy msticpy, also known as the Microsoft Threat Intelligence Python Security Tools, is a set of Python tools intended to be used for security investigations and hunting. Many of the tools originated as code Jupyter notebooks solve a problem as part of security investigation. Some of the tools are only useful in notebooks, but many others can be used from the Python command line or imported into your ...

  Manage Azure Sentinel Threat-Hunting Queries To efficiently find and isolate security threats, and unwanted activities in Contoso's environment, you can use the Azure Sentinel which contains powerful query tools. Hunt by using built-in queries Search and query tools can be used in Azure Sentinel to hunt for security threats and tactics throughout your environment. The Hunting page in Azure Sentinel provides built-in queries that can easily guide your hunting process as well as helps you to pursue the appropriate hunting paths to uncover issues in your environment while also exposing issues with the help of Hunting Queries that aren't significant enough on their own to generate an alert but have happened often enough over time to warrant investigation.  The Hunting page also provides a list of all hunting queries that can be saved by selecting the Favorites star icon for the query in the list.  Tip- When a query is selected as a favorite, it runs automatically each time ...

  CyberSecurity Threat Hunting The term "threat hunting" is defined differently by different people. The most commonly used definition is that it is the idea that you are proactively hunting through your environment for a threat or a set of activities that you have not previously detected.  Other uses of the term hunting includes searching for threats with newly obtained indicators. If a new IP Address considered harmful is provided by a Threat Intelligence Feed, an analyst can then note the IP address to search the log to find if the new indicator was seen in the past. Azure Sentinel already provides hunting queries to facilitate this process.Next, you can hunt for more evidence-based threats from a current Incident or Alert as part of an Incident Analysis Process which is vital to explore the data based on the evidence found in a current incident. Both Azure Sentinel and Microsoft 365 Defender provides this type of hunting capability. Using KQL queries to find threats is th...

  Azure Sentinel Workbooks Several ready for use templates are provided by the Azure Sentinel that can be used to create your own workbook and then modify them as needed for Contoso. Most of the data connectors it uses to ingest data come with their own workbooks, but better insight can be obtained by simply looking into the data that is being ingested by using tables and visualizations, including bar and pie charts. You can also make your own workbook easily by using this data from the beginning instead of using the predefined templates. Workbook Page You can easily access the workbook page from the Azure Sentinel from the navigation pane which consists of the: Workbook header- You can add a new workbook and review the saved workbooks as well as templates that are available on the workbook page. Templates section- You can access existing workbook templates on the Templates tab. You can save some of the workbooks for quick access and they will appear on the My Workbooks tab.  ...

  User & Entity Behavior Analytics (UEBA) To eliminate the drudgery from your analysts' workloads and the uncertainty from their efforts you can simply use the UEBA capability in Azure Sentinel, which delivers high-fidelity and actionable intelligence, so that they can focus on investigation as well as remediation. Azure Sentinel collects logs and alerts from all of its connected data sources to analyze them as well as build baseline behavioral profiles of your organization's entities across time and peer group horizon. By using various techniques and machine learning capabilities, Sentinel can then easily identify anomalous activities as well as help you to determine if an asset has been compromised, while also figuring out the relative sensitivity of particular assets, identify the peer groups of assets, as well as evaluate the potential impact of any given compromised asset. Armed with this information, you can effectively prioritize your investigation and incident handl...

  Incident Management in Azure Sentinel Incident management is a complete process of incident investigation, which starts from creation, while processing in-depth investigation, and finally to resolution providing a complete incident management environment to perform these steps. Azure Sentinel can be used to review the following: detailed incident information,  assign an incident owner,  set and maintain incident severity, and manage incident status.  Explain Evidence & Entities Various sources of security information are extensively used by Azure Sentinel to create incidents and as the lead system engineer at Contoso, there will always be a need to understand these sources to the best utilization of  incident management in Azure Sentinel. Incident Evidence Incident evidence provides security event information and related Azure Sentinel assets that can identify threats in the Azure Sentinel environment. They can display how a threat has been identified in A...

  Azure Sentinel as a SIEM & SOAR solution Azure Sentinel is known for its Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) solution that's especially designed for hybrid environments. To alert you about any potential security threats such as attempts to access Contoso's resources from outside its infrastructure or when data from Contoso appears to be sent to a known malicious IP address, it extensively uses built-in and custom detections while also creating incidents based on these alerts.  Azure Sentinel Playbooks The collections of the procedures based on Azure Logic Apps that runs in response to an alert are called Security Playbooks and can also be run manually in response to your investigation of an incident or an alert can be configured to run a playbook automatically. Its ability to respond to the incidents automatically also allows you to automate some of your security operations and make your Service Orga...

  Threat Detection with Azure Sentinel Analytics What is Azure Sentinel Analytics? Azure Sentinel Analytics offers several functionalities that can be used to implement security for the data and resources at Contoso.  Historical data  collected from your workstations, servers, networking devices, firewalls, intrusion prevention, sensors, and so on can be analyzed from various sources to identify correlations and anomalies. Analytics rules can trigger alerts based on the attack techniques that are used by known malicious actors and these rules can be easily set up to help ensure your SOC is alerted to potential security incidents in your environment regularly. Why use analytics rules for security operations? Azure Sentinel Analytics plays a vital part in the overall detection of the security threat by correlating and matching the signals that impact the presence of a cybersecurity threat. You can easily get insights into where an attack originated from, what resources were...

  Plan for threat intelligence connectors Azure Sentinel readily allows you to import the threat indicators your organization uses, which can enhance your security analysts ability to detect and prioritize known threats. Several features from Azure Sentinel then become available or are enhanced are as follows: Analytics includes a set of scheduled rule templates you can enable to generate alerts and incidents based on matches of log events from your threat indicators. Workbooks provide summarized information about the threat indicators imported into Azure Sentinel and any alerts generated from analytics rule that match your threat indicators. Hunting queries allow security investigators to use threat indicators within the context of common hunting scenarios. Notebooks can use threat indicators when you investigate anomalies and hunt for malicious behaviors.    There are two types of Threat Intelligence Connectors- the TAXII Connector and the Threat Intelligence Platforms ...

  Plan for the Syslog Connector The events from Linux-based, Syslog-supporting machines or appliances can be streamed into Azure Sentinel using the Log Analytics agent for Linux. The host's native Syslog daemon will collect local events of the specified types and forward them locally to the agent, which will stream them to your Log Analytics workspace. Log Analytics also helps in collecting the messages sent by the rsyslog or syslog-ng daemons, where rsyslog is the default that's on version 5 of Red Hat Enterprise Linux (RHEL), CentOS, and Oracle except for the Linux version sysklog Syslog event collection and the rsyslog daemon should be installed and configured to replace sysklog for these versions of Linux. How it works? Syslog is an event logging protocol that is common to Linux and when the Log Analytics agent for Linux is installed on your VM or appliance, the installation routine configures the local Syslog daemon to forward messages to the agent on TCP port 25224 which ...