Skip to content

Commit 216b6c5

Browse files
authored
Merge pull request #175219 from MicrosoftDocs/master
Merge master to live, Sunday 4 PM
2 parents 19ed158 + d7c8d7c commit 216b6c5

File tree

11 files changed

+192
-2
lines changed

11 files changed

+192
-2
lines changed

articles/security-center/release-notes.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ Use the security recommendation "[A vulnerability assessment solution should be
4242

4343
To automatically surface the vulnerabilities, on existing and new machines, without the need to manually remediate the recommendation, see [Vulnerability assessment solutions can now be auto enabled (in preview)](#vulnerability-assessment-solutions-can-now-be-auto-enabled-in-preview).
4444

45+
Learn more in [Investigate weaknesses with Microsoft Defender for Endpoint's threat and vulnerability management](deploy-vulnerability-assessment-tvm.md).
4546

4647
### Vulnerability assessment solutions can now be auto enabled (in preview)
4748

@@ -64,6 +65,8 @@ The [asset inventory](asset-inventory.md) page now includes a filter to select m
6465

6566
Additionally, you can query the software inventory data in **Azure Resource Graph Explorer**.
6667

68+
To use these new features, you'll need to enable the [integration with Microsoft Defender for Endpoint](security-center-wdatp.md).
69+
6770
For full details, including sample Kusto queries for Azure Resource Graph, see [Access a software inventory](asset-inventory.md#access-a-software-inventory).
6871

6972
:::image type="content" source="media/deploy-vulnerability-assessment-tvm/software-inventory.png" alt-text="If you've enabled the threat and vulnerability solution, Security Center's asset inventory offers a filter to select resources by their installed software.":::

articles/security-center/upcoming-changes.md

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: memildin
55
manager: rkarlin
66
ms.service: security-center
77
ms.topic: overview
8-
ms.date: 10/08/2021
8+
ms.date: 10/10/2021
99
ms.author: memildin
1010

1111
---
@@ -27,6 +27,7 @@ If you're looking for the latest release notes, you'll find them in the [What's
2727
| [Deprecating a preview alert: ARM.MCAS_ActivityFromAnonymousIPAddresses](#deprecating-a-preview-alert-armmcas_activityfromanonymousipaddresses) | October 2021|
2828
| [Legacy implementation of ISO 27001 is being replaced with new ISO 27001:2013](#legacy-implementation-of-iso-27001-is-being-replaced-with-new-iso-270012013)| October 2021|
2929
| [Changes to recommendations for managing endpoint protection solutions](#changes-to-recommendations-for-managing-endpoint-protection-solutions) | November 2021 |
30+
| [Multiple changes to identity recommendations](#multiple-changes-to-identity-recommendations) | November 2021 |
3031
| [Enhancements to recommendation to classify sensitive data in SQL databases](#enhancements-to-recommendation-to-classify-sensitive-data-in-sql-databases) | Q1 2022 |
3132
|||
3233

@@ -71,6 +72,56 @@ Learn more:
7172
- [Security Center's supported endpoint protection solutions](security-center-services.md#endpoint-supported)
7273
- [How these recommendations assess the status of your deployed solutions](security-center-endpoint-protection.md)
7374

