Skip to content

Commit 33b1663

Browse files
yelevinyelevin
committed
Early draft
1 parent eb93ca8 commit 33b1663

File tree

2 files changed

+70
-63
lines changed

2 files changed

+70
-63
lines changed

‎articles/sentinel/bookmarks.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,21 @@ ms.date: 10/24/2019
1414

1515
# Keep track of data during hunting with Azure Sentinel
1616

17+
> [!IMPORTANT]
18+
>
19+
> The features for mapping MITRE ATT&CK techniques and mapping an expanded set of entity types and identifiers for bookmarks are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
20+
>
21+
22+
[!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)]
23+
1724
Threat hunting typically requires reviewing mountains of log data looking for evidence of malicious behavior. During this process, investigators find events that they want to remember, revisit, and analyze as part of validating potential hypotheses and understanding the full story of a compromise.
1825

1926
Hunting bookmarks in Azure Sentinel help you do this, by preserving the queries you ran in **Azure Sentinel - Logs**, along with the query results that you deem relevant. You can also record your contextual observations and reference your findings by adding notes and tags. Bookmarked data is visible to you and your teammates for easy collaboration.
2027

28+
Now you can identify and address gaps in MITRE ATT&CK technique coverage, across all hunting queries, by mapping your custom hunting queries to MITRE ATT&CK techniques.
29+
Also in preview, you can investigate more types of entities while hunting with bookmarks by mapping the full set of entity types and identifiers supported by Microsoft Sentinel Analytics in your custom queries. This enables you to use bookmarks to explore the entities returned in hunting query results using Entity Pages, incidents and the investigation graph. If a bookmark captures results from a hunting query, it automatically inherits the MITRE ATT&CK technique and entity mappings. For additional information on the preview see our blog post here.
30+
If you find something that urgently needs to be addressed while hunting in your logs, in a couple of clicks, you can create a bookmark and promote it to an incident, or add the bookmark to an existing incident. For more information about incidents, see Tutorial: Investigate incidents with Azure Sentinel.
31+
2132
You can revisit your bookmarked data at any time on the **Bookmarks** tab of the **Hunting** pane. You can use filtering and search options to quickly find specific data for your current investigation. Alternatively, you can view your bookmarked data directly in the **HuntingBookmark** table in your Log Analytics workspace. For example:
2233

2334
> [!div class="mx-imgBorder"]

‎articles/sentinel/hunting.md

Lines changed: 59 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,19 @@
11
---
22
title: Hunting capabilities in Azure Sentinel| Microsoft Docs
33
description: Use Azure Sentinel's built-in hunting queries to guide you into asking the right questions to find issues in your data.
4-
services: sentinel
5-
documentationcenter: na
64
author: yelevin
7-
manager: rkarlin
8-
editor: ''
9-
10-
ms.assetid: 6aa9dd27-6506-49c5-8e97-cc1aebecee87
115
ms.service: azure-sentinel
126
ms.subservice: azure-sentinel
13-
ms.devlang: na
147
ms.topic: conceptual
158
ms.custom: mvc
16-
ms.tgt_pltfrm: na
17-
ms.workload: na
189
ms.date: 08/08/2021
1910
ms.author: yelevin
2011
---
21-
2212
# Hunt for threats with Azure Sentinel
2313

2414
> [!IMPORTANT]
2515
>
26-
> The cross-resource query experience and upgrades to the **hunting dashboard** (see marked items below) are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16+
> The cross-resource query experience and upgrades to **custom queries and bookmarks** (see marked items below) are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
2717
>
2818
2919
[!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)]
@@ -61,40 +51,90 @@ Use queries before, during, and after a compromise to take the following actions
6151
> - Use community resources, such as the [Azure Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries) to find additional queries and data sources.
6252
>
6353
64-
## Use the hunting dashboard (Public preview)
54+
## Use the hunting dashboard
6555

6656
The hunting dashboard enables you to run all your queries, or a selected subset, in a single selection. In the Azure Sentinel portal, select **Hunting**.
6757

68-
The table shown lists all the queries written by Microsoft's team of security analysts and any extra query you created or modified. Each query provides a description of what it hunts for, and what kind of data it runs on. These templates are grouped by their various tactics - the icons on the right categorize the type of threat, such as initial access, persistence, and exfiltration.
58+
The table shown lists all the queries written by Microsoft's team of security analysts and any extra query you created or modified. Each query provides a description of what it hunts for, and what kind of data it runs on. These queries are grouped by their MITRE ATT&CK **tactics**. The icons on the right categorize the type of threat, such as initial access, persistence, and exfiltration. MITRE ATT&CK **techniques** are shown in the **Techniques** column and describe the specific behavior identified by the hunting query.
6959

7060
:::image type="content" source="media/hunting/hunting-start.png" alt-text="Azure Sentinel starts hunting" lightbox="media/hunting/hunting-start.png":::
7161

