Skip to content

Commit ff7f85c

Browse files
v-amolpatilv-amolpatil
committed
Merge branch 'master' into v-tsawant/ASIM-vimAuthenticationSshd
2 parents 9616c0d + b7dbef3 commit ff7f85c

11 files changed

+661
-89
lines changed

‎Solutions/UEBA Essentials/Data/Solution_UEBA.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,15 @@
2828
"Hunting Queries/UEBA Multi-Source Anomalous Activity Overview.yaml",
2929
"Hunting Queries/Anomalous First-Time Device Logon.yaml",
3030
"Hunting Queries/Anomalous Okta First-Time or Uncommon Actions.yaml",
31-
"Hunting Queries/Anomalous GCP IAM Activity.yaml"
31+
"Hunting Queries/Anomalous GCP IAM Activity.yaml",
32+
"Hunting Queries/Anomalous High-Score Activity Triage.yaml",
33+
"Hunting Queries/Anomaly Template Distribution by Tactics and Techniques.yaml",
34+
"Hunting Queries/User-Centric Anomaly Investigation.yaml",
35+
"Hunting Queries/Anomaly Detection Trend Analysis.yaml",
36+
"Hunting Queries/Top Anomalous Source IP Triage.yaml"
3237
],
3338
"Metadata": "SolutionMetadata.json",
3439
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\UEBA Essentials",
35-
"Version": "3.0.2",
40+
"Version": "3.0.3",
3641
"TemplateSpec": true
3742
}

‎Solutions/UEBA Essentials/Hunting Queries/Anomalous AAD Account Manipulation.yaml‎

Lines changed: 0 additions & 58 deletions
This file was deleted.

‎Solutions/UEBA Essentials/Hunting Queries/Anomalous High-Score Activity Triage.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: a7b8c9d0-e1f2-3456-7890-abcdef123456
2+
name: Anomalous High-Score Activity Triage
3+
description: |
4+
'Identify the highest-scoring anomalies for rapid triage using Anomalies Table.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(7d)
14+
| sort by Score desc
15+
| project TimeGenerated, AnomalyTemplateName, Score, Description, UserName, SourceIpAddress, Tactics, Techniques
16+
entityMappings:
17+
- entityType: Account
18+
fieldMappings:
19+
- identifier: Name
20+
columnName: UserName
21+
- entityType: IP
22+
fieldMappings:
23+
- identifier: Address
24+
columnName: SourceIpAddress
25+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/Anomaly Detection Trend Analysis.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: d0e1f2a3-b4c5-6789-0123-def456789012
2+
name: Anomaly Detection Trend Analysis
3+
description: |
4+
'Visualizes anomaly detection trends over the past 90 days, showing daily counts of triggered anomaly templates. Use this time-series chart to identify patterns, spikes in anomalous behavior, and seasonal trends for baseline establishment and threat hunting prioritization.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(90d)
14+
| summarize Count = count() by bin(TimeGenerated, 1d), AnomalyTemplateName
15+
| render timechart
16+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/Anomaly Template Distribution by Tactics and Techniques.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: b8c9d0e1-f2a3-4567-8901-bcdef2345678
2+
name: Anomaly Template Distribution by Tactics and Techniques
3+
description: |
4+
'Provides a statistical overview of anomaly detections over the past 30 days, grouped by template name, MITRE ATT&CK tactics, and techniques. Use this query to identify the most frequently triggered anomaly patterns and their associated threat techniques for trend analysis and detection tuning.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(30d)
14+
| summarize Count = count() by AnomalyTemplateName, Tactics, Techniques
15+
| sort by Count desc
16+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/Top Anomalous Source IP Triage.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
id: e1f2a3b4-c5d6-7890-1234-abcdef567890
2+
name: Top Anomalous Source IP Triage
3+
description: |
4+
'Identifies the top source IP addresses with multiple distinct anomaly templates over the past 30 days (excluding single noisy hits), then surfaces their most recent (last 24h) high-fidelity anomalous activities for focused investigation, including scores, tactics, techniques, and behavioral insights.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
let TopIPs =
13+
Anomalies
14+
| where TimeGenerated > ago(30d)
15+
| where isnotempty(SourceIpAddress)
16+
| summarize TotalAnomalies = count(), DistinctTemplates = dcount(AnomalyTemplateName) by SourceIpAddress
17+
| where TotalAnomalies > 1 and DistinctTemplates > 1
18+
| top 5 by TotalAnomalies desc
19+
| project SourceIpAddress;
20+
Anomalies
21+
| where TimeGenerated > ago(24h)
22+
| where SourceIpAddress in (TopIPs)
23+
| project TimeGenerated, SourceIpAddress, AnomalyTemplateName, Score, Description,
24+
UserPrincipalName, UserName, StartTime, EndTime,
25+
Tactics, Techniques, ActivityInsights, DeviceInsights, UserInsights, AnomalyReasons
26+
| order by SourceIpAddress asc, Score desc, TimeGenerated desc
27+
entityMappings:
28+
- entityType: IP
29+
fieldMappings:
30+
- identifier: Address
31+
columnName: SourceIpAddress
32+
- entityType: Account
33+
fieldMappings:
34+
- identifier: Name
35+
columnName: UserName
36+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/User-Centric Anomaly Investigation.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: c9d0e1f2-a3b4-5678-9012-cdef34567890
2+
name: User-Centric Anomaly Investigation
3+
description: |
4+
'Investigates all anomalous activities associated with a specific user account over the past 30 days, including anomaly scores, behavioral insights, source locations, and MITRE ATT&CK mappings. Customize by replacing "[email protected]" with the target user principal name for focused threat hunting and incident response.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(30d)
14+
| where UserPrincipalName == "[email protected]"
15+
| project TimeGenerated, UserName, AnomalyTemplateName, Score, Description, ActivityInsights, UserInsights, SourceIpAddress, SourceLocation, Tactics, Techniques
16+
entityMappings:
17+
- entityType: Account
18+
fieldMappings:
19+
- identifier: Name
20+
columnName: UserName
21+
- entityType: IP
22+
fieldMappings:
23+
- identifier: Address
24+
columnName: SourceIpAddress
25+
version: 1.0.0