75+
### Multiple changes to identity recommendations
76+
77+
**Estimated date for change:** November 2021
78+
79+
Security Center includes multiple recommendations for improving the management of users and accounts. In November, we'll be making the changes outlined below.
80+
81+
- **Improved freshness interval** - Currently, the identity recommendations have a freshness interval of 24 hours. This update will reduce that interval to 12 hours.
82+
83+
- **Account exemption capability** - Security Center has many features for customizing the experience and making sure your secure score reflects your organization's security priorities. The exempt option on security recommendations is one such feature. For a full overview and instructions, see [Exempting resources and recommendations from your secure score](exempt-resource.md). With this update, you'll be able to exempt specific accounts from evaluation by the eight recommendations listed in the following table.
84+
85+
Typically, you'd exempt emergency “break glass” accounts from MFA recommendations, because such accounts are often deliberately excluded from an organization's MFA requirements. Alternatively, you might have external accounts that you'd like to permit access to but which don't have MFA enabled.
86+
87+
> [!TIP]
88+
> When you exempt an account, it won't be shown as unhealthy and also won't cause a subscription to appear unhealthy.
89+
90+
|Recommendation| Assessment key|
91+
|-|-|
92+
|[MFA should be enabled on accounts with owner permissions on your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/94290b00-4d0c-d7b4-7cea-064a9554e681)|94290b00-4d0c-d7b4-7cea-064a9554e681|
93+
|[MFA should be enabled on accounts with read permissions on your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/151e82c5-5341-a74b-1eb0-bc38d2c84bb5)|151e82c5-5341-a74b-1eb0-bc38d2c84bb5|
94+
|[MFA should be enabled on accounts with write permissions on your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/57e98606-6b1e-6193-0e3d-fe621387c16b)|57e98606-6b1e-6193-0e3d-fe621387c16b|
95+
|[External accounts with owner permissions should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/c3b6ae71-f1f0-31b4-e6c1-d5951285d03d)|c3b6ae71-f1f0-31b4-e6c1-d5951285d03d|
96+
|[External accounts with read permissions should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/a8c6a4ad-d51e-88fe-2979-d3ee3c864f8b)|a8c6a4ad-d51e-88fe-2979-d3ee3c864f8b|
97+
|[External accounts with write permissions should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/04e7147b-0deb-9796-2e5c-0336343ceb3d)|04e7147b-0deb-9796-2e5c-0336343ceb3d|
98+
|[Deprecated accounts with owner permissions should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/e52064aa-6853-e252-a11e-dffc675689c2)|e52064aa-6853-e252-a11e-dffc675689c2|
99+
|[Deprecated accounts should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/00c6d40b-e990-6acf-d4f3-471e747a27c4)|00c6d40b-e990-6acf-d4f3-471e747a27c4|
100+
|||
101+
102+
- **Recommendations rename** - From this update, we're renaming two recommendations. We're also revising their descriptions. The assessment keys will remain unchanged.
103+
104+
105+
|Property |Current value | From the update|
106+
|---------|---------|---------|
107+
|Assessment key | e52064aa-6853-e252-a11e-dffc675689c2 | Unchanged|
108+
|Name |[Deprecated accounts with owner permissions should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/e52064aa-6853-e252-a11e-dffc675689c2) |Subscriptions should be purged of accounts that are blocked in Active Directory and have owner permissions |
109+
|Description |User accounts that have been blocked from signing in, should be removed from your subscriptions.<br>These accounts can be targets for attackers looking to find ways to access your data without being noticed.|User accounts that have been blocked from signing into Active Directory, should be removed from your subscriptions. These accounts can be targets for attackers looking to find ways to access your data without being noticed.<br>Learn more about securing the identity perimeter in [Azure Identity Management and access control security best practices](/azure/security/fundamentals/identity-management-best-practices.md).|
110+
|Related policy |[Deprecated accounts with owner permissions should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2febb62a0c-3560-49e1-89ed-27e074e9f8ad) |Subscriptions should be purged of accounts that are blocked in Active Directory and have owner permissions |
111+
|||
112+
113+
|Property |Current value | From the update|
114+
|---------|---------|---------|
115+
|Assessment key | 00c6d40b-e990-6acf-d4f3-471e747a27c4 | Unchanged|
116+
|Name |[Deprecated accounts should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/00c6d40b-e990-6acf-d4f3-471e747a27c4)|Subscriptions should be purged of accounts that are blocked in Active Directory and have read and write permissions|
117+
|Description |User accounts that have been blocked from signing in, should be removed from your subscriptions.<br>These accounts can be targets for attackers looking to find ways to access your data without being noticed.|User accounts that have been blocked from signing into Active Directory, should be removed from your subscriptions. These accounts can be targets for attackers looking to find ways to access your data without being noticed.<br>Learn more about securing the identity perimeter in [Azure Identity Management and access control security best practices](/azure/security/fundamentals/identity-management-best-practices.md).|
118+
|Related policy |[Deprecated accounts should be removed from your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f6b1cbf55-e8b6-442f-ba4c-7246b6381474)|Subscriptions should be purged of accounts that are blocked in Active Directory and have read and write permissions|
119+
|||
120+
121+
122+
123+
124+
74125
### Enhancements to recommendation to classify sensitive data in SQL databases
75126

