Aug 18 2020 04:55 PM
Aug 18 2020 04:55 PM
Hi, I'm new to Sentinel with my only real experience being the MS Sentinel Ninja training.
I have a list of events from an existing SIEM that I need to replicate in Sentinel using data coming from on-premise MS AD servers.
When I went to write my first rule I found most of template queries seem to be Azure AD based queries.
Could someone please point me to (or show me) examples of writing queries for on-premise data feeds to meet the following sample of requirements:
Send a weekly email containing all occurrences of Windows event 1102 in last 1 week
Type: Event: Windows audit log cleared (event 1102)
REQ-010 Send an hourly email containing all occurrences of changes to “Domain Admins” and “G_Client Support Staff” AD groups
Type: AD group change: Domain Admins
REQ-017 Upon occurrence of proxy log URLS matching AusCert IoC list, an email must be sent
Type: IoC Matching: URL (from Proxy logs) matches AusCert IoC list
Thanks in anticipation
Aug 23 2020 07:51 AM
Aug 23 2020 04:29 PM
Hi there and thanks for the reply.
Yes I have looked through the templates and I made some reasonable progress over the weekend, but also hit a lot of challenges on the way!
Not the least of which is that the preview release won't allow alert schedules of more than one day so I'm still trying to figure out how to do the once a week and once a month reports.
Other challenges include the need to set up Logic Apps and create a playbook just to send a response email and in doing that, having to resolve automation issues composing and sending the email.
I've yet to work through the integration of threat feeds so I can use the TI_rules to do the IoC matching requirements although I have found the page describing that process.
Aug 24 2020 05:18 AMSolution
Aug 25 2020 02:42 AM
Thank you for your input.
As I get more of an understanding of how the ecosystem fits together I am understanding more of what tables I need to query and what entities within those tables are/are-not populated from their sources.
We were asked to replicate what one SIEM (splunk) was being used for, in another SIEM (Sentinel) but now understanding that Logic Apps is actually the preferred (and in some case perhaps the only practical) way to achieve the email reporting function we were required to provide from Log Analytics, helped me clarify the definition of Sentinel as a SIEM (+SOAR) vs just being a glorified report generator which it is not really designed for!
It all starts to make more sense now :)
My new challenge is getting the LA Playbook query output parsed up and presented in a neat email format, but I seem to be winning with that too now :)
Aug 25 2020 02:45 AM