‎Solutions/UEBA Essentials/Package/3.0.3.zip‎

21.1 KB
Binary file not shown.

‎Solutions/UEBA Essentials/Package/createUiDefinition.json‎

Lines changed: 71 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/UEBA%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel UEBA content package will provide you with various queries based on UEBA tables, that allows you to hunt for tailored threat scenarios. You'll be able to investigate and search for anomalous activities over UEBA's enriched data, and get inspired to customize queries according to your own use-cases.\n\n**Important :** Some of the queries that are part of this solution, make use of [Built-in Watchlist Templates](https://docs.microsoft.com/azure/sentinel/watchlist-schemas) and will not work unless the corresponding watchlist is created. Other queries may requires changes to match your environment details.\n\n**Hunting Queries:** 25\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/UEBA%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel UEBA content package will provide you with various queries based on UEBA tables, that allows you to hunt for tailored threat scenarios. You'll be able to investigate and search for anomalous activities over UEBA's enriched data, and get inspired to customize queries according to your own use-cases.\n\n**Important :** Some of the queries that are part of this solution, make use of [Built-in Watchlist Templates](https://docs.microsoft.com/azure/sentinel/watchlist-schemas) and will not work unless the corresponding watchlist is created. Other queries may requires changes to match your environment details.\n\n**Hunting Queries:** 30\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -422,6 +422,76 @@
422422
}
423423
}
424424
]
425+
},
426+
{
427+
"name": "huntingquery26",
428+
"type": "Microsoft.Common.Section",
429+
"label": "Anomalous High-Score Activity Triage",
430+
"elements": [
431+
{
432+
"name": "huntingquery26-text",
433+
"type": "Microsoft.Common.TextBlock",
434+
"options": {
435+
"text": "Identify the highest-scoring anomalies for rapid triage using Anomalies Table. This hunting query depends on BehaviorAnalytics data connector (Anomalies Parser or Table)"
436+
}
437+
}
438+
]
439+
},
440+
{
441+
"name": "huntingquery27",
442+
"type": "Microsoft.Common.Section",
443+
"label": "Anomaly Template Distribution by Tactics and Techniques",
444+
"elements": [
445+
{
446+
"name": "huntingquery27-text",
447+
"type": "Microsoft.Common.TextBlock",
448+
"options": {
449+
"text": "Provides a statistical overview of anomaly detections over the past 30 days, grouped by template name, MITRE ATT&CK tactics, and techniques. Use this query to identify the most frequently triggered anomaly patterns and their associated threat techniques for trend analysis and detection tuning. This hunting query depends on BehaviorAnalytics data connector (Anomalies Parser or Table)"
450+
}
451+
}
452+
]
453+
},
454+
{
455+
"name": "huntingquery28",
456+
"type": "Microsoft.Common.Section",
457+
"label": "User-Centric Anomaly Investigation",
458+
"elements": [
459+
{
460+
"name": "huntingquery28-text",
461+
"type": "Microsoft.Common.TextBlock",
462+
"options": {
463+
"text": "Investigates all anomalous activities associated with a specific user account over the past 30 days, including anomaly scores, behavioral insights, source locations, and MITRE ATT&CK mappings. Customize by replacing \"[email protected]\" with the target user principal name for focused threat hunting and incident response. This hunting query depends on BehaviorAnalytics data connector (Anomalies Parser or Table)"
464+
}
465+
}
466+
]
467+
},
468+
{
469+
"name": "huntingquery29",
470+
"type": "Microsoft.Common.Section",
471+
"label": "Anomaly Detection Trend Analysis",
472+
"elements": [
473+
{
474+
"name": "huntingquery29-text",
475+
"type": "Microsoft.Common.TextBlock",
476+
"options": {
477+
"text": "Visualizes anomaly detection trends over the past 90 days, showing daily counts of triggered anomaly templates. Use this time-series chart to identify patterns, spikes in anomalous behavior, and seasonal trends for baseline establishment and threat hunting prioritization. This hunting query depends on BehaviorAnalytics data connector (Anomalies Parser or Table)"
478+
}
479+
}
480+
]
481+
},
482+
{
483+
"name": "huntingquery30",
484+
"type": "Microsoft.Common.Section",
485+
"label": "Top Anomalous Source IP Triage",
486+
"elements": [
487+
{
488+
"name": "huntingquery30-text",
489+
"type": "Microsoft.Common.TextBlock",
490+
"options": {
491+
"text": "Identifies the top source IP addresses with multiple distinct anomaly templates over the past 30 days (excluding single noisy hits), then surfaces their most recent (last 24h) high-fidelity anomalous activities for focused investigation, including scores, tactics, techniques, and behavioral insights. This hunting query depends on BehaviorAnalytics data connector (Anomalies Parser or Table)"
492+
}
493+
}
494+
]
425495
}
426496
]
427497
}

0 commit comments

Comments
 (0)