76127
**Estimated date for change:** Q1 2022

articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,8 @@
188188
href: import-export-analytics-rules.md
189189
- name: Work with SOC-ML anomaly rules
190190
href: work-with-anomaly-rules.md
191+
- name: Manage template versions for analytics rules
192+
href: manage-analytics-rule-templates.md
191193
- name: Enable User and Entity Behavior Analytics (UEBA)
192194
href: enable-entity-behavior-analytics.md
193195
- name: Work with SOC-ML anomaly rules
Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
title: Manage template versions for your scheduled analytics rules in Azure Sentinel
3+
description: Learn how to manage the relationship between your scheduled analytics rule templates and the rules created from those templates. Merge updates to the templates into your rules, and revert changes in your rules back to the original template.
4+
services: sentinel
5+
documentationcenter: na
6+
author: yelevin
7+
manager: rkarlin
8+
editor: ''
9+
10+
ms.service: azure-sentinel
11+
ms.subservice: azure-sentinel
12+
ms.devlang: na
13+
ms.topic: how-to
14+
ms.tgt_pltfrm: na
15+
ms.workload: na
16+
ms.date: 10/03/2021
17+
ms.author: yelevin
18+
19+
---
20+
# Manage template versions for your scheduled analytics rules in Azure Sentinel
21+
22+
> [!IMPORTANT]
23+
>
24+
> This feature is in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
25+
26+
## Introduction
27+
28+
Azure Sentinel comes with [analytics rule templates](detect-threats-built-in.md) that you turn into active rules by effectively creating a copy of them – that’s what happens when you create a rule from a template. At that point, however, the active rule is no longer connected to the template. If changes are made to a rule template, by Microsoft engineers or anyone else, any rules created from that template beforehand are ***not*** dynamically updated to match the new template.
29+
30+
However, rules created from templates ***do*** remember which templates they came from, which allows you two advantages:
31+
32+
- If you made changes to a rule when creating it from a template (or at any time after that), you can always revert the rule back to its original version (as a copy of the template).
33+
34+
- You can get notified when a template is updated, and you'll have the choice to update your rules to the new version of their templates or leave them as they are.
35+
36+
This article will show you how to manage these tasks, and what to keep in mind. The procedures discussed below apply to any **[Scheduled](detect-threats-built-in.md#scheduled)** analytics rules created from templates.
37+
38+
## Discover your rule's template version number
39+
40+
With the implementation of template version control, you can see and track the versions of your rule templates and the rules created from them. Rules whose templates have been updated display an "*Update available*" badge next to the rule name.
41+
42+
1. On the **Analytics** blade, select the **Active rules** tab.
43+
44+
1. Select any rule of type **Scheduled**.
45+
46+
- If the rule displays the "*Update available*" badge, its details pane will have a **Review and update** button next to the **Edit** button (see image 1 in the next step below).
47+
48+
- If the rule was created from a template but does not have the "*Update available*" badge, its details pane will have a **Compare with template** button next to the **Edit** button (see images 2 and 3 in the next step below).
49+
50+
- If there is only an **Edit** button, the rule was created from scratch, not from a template.
51+
52+
:::image type="content" source="media/manage-analytics-rule-templates/see-rules-with-updated-template.png" alt-text="Screenshot of active rules list, with badge indicating a template update is available." lightbox="media/manage-analytics-rule-templates/see-rules-with-updated-template.png":::
53+
54+
1. Scroll down to the bottom of the details pane, where you'll see two version numbers: the version of the template from which the rule was created, and the latest available version of the template.
55+
56+
:::image type="content" source="media/manage-analytics-rule-templates/see-template-versions.png" alt-text="Screenshot of details pane. Scroll down to see template version numbers." border="false":::
57+
58+
The number is in a “1.0.0” format – major version, minor version, and build.
59+
(For the time being, the build number is not in use and will always be 0.)
60+
61+
- A difference in the *major version* number indicates that something essential in the template was changed, that could affect how the rule detects threats or even its ability to function altogether. This is a change you will want to include in your rules.
62+
63+
- A difference in the *minor version* number indicates a minor improvement in the template – a cosmetic change or something similar – that would be “nice to have” but is not critical to maintaining the rule’s functionality, efficacy, or performance. This is a change that you could just as easily take or leave.
64+
65+
> [!NOTE]
66+
> Images 2 and 3 above show two examples of rules created from templates, where the template has not been updated.
