M3: Analytics Rules
Last updated
Last updated
This module guides you through the Analytics Rule part in Microsoft Sentinel, and shows you how to create diffrent type of rules (Security Detections)
This module assumes that you have completed Module 1, as the data and the artifacts that we will be using in this module need to be deployed on your Microsoft Sentinel instance.
Open your newly created Microsoft Sentinel instance.
On the left menu navigate to analytics and select Rule template section
Review the analytics rules templates that ship with the product.
On the analytics rule filter select Data sources and check security Event, review all the analytic rules on the above data source.
In the rule search bar type Rare RDP Connections for the rule name.
To review the rule logic and possible configuration options, in the right lower corner press create rule
Review the rule defintion like tactics and severity.
Press Next: Set rule logic in the bottom of the page
in the rule logic screen, you have the ability to create or modify the rule KQL query, control of the entity mapping and define the scheduling and lookback time range.
After you reviewed the rule configuration options, close this page and navigate back to the main Microsoft Sentinel Overview screen
Microsoft Sentinel is a cloud-native SIEM and as such, it acts as single pane of glass for alerts and event correlation. For this purpose, and to be able to ingest and surafce alerts from Microsoft Security Products, we create a Microsoft incident creation rule. In this exercise, we will review this feature and create one example rule with a filtering option to help the analyst deal with alert fatigue.
In Microsoft Sentinel main page press on the Analytics section.
In the top bar press on +Create and select Microsoft incident creation rule
In the rule name enter "Azure Defender only medium and high Alerts"
In the Microsoft security service dropdown select Azure Defender
In the Filter by severity select custom and mark High and Medium
Press Next: Automated response
In the above "Automated response" page you can attach automation rule that can generate automation tasks that can assist your SOC with repetitive tasks, or Security remediation. More in this topic in the SOAR module.
Press Next: Review and create in the next page.
Fusion rule is a unique kind of detection rule. With Fusion rule, Microsoft Sentinel can automatically detect multistage attacks by identifying combinations of anomalous behaviors and suspicious activities That are observed at various stages of the kill-chain.
In this exercise we will learn how to distinguish and review Fusion rule in Microsoft Sentinel.
In the analytics page rule template tab, use the Rule Type filter and select Fusion
In the template screen notice the tag IN USE as this rule template enabled by default.
Press on the rule and review the data sources in the rule right pane.
As Fusion rules produce security incidents with high fidelity and simulation can be challenging, we are adding an example of an incident that was created from fusion detection.
In the below example we are seeing 2 low severity alerts from Azure Active Directory Identity Protection and Microsoft Cloud App Security that stich together into high severity incidence:
Your Security consult notify you about this thread
Base on the attack vector and the organization risk he recommend you to create detection rule for this malicious activity. In this exercise you will use Microsoft Sentinel analytics rule wizard to create new detection.
Review the article in the above link and understand what is the data source that will be part of the detection.
Check if this operation are capture as part of your collection strategy:
In the left menu press on the Logs and navigate to the search canvas
important note: in this lab we are using custom logs that replace the Out-off-the-box tables
Run the search query below to see the list of activities Microsoft Sentinel captured in the last 24hr
As you can see the New-InboxRule operation is indeed captured in your logs.
In the analytics rule page, in the top bar press on +Create and select scheduled query Rule
In this screen we will add general information regarding this rule.
In the Name type "Malicious Inbox Rule - custom".
In the rule Description add This rule is detecting on delete all traces of phishing email from user mailboxes.
In the Tactics select Persistence and Defense Evasion.
In the rule severity select medium.
Press Next: SET rule logic.
In the Rule logic page, review and copy the above query
we can view the rule creation estimatin by pressing Test with current data in the right side and see the number of hits.
Under the Alert enrichment (Preview), expand the entity mapping section that will allow us to map our fields to well-known categories:
In the Entity type open the supported list of entities and select Account in the identifier select FullName and map it to UserId__s
Press + Add new entity and this time select Host entity in the identifier select FullName and map it to OriginatingServer_s
Press + Add new entity, select IP entity, in the identifier select Address and map it to ClientIPAddress value.
Your mapping should look like the above:
To make your SOC more productive, save analyst time and effectively triage newly created incidents, your SOC analyst ask you to add the affected user from the search results as part of the alert title.
For applying this request, we will use the Alert details feature and create custom Alert Name Format
In the Alert Name Format copy the above dynamic title "Malicious Inbox Rule, affected user {{UserId__s}}"
In the Query scheduling set the run query every to 5 minutes and the Lookup data to last 12 Hours (This scheduling might not be ideal for production environment and should be tune). If you deployed the lab more than 12 hours ago, you will need to change the lookback period.
In the Suppression leave it on Off
Press the Next:Incident settings(Preview)
As your SOC is under stress, we want to reduce the number of alerts and be sure that when analyst handle a specific incident, he/she will see all related events or other incidents related to the same attack story. For that we will implement Alert grouping feature. To do so, follow the steps below:
In the Incident settings (Preview) under Alert grouping change it to Enabled.
Modify the Limit the group to alerts created within the selected time frame to 12 hours.
Select the Grouping alerts into a single incident if the selected entity types and details matches and select the Account.
Press the Next: Automated response and also press Next:Review and create this newly analytics rule.
After we created the custom analytics rule that detect us for malicious inbox rule rules. Let's review the incident that was created from this analytics rule.
On the main Microsoft Sentinel main page, select incidents and review the incident page
Locate a new incident with title "Malicious Inbox Rule, affected user AdeleV@contoso.OnMicrosoft.com" notice that the name adapt and the effected user name added to the incident name.
In the right pane we can review the incident preview, this view will gave us high level overview on the incident and the entity that related to it.
Press on the "view full details"
In the incident full details page you are able to see alert timeline (effective when you have more than one alert in a given incident)
Check the top level tabs and press on the entity tab, this section will expose all the mapped entities that related to this incident.
press on the entity "AdeleV@contoso.OnMicrosoft.com" this action will navigate us to the user entity page, this page will give us holistic view on the user entity, with all its activity and related alerts.
You can now continue to Module 4 - Incident Management