72-
Use the hunting dashboard to identify where to start hunting, by looking at result count, spikes, or the change in result count over a 24-hour period. Sort and filter by favorites, data source, MITRE ATT&CK tactic or technique, results, or results delta. View queries that still need data sources connected**, and get recommendations on how to enable these queries.
62+
Use the hunting dashboard to identify where to start hunting, by looking at result count, spikes, or the change in result count over a 24-hour period. Sort and filter by favorites, data source, MITRE ATT&CK tactic or technique, results, results delta, or results delta percentage. View queries that still need data sources connected**, and get recommendations on how to enable these queries.
7363

7464
The following table describes detailed actions available from the hunting dashboard:
7565

7666
|Action |Description |
7767
|---------|---------|
7868
|**See how queries apply to your environment** | Select the **Run all queries (Preview)** button, or select a subset of queries using the check boxes to the left of each row and select the **Run selected queries (Preview)** button. <br><br>Running your queries can take anywhere from a few seconds to many minutes, depending on how many queries are selected, the time range, and the amount of data that is being queried. |
7969
|**View the queries that returned results** | After your queries are done running, view the queries that returned results using the **Results** filter: <br>- Sort to see which queries had the most or fewest results. <br>- View the queries that are not at all active in your environment by selecting *N/A* in the **Results** filter. <br>- Hover over the info icon (**i**) next to the *N/A* to see which data sources are required to make this query active. |
80-
|**Identify spikes in your data** | Identify spikes in the data by sorting or filtering on **Results delta**. <br><br>This compares the results of the last 24 hours against the results of the previous 24-48 hours, highlighting any large differences in volume. |
81-
|**View queries mapped to the MITRE Att&CK tactic** | The **MITRE ATT&CK tactic bar**, at the top of the table, lists how many queries are mapped to each MITRE ATT&CK tactic. The tactic bar gets dynamically updated based on the current set of filters applied. <br><br>This enables you to see which MITRE ATT&CK tactics show up when you filter by a given result count, a high result delta, *N/A* results, or any other set of filters. |
70+
|**Identify spikes in your data** | Identify spikes in the data by sorting or filtering on **Results delta** or **Results delta percentage**. <br><br>This compares the results of the last 24 hours against the results of the previous 24-48 hours, highlighting any large differences or relative difference in volume. |
71+
|**View queries mapped to the MITRE ATT&CK tactic** | The **MITRE ATT&CK tactic bar**, at the top of the table, lists how many queries are mapped to each MITRE ATT&CK tactic. The tactic bar gets dynamically updated based on the current set of filters applied. <br><br>This enables you to see which MITRE ATT&CK tactics show up when you filter by a given result count, a high result delta, *N/A* results, or any other set of filters. |
8272
|**View queries mapped to MITRE ATT&CK techniques** | Queries can also be mapped to MITRE ATT&CK techniques. You can filter or sort by MITRE ATT&CK techniques using the **Technique** filter. By opening a query, you will be able to select the technique to see the MITRE ATT&CK description of the technique. |
8373
|**Save a query to your favorites** | Queries saved to your favorites automatically run each time the **Hunting** page is accessed. You can create your own hunting query or clone and customize an existing hunting query template. |
8474
|**Run queries** | Select **Run Query** in the hunting query details page to run the query directly from the hunting page. The number of matches is displayed within the table, in the **Results** column. Review the list of hunting queries and their matches. |
8575
|**Review an underlying query** | Perform a quick review of the underlying query in the query details pane. You can see the results by clicking the **View query results** link (below the query window) or the **View Results** button (at the bottom of the pane). The query will open in the **Logs** (Log Analytics) blade, and below the query, you can review the matches for the query. |
8676
| | |
8777

8878

89-
## Create your own bookmarks
79+
## Create a custom hunting query
80+
81+
Create or modify a query and save it as your own query or share it with users who are in the same tenant.
82+
83+
:::image type="content" source="./media/hunting/save-query.png" alt-text="Save query" lightbox="./media/hunting/save-query.png":::
84+
85+
**To create a new query**:
86+
87+
1. Select **New query**.
88+
89+
1. Fill in all the blank fields and select **Create**.
90+
91+
1. (Preview) Create entity mappings by selecting entity types, identifiers and columns.
92+
93+
1. (Preview) Map MITRE ATT&CK techniques to your hunting queries by selecting the tactic, technique and sub-technique (if applicable).
94+
95+
:::image type="content" source="./media/hunting/new-query.png" alt-text="New query" lightbox="./media/hunting/new-query.png":::
96+
97+
**To clone and modify an existing query**:
98+
99+
1. Select the hunting query in the table you want to modify.
100+
101+
1. Select the ellipsis (...) in the line of the query you want to modify, and select **Clone query**.
102+
103+
:::image type="content" source="./media/hunting/clone-query.png" alt-text="Clone query" lightbox="./media/hunting/clone-query.png":::
104+
105+
1. Modify the query and select **Create**.
106+
107+
:::image type="content" source="./media/hunting/custom-query.png" alt-text="Custom query" lightbox="./media/hunting/custom-query.png":::
108+
109+
110+
111+
## Sample query
112+
113+
A typical query starts with a table name followed by a series of operators separated by \|.
114+
115+
In the example above, start with the table name SecurityEvent and add piped elements as needed.
116+
117+
1. Define a time filter to review only records from the previous seven days.
118+
119+
1. Add a filter in the query to only show event ID 4688.
120+
121+
1. Add a filter in the query on the CommandLine to contain only instances of cscript.exe.
122+
123+
1. Project only the columns you're interested in exploring and limit the results to 1000 and select **Run query**.
124+
125+
1. Select the green triangle and run the query. You can test the query and run it to look for anomalous behavior.
90126

