Help Protect your Exchange Environment With Microsoft Sentinel
TL;DR; Sentinel + Exchange Servers or Exchange Online = better protected New Microsoft Sentinel security solution for Exchange Online and on premises servers : Microsoft Exchange Security! This content is very useful for any organization concerned about keeping the highest security posture as possible and be alerted in case of suspicious activities for those critical items.
Cowrie honeypot and its Integration with Microsoft Sentinel.
Honeypot: Honeypot is a security mechanism designed to attract, detect, and analyze malicious activities and attackers by simulating a vulnerable system or network service. The primary purpose of a honeypot is to provide a controlled environment where security professionals can observe and study attack methods, tools, and behaviors without putting actual production systems at risk. Integrating Honeypot (Cowrie) with Microsoft Sentinel brings several benefits for enhancing cybersecurity operations. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) service that provides intelligent security analytics and threat intelligence across the enterprise. By combining Cowrie’s detailed honeypot data with Sentinel’s advanced analytics and automation capabilities, organizations can achieve a more comprehensive and effective security posture. Analytical Rules, Threat Hunting, Automation, Workbooks, Custom Parsers.Introducing the Use Cases Mapper workbook
1. Intro While looking for the most effective use cases for Sentinel, it usually makes sense to start with data sources that already exist in some way in the corporate environment, whether due to a previous / third-party SIEM integration or due to an already implemented security stack / solution. The next logical step in this process is to determine preexisting sentinel solutions for the products already in use. Unfortunately, this often occurs only inadequately or is not carried out completely due to lack of resources. In addition, the solutions available (so called Content-Hub-Solutions) continue to evolve and once implemented, necessary updates may be neglected. This is where the Use Case Mapper Workbook can help. The workbook and the complementary resources (watchlists) can be used to map common Use Cases to the Mitre ATT&CK framework, i.e. the tactics and techniques listed there. This gives you a quick overview of the analysis options available in Sentinel (e.g. Analytic Rules & Hunting Queries) according to these Use Cases. The identified Use Cases in this context are: Credential Exploitation Lateral Movement Rapid Encryption Command and Control Communication Insider Risk Anomalous Privilege Escalation Third-Party Abuses Overexposure Data Exfiltration Mobile Data Security Communication Abuse Web Application Abuse NOTE: These can change over time, as attack & defense strategies and techniques are constantly changing as well. To be able to adapt this information to your own needs, the option of reducing the results to selected Data Sources (Content Hub Solutions) has been implemented as well. 2. Prerequisites Before getting started, you have to check the prerequisites that should be fulfilled. an Azure subscription with a Sentinel equipped Log Analytic Workspace The correct RBAC roles assigned - for the sake of simplicity, it should be 'Contributor' or 'Owner' 3. How to deploy/get started Go to the following website: Azure-Sentinel/Workbooks/use cases mapper workbook at master · Azure/Azure-Sentinel · GitHub Look for the 'Deploy to Azure' button Log into a suitable tenant Enter the required information (subscription, resource group, region, workspace name) (1) and click 'Review + create' (2) Check your entered information again and confirm it by clicking on 'Create' The new workbook (Use Case Mapper) should now appear in Sentinel in 'Workbooks' section. 4. How to use & structure In the first section of the workbook, you have the option to select one of the predefined Use Cases. The next step (2nd step) is to select the right data source/solution. The selection made before is presented in section 3 below. Based on the selections made, the following information is presented. Analytical rules - ID | Name | Solution | Technique + graphical representation Hunting Queries - ID | Name | Solution | Technique + graphical representation Workbooks - Name | Solution 5. Conclusion The Use Case Mapper Workbook is an invaluable tool for identifying gaps in your Sentinel environment and the established Content-Hub-Solutions. It simplifies the process of supplementing your solutions to achieve a complete implementation. Additionally, it helps you stay informed about updates (such as new hunting queries, analytic rules, or workbooks) and makes it possible to integrate them promptly. The workbook also provides a clear picture of the threats and vulnerabilities that should be mitigated with your solutions and where they can be found within the Mitre Att&ck Framework.Correlating Microsoft Defender for Cloud alerts in Sentinel
Incident load is one of the major pain points of modern SOC. One of the methods used to manage alert fatigue is using grouping. In this blog post we will demonstrate a concept for correlating Microsoft Defender for Cloud alerts using Microsoft Sentinel analytics rules. This can be applied to many scenarios made possible using the new ‘Sentinel entities’ entity mapping.Detect Network beaconing via Intra-Request time delta patterns in Azure Sentinel
This article will discuss the use case of detecting network beaconing via intra-request time delta patterns using KQL (Kusto query language) in Azure Sentinel. The logic or technique of the use-case was originally discussed at threat hunting project here and also blogged with the open source network analytics tool (flare) implementation by huntoperator here. Implementing this technique natively using KQL allows defenders to quickly apply it over multiple network data sources and easily set up alerts within Azure Sentinel.Microsoft Sentinel Solution for SAP® Applications - New data exfiltration detection rules
On August 2022, Microsoft Sentinel solution for SAP was made generally available (GA). Together with releasing the Microsoft Sentinel Solution for SAP® Applications, new additional OOTB content has been added. This blog covers five new data exfiltration detection rules included with the Microsoft Sentinel Solution for SAP® Applications (these rules are currently in preview).Dynamic alert details - The force awakens
When authoring a new detection, one must keep in mind that the MTTR is highly impacted by the data available in the incident and alerts. Dynamic alert details allow customization of the alert properties resulting in a shorter investigation process. In this blog post we will cover the newly released capability in Microsoft Sentinel scheduled analytics rules to dynamically set the alert properties.
Azure Active Directory Identity Protection user account enrichments removed: how to mitigate impact
AADIP connector no longer contains user account enrichment fields. In this post we'll offer mitigation steps you can take, to allow you to self enrich your AADIP data in your Microsoft Sentinel workspace using UEBA's IdentityInfo table.