67+
> - Image 2 shows a rule that has a version number for its current template. This signals that the rule was created after Azure Sentinel's initial implementation of template version control in October 2021.
68+
> - Image 3 shows a rule that doesn't have a current template version. This shows that the rule had been created before October 2021. If there is a latest template version available, it's likely a newer version of the template than the one used to create the rule.
69+
70+
## Compare your active rule with its template
71+
72+
Choose one of the following tabs according to the action you wish to take, to see the instructions for that action:
73+
74+
# [Update template](#tab/update)
75+
76+
Having selected a rule and determined that you want to consider updating it, select **Review and update** on the details pane (see above). You'll see that the **Analytics rule wizard** now has a **Compare to latest version** tab.
77+
78+
On this tab you'll see a side-by-side comparison between the YAML representations of the existing rule and the latest version of the template.
79+
80+
:::image type="content" source="media/manage-analytics-rule-templates/compare-template-versions.png" alt-text="Screenshot of 'Compare to latest version' tab in Analytics rule wizard.":::
81+
82+
> [!NOTE]
83+
> Updating this rule will overwrite your existing rule with the latest version of the template.
84+
Any automation step or logic that makes reference to the existing rule should be verified, in case the referenced names have changed. Also, any customizations you made in creating the original rule - changes to the query, scheduling, grouping, or other settings - may be overwritten.
85+
86+
### Update your rule with the new template version
87+
88+
- If the changes made to the new version of the template are acceptable to you, and nothing else in your original rule has been affected, select **Review and update** to validate and apply the changes.
89+
90+
- If you want to further customize the rule or re-apply any changes that might otherwise be overwritten, select **Next : Custom changes**. If you choose this, you will cycle through the remaining tabs of the [Analytics rule wizard](detect-threats-custom.md) to make those changes, after which you will validate and apply the changes on the **Review and update** tab.
91+
92+
- If you don't want to make any changes to your existing rule, but rather to keep the existing template version, simply exit the wizard by selecting the X in the upper right corner.
93+
94+
# [Revert to template](#tab/revert)
95+
96+
Having selected a rule and determined that you want to revert to its original version, select **Compare with template** on the details pane (see above). You'll see that the **Analytics rule wizard** now has a **Compare to latest version** tab.
97+
98+
On this tab you'll see a side-by-side comparison between the YAML representations of the existing rule and the latest version of the template. These two version numbers may be the same, but the left side shows the active rule including any changes that have been made to it during or after its creation from the template, while the right side shows the unchanged template.
99+
100+
:::image type="content" source="media/manage-analytics-rule-templates/compare-template-versions-2.png" alt-text="Screenshot of 'Compare to latest version' tab in Analytics rule wizard.":::
101+
102+
> [!NOTE]
103+
> Updating this rule will overwrite your existing rule with the latest version of the template.
104+
Any automation step or logic that makes reference to the existing rule should be verified, in case the referenced names have changed. Also, any customizations you made in creating the original rule - changes to the query, scheduling, grouping, or other settings - may be overwritten.
105+
106+
### Revert your rule to its original template version
107+
108+
- If you want to revert completely to the original version of this rule - a clean copy of the template - select **Review and update** to validate and apply the changes.
109+
110+
- If you want to customize the rule differently or re-apply any changes that might otherwise be overwritten, select **Next : Custom changes**. If you choose this, you will cycle through the remaining tabs of the [Analytics rule wizard](detect-threats-custom.md) to make those changes, after which you will validate and apply the changes on the **Review and update** tab.
111+
112+
- If you don't want to make any changes to your existing rule, simply exit the wizard by selecting the X in the upper right corner.
113+
114+
---
115+
116+
## Next steps
117+
In this document, you learned how to track the versions of your Azure Sentinel analytics rule templates, and either to revert active rules to existing template versions, or update them to new ones. To learn more about Azure Sentinel, see the following articles:
118+
119+
- Learn more about [analytics rules](detect-threats-built-in.md).
120+
- See more details about the [analytics rule wizard](detect-threats-custom.md).
80.9 KB
Loading
74.9 KB
Loading
45.8 KB
Loading
140 KB
Loading
46.4 KB
Loading

0 commit comments

Comments
 (0)