Scribd Logo
Upload

Welcome to Scribd!

  • 103 views

    Hunt For Threats Using The Microsoft Sentinel Portal Slides

    Uploaded by

    Jesse Oliveira
    This document discusses advanced hunting capabilities in the Microsoft Sentinel portal. It covers: - Performing advanced hunting using Jupyter notebooks, which allow running analytics, visualizations, and integrating external data. - Creating custom hunting queries to modify manually-run queries or convert them to analytical rules for automated monitoring. - Using hunting bookmarks to track query results and reference findings for collaboration. - Monitoring hunting queries in real time using Livestream sessions. The last section previews a demonstration of these features, including notebooks, custom queries, bookmarks, and Livestream. It also requires specific role-based access and an Azure Machine Learning workspace to use notebooks for advanced hunting in Sentinel.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Hunt For Threats Using The Microsoft Sentinel Portal Slides

    Uploaded by

    Jesse Oliveira
    103 views32 pages
    This document discusses advanced hunting capabilities in the Microsoft Sentinel portal. It covers: - Performing advanced hunting using Jupyter notebooks, which allow running analytics, visualizations, and integrating external data. - Creating custom hunting queries to modify manually-run queries or convert them to analytical rules for automated monitoring. - Using hunting bookmarks to track query results and reference findings for collaboration. - Monitoring hunting queries in real time using Livestream sessions. The last section previews a demonstration of these features, including notebooks, custom queries, bookmarks, and Livestream. It also requires specific role-based access and an Azure Machine Learning workspace to use notebooks for advanced hunting in Sentinel.

    Original Title

    Hunt for Threats Using the Microsoft Sentinel Portal Slides

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses advanced hunting capabilities in the Microsoft Sentinel portal. It covers: - Performing advanced hunting using Jupyter notebooks, which allow running analytics, visualizations, and integrating external data. - Creating custom hunting queries to modify manually-run queries or convert them to analytical rules for automated monitoring. - Using hunting bookmarks to track query results and reference findings for collaboration. - Monitoring hunting queries in real time using Livestream sessions. The last section previews a demonstration of these features, including notebooks, custom queries, bookmarks, and Livestream. It also requires specific role-based access and an Azure Machine Learning workspace to use notebooks for advanced hunting in Sentinel.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    103 views32 pages

    Hunt For Threats Using The Microsoft Sentinel Portal Slides

    Uploaded by

    Jesse Oliveira
    This document discusses advanced hunting capabilities in the Microsoft Sentinel portal. It covers: - Performing advanced hunting using Jupyter notebooks, which allow running analytics, visualizations, and integrating external data. - Creating custom hunting queries to modify manually-run queries or convert them to analytical rules for automated monitoring. - Using hunting bookmarks to track query results and reference findings for collaboration. - Monitoring hunting queries in real time using Livestream sessions. The last section previews a demonstration of these features, including notebooks, custom queries, bookmarks, and Livestream. It also requires specific role-based access and an Azure Machine Learning workspace to use notebooks for advanced hunting in Sentinel.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 32

    Hunt for Threats Using the Microsoft

    Sentinel Portal

    Michael J. Teske
    Principal Author Evangelist-Pluralsight
    Hunt for Threats Using the Microsoft Sentinel
    Portal

    Perform advanced hunting with notebooks


    Create custom hunting queries
    - Run hunting queries manually
    - Convert a hunting query to an analytical rule

    Use hunting bookmarks for data investigations


    - Track query results with bookmarks
    Monitor hunting queries by using Livestream
    Perform Advanced Hunting with Notebooks
    Perform Advanced Hunting with Notebooks

    Data store is accessed by a common API


    - Azure Portal
    - Azure Sentinel tools
    - Jupyter notebooks
    - Python
    Use notebooks for:
    - Perform analytics
    - Create data visualizations
    - Integrate external data sources
    Requirements

    Machine Learning Workspace


    - Storage account
    - Key vault
    - Application insights
    - Networking
    • Public or private endpoint
    - Advanced
    • System or user assigned identity
    • Credential or Identity-based storage
    account access
    • Microsoft or customer managed keys
    Permissions Required for Notebooks

    Microsoft Sentinel Permissions Azure Machine Learning Permissions


    Microsoft Sentinel Reader Default roles
    Microsoft Sentinel Responder Azure ML Data Scientist
    Microsoft Sentinel Contributor Reader
    Contributor
    Owner
    Jupyter Notebooks
    Create Custom Hunting Queries
    Custom Queries
    Custom Queries
    Custom Hunting Queries

    Queries, but for threat hunting, but still KQL


    queries
    Modify query in details pane and run
    Save modified query as a new query
    Custom Hunting Queries
    Custom Hunting Queries
    Convert a Hunting Query to an Analytical Rule

    Hunting queries expose data you might want


    to monitor

    Data returned is consistent and constant


    Important enough to add to your normal
    alerting system
    Allows you to convert from manual monitoring
    to automated analysis
    Convert a Hunting Query to an Analytical Rule
    Use Hunting Bookmarks for
    Data Investigations
    Hunting Bookmarks

    Used to preserve queries ran in Microsoft


    Sentinel
    - Includes query results
    - Record observations
    - Reference findings via notes

    Visible to you and your team for collaboration


    Allows you to address urgent findings
    Hunting Bookmarks
    Hunting Bookmarks
    # PowerShell Azure Sentinel Bookmark commands

    Get-AzSentinelBookmark

    New-AzSentinelBoomark

    Remove-AzSentinelBoomark

    Update-AzSentinelBoomark

    Hunting Bookmarks Using PowerShell


    # Create a bookmark named MyBookmark

    New-AzSentinelBookmark -ResourceGroupName “ps-course-rg" -WorkspaceName "MyWorkspace“ `

    -DisplayName "MyBookmark" -Query "SecurityAlert | take 1“

    Hunting Bookmarks Using PowerShell


    Hunting Bookmarks
    Hunting Bookmarks
    Monitor Hunting Queries by Using Livestream
    Monitor Hunting Queries by Using Livestream

    Livestream allows users quickly create


    sessions using any Analytics query
    - Real time monitoring
    Monitor Hunting Queries by Using Livestream
    Monitor Hunting Queries by Using Livestream
    Monitor Hunting Queries by Using Livestream
    Demo Review Jupyter Notebooks
    Manage custom queries
    - Convert query to analytics rule
    - Hunting bookmarks
    - Create Livestream session
    Perform advanced hunting with notebooks
    - Running cell blocks
    - Requires an Azure Machine Learning
    workspace
    Summary
    - Must have:
    • Sentinel reader, responder and
    contributor roles
    • Default Azure ML roles

    Create custom hunting queries


    - Run hunting queries manually
    - Convert a hunting query to an
    analytical rule
    • Add to your normal security monitoring
    Use hunting bookmarks for data
    investigations
    Summary
    - Track query results with bookmarks
    • Provides ability to return to the
    investigation
    Monitor hunting queries by using
    Livestream
    - Monitoring hunting queries as they occur
    in real time
    Up Next:
    Configure SOAR in Microsoft Sentinel

    You might also like