91-
During the hunting and investigation process, you may come across query results that may look unusual or suspicious. Bookmark these items refer back to them in the future, such as when creating or enriching an incident for investigation.
127+
## Create bookmarks
128+
129+
During the hunting and investigation process, you may come across query results that may look unusual or suspicious. Bookmark these items to refer back to them in the future, such as when creating or enriching an incident for investigation.
92130

93131
- In your results, mark the checkboxes for any rows you want to preserve, and select **Add bookmark**. This creates for a record for each marked row - a bookmark - that contains the row results, the query that created the results, and entity mappings to extract users, hosts, and IP addresses. You can add your own tags and notes to each bookmark.
94132

133+
- (Preview) Bookmarks will default to use the same entity and MITRE ATT&CK technique mappings as the hunting query being investigated.
134+
95135
- View all the bookmarked findings by clicking on the **Bookmarks** tab in the main **Hunting** page. Add tags to bookmarks to classify them for filtering. For example, if you're investigating an attack campaign, you can create a tag for the campaign, apply the tag to any relevant bookmarks, and then filter all the bookmarks based on the campaign.
96136

97-
- Investigate a single bookmarked finding by selecting the bookmark and then clicking **Investigate** in the details pane to open the investigation experience.
137+
- Investigate a single bookmarked finding by selecting the bookmark and then clicking **Investigate** in the details pane to open the investigation experience. You can also directly select a listed entity to view that entity’s corresponding entity page.
98138

99139
You can also create an incident from one or more bookmarks or add one or more bookmarks to an existing incident. Select a checkbox to the left of any bookmarks you want to use, and then select **Incident actions** > **Create new incident** or **Add to existing incident**. Triage and investigate the incident like any other.
100140

@@ -184,50 +224,6 @@ The following operators are especially helpful in Azure Sentinel hunting queries
184224

185225
- **adx() (preview)** - This function performs cross-resource queries of Azure Data Explorer data sources from the Azure Sentinel hunting experience and Log Analytics. For more information, see [Cross-resource query Azure Data Explorer by using Azure Monitor](../azure-monitor/logs/azure-monitor-data-explorer-proxy.md).
186226

187-
## Save a query
188-
189-
Create or modify a query and save it as your own query or share it with users who are in the same tenant.
190-
191-
:::image type="content" source="./media/hunting/save-query.png" alt-text="Save query" lightbox="./media/hunting/save-query.png":::
192-
193-
**To create a new query**:
194-
195-
1. Select **New query**.
196-
197-
1. Fill in all the blank fields and select **Create**.
198-
199-
:::image type="content" source="./media/hunting/new-query.png" alt-text="New query" lightbox="./media/hunting/new-query.png":::
200-
201-
**To clone and modify an existing query**:
202-
203-
1. Select the hunting query in the table you want to modify.
204-
205-
1. Select the ellipsis (...) in the line of the query you want to modify, and select **Clone query**.
206-
207-
:::image type="content" source="./media/hunting/clone-query.png" alt-text="Clone query" lightbox="./media/hunting/clone-query.png":::
208-
209-
1. Modify the query and select **Create**.
210-
211-
:::image type="content" source="./media/hunting/custom-query.png" alt-text="Custom query" lightbox="./media/hunting/custom-query.png":::
212-
213-
214-
215-
## Sample query
216-
217-
A typical query starts with a table name followed by a series of operators separated by \|.
218-
219-
In the example above, start with the table name SecurityEvent and add piped elements as needed.
220-
221-
1. Define a time filter to review only records from the previous seven days.
222-
223-
1. Add a filter in the query to only show event ID 4688.
224-
225-
1. Add a filter in the query on the CommandLine to contain only instances of cscript.exe.
226-
227-
1. Project only the columns you're interested in exploring and limit the results to 1000 and select **Run query**.
228-
229-
1. Select the green triangle and run the query. You can test the query and run it to look for anomalous behavior.
230-
231227
## Next steps
232228

233229
In this article, you learned how to run a hunting investigation with Azure Sentinel.

0 commit comments

Comments
 (0)