|
| 1 | +--- |
| 2 | +title: Common threat detection scenarios | Microsoft Docs |
| 3 | +description: Learn some common threats you might want to search for and which components you need, and learn how to set up these detections. |
| 4 | +services: sentinel |
| 5 | +documentationcenter: na |
| 6 | +author: yelevin |
| 7 | +manager: rkarlin |
| 8 | +editor: '' |
| 9 | + |
| 10 | +ms.assetid: d51d2e09-a073-41c8-b396-91d60b057e6a |
| 11 | +ms.service: azure-sentinel |
| 12 | +ms.subservice: azure-sentinel |
| 13 | +ms.devlang: na |
| 14 | +ms.topic: conceptual |
| 15 | +ms.tgt_pltfrm: na |
| 16 | +ms.workload: na |
| 17 | +ms.date: 06/06/2021 |
| 18 | +ms.author: yelevin |
| 19 | +--- |
| 20 | + |
| 21 | +# Common threat detection scenarios |
| 22 | + |
| 23 | +## Configure the Security events / Windows Security Events connector for anomalous RDP login detection |
| 24 | + |
| 25 | +> [!IMPORTANT] |
| 26 | +> Anomalous RDP login detection is currently in public preview. |
| 27 | +> This feature is provided without a service level agreement, and it's not recommended for production workloads. |
| 28 | +> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). |
| 29 | +
|
| 30 | +Azure Sentinel can apply machine learning (ML) to Security events data to identify anomalous Remote Desktop Protocol (RDP) login activity. Scenarios include: |
| 31 | + |
| 32 | +- **Unusual IP** - the IP address has rarely or never been observed in the last 30 days |
| 33 | + |
| 34 | +- **Unusual geo-location** - the IP address, city, country, and ASN have rarely or never been observed in the last 30 days |
| 35 | + |
| 36 | +- **New user** - a new user logs in from an IP address and geo-location, both or either of which were not expected to be seen based on data from the 30 days prior. |
| 37 | + |
| 38 | +**Configuration instructions** |
| 39 | + |
| 40 | +1. You must be collecting RDP login data (Event ID 4624) through the **Security events** or **Windows Security Events** data connectors. Make sure you have selected an [event set](#event-id-reference) besides "None", or created a data collection rule that includes this event ID, to stream into Azure Sentinel. |
| 41 | + |
| 42 | +1. From the Azure Sentinel portal, select **Analytics**, and then select the **Rule templates** tab. Choose the **(Preview) Anomalous RDP Login Detection** rule, and move the **Status** slider to **Enabled**. |
| 43 | + |
| 44 | + > [!NOTE] |
| 45 | + > As the machine learning algorithm requires 30 days' worth of data to build a baseline profile of user behavior, you must allow 30 days of Windows Security events data to be collected before any incidents can be detected. |
| 46 | +
|
| 47 | +## Configure the Syslog connector for anomalous SSH login detection |
| 48 | + |
| 49 | +> [!IMPORTANT] |
| 50 | +> Anomalous SSH login detection is currently in public preview. |
| 51 | +> This feature is provided without a service level agreement, and it's not recommended for production workloads. |
| 52 | +> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). |
| 53 | +
|
| 54 | +Azure Sentinel can apply machine learning (ML) to the syslog data to identify anomalous Secure Shell (SSH) login activity. Scenarios include: |
| 55 | + |
| 56 | +- Impossible travel – when two successful login events occur from two locations that are impossible to reach within the timeframe of the two login events. |
| 57 | +- Unexpected location – the location from where a successful login event occurred is suspicious. For example, the location has not been seen recently. |
| 58 | + |
| 59 | +This detection requires a specific configuration of the Syslog data connector: |
| 60 | + |
| 61 | +1. For step 2 under [Configure the Log Analytics agent](#configure-the-log-analytics-agent) above, make sure that both **auth** and **authpriv** are selected as facilities to monitor, and that all the severities are selected. |
| 62 | + |
| 63 | +2. Allow sufficient time for syslog information to be collected. Then, navigate to **Azure Sentinel - Logs**, and copy and paste the following query: |
| 64 | + |
| 65 | + ```kusto |
| 66 | + Syslog |
| 67 | + | where Facility in ("authpriv","auth") |
| 68 | + | extend c = extract( "Accepted\\s(publickey|password|keyboard-interactive/pam)\\sfor ([^\\s]+)",1,SyslogMessage) |
| 69 | + | where isnotempty(c) |
| 70 | + | count |
| 71 | + ``` |
| 72 | + |
| 73 | + Change the **Time range** if required, and select **Run**. |
| 74 | + |
| 75 | + If the resulting count is zero, confirm the configuration of the connector and that the monitored computers do have successful login activity for the time period you specified for your query. |
| 76 | + |
| 77 | + If the resulting count is greater than zero, your syslog data is suitable for anomalous SSH login detection. You enable this detection from **Analytics** > **Rule templates** > **(Preview) Anomalous SSH Login Detection**. |
| 78 | +
|
| 79 | +
|
| 80 | +## Next steps |
| 81 | +In this document, you learned how to connect Windows security events to Azure Sentinel. To learn more about Azure Sentinel, see the following articles: |
| 82 | +- Learn how to [get visibility into your data and potential threats](get-visibility.md). |
| 83 | +- Get started detecting threats with Azure Sentinel, using [built-in](detect-threats-built-in.md) or [custom](detect-threats-custom.md) rules. |
0 commit comments