You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/add-entity-to-threat-intelligence.md
+55-17Lines changed: 55 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,39 +24,77 @@ The [investigation graph](investigate-cases.md) is a visual, intuitive tool that
24
24
25
25
1. From the Microsoft Sentinel navigation menu, select **Incidents**.
26
26
27
-
:::image type="content" source="media/investigate-cases/incident-severity.png" alt-text="Screenshot of incidents queue displayed in a grid." lightbox="media/investigate-cases/incident-severity.png":::
28
-
29
27
1. Select an incident to investigate. In the incident details panel, select the **Actions** button and choose **Investigate** from the pop-up menu. This will open the investigation graph.
30
28
29
+
<!--
31
30
:::image type="content" source="media/relate-alerts-to-incidents/investigation-map.png" alt-text="Screenshot of incidents with alerts in investigation graph." lightbox="media/investigate-cases/incident-severity.png":::
31
+
-->
32
+
33
+
1. Select the entity from the graph that you want to add as a threat indicator. A side panel will open on the right. Select **Add to TI**.
34
+
35
+
1. The **New indicator** side panel will open. The following fields will be populated automatically:
32
36
33
-
1. Select the entity you want to add as a threat indicator. A side panel will open on the right. Select **Add to TI**.
37
+
-**Type**
38
+
- The type of indicator represented by the entity you're adding.
39
+
Drop-down with possible values: *ipv4-addr*, *ipv6-addr*, *URL*, *file*, *domain-name*
40
+
- Required; automatically populated based on the **entity type**.
34
41
35
-
1. The **New indicator** side panel will open. Fill in the fields as described below.
42
+
-**Value**
43
+
- The name of this field changes dynamically to the selected indicator type.
44
+
- The value of the indicator itself.
45
+
- Required; automatically populated by the **entity value**.
36
46
37
-
| Field | Required? | Description |
38
-
| ----- | --------- | ----------- |
39
-
| Type | Yes | Type of the indicator (ipv4-addr, ipv6-addr, URL, file, domain-name).<br>**This is auto-populated based on the entity type.**|
40
-
| Value | Yes | Value of the observable.
47
+
-**Tags**
48
+
- Free-text tags you can add to the indicator.
49
+
- Optional; automatically populated by the **incident ID**. You can add others.
50
+
51
+
-**Name**
52
+
- Name of the indicator - this is what will be displayed in your list of indicators.
53
+
- Optional; automatically populated by the **incident name.**
54
+
55
+
-**Created by**
56
+
- Creator of the indicator.
57
+
- Optional; automatically-populated by the user logged into Microsoft Sentinel.
41
58
42
-
1. Hover over one of the related alerts until a menu pops out to its side. Select **Add alert to incident (Preview)**.
59
+
Fill in the remaining fields accordingly.
43
60
44
-
:::image type="content" source="media/relate-alerts-to-incidents/add-alert-to-incident.png" alt-text="Screenshot of adding an alert to an incident in the investigation graph.":::
61
+
-**Threat type**
62
+
- The threat type represented by the indicator. ***EXAMPLE???***
63
+
- Optional; free text.
45
64
46
-
1. The alert is added to the incident, and for all purposes is part of the incident, along with all its entities and details. You'll see two visual representations of this:
65
+
-**Description**
66
+
- Description of the indicator.
67
+
- Optional; free text.
47
68
48
-
- The line connecting it to the entity in the investigation graph has changed from dotted to solid, and connections to entities in the added alert have been added to the graph.
69
+
-**Revoked**
70
+
- Revoked status of the indicator. Mark checkbox to revoke the indicator, clear checkbox to make it active.
71
+
- Optional; boolean.
49
72
50
-
:::image type="content" source="media/relate-alerts-to-incidents/alert-joined-to-incident.png" alt-text="Screenshot showing an alert added to an incident." lightbox="media/relate-alerts-to-incidents/alert-joined-to-incident.png":::
73
+
-**Confidence**
74
+
- Score reflecting confidence in the correctness of the data, by percent.
75
+
- Optional; integer, 1-100
51
76
52
-
- The alert now appears in this incident's timeline, together with the alerts that were already there.
77
+
-**Kill chain**
78
+
- Phases in the [*Lockheed Martin Cyber Kill Chain*](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html#OVERVIEW) to which the indicator corresponds.
79
+
- Optional; free text
53
80
54
-
:::image type="content" source="media/relate-alerts-to-incidents/two-alerts.png" alt-text="Screenshot showing an alert added to an incident's timeline.":::
81
+
-**Valid from**
82
+
- The time from which this indicator is considered valid.
83
+
- Required; date/time
55
84
85
+
-**Valid until**
86
+
- The time at which this indicator should no longer be considered valid.
87
+
- Optional; date/time
56
88
57
89
90
+
1. When all the fields are filled in to your satisfaction, select **Apply**. You'll see a confirmation message in the upper-right-hand corner that your indicator was created.
91
+
92
+
1. The entity will be added as a threat indicator in your workspace. You can find it [in the list of indicators in the **Threat intelligence** page](work-with-threat-indicators.md#find-and-view-your-indicators-in-the-threat-intelligence-page), and also [in the *ThreatIntelligenceIndicators* table in **Logs**](work-with-threat-indicators.md#find-and-view-your-indicators-in-logs).
93
+
58
94
## Next steps
59
-
In this article, you learned how to add alerts to incidents and remove them using the Microsoft Sentinel portal and API. For more information, see:
95
+
96
+
In this article, you learned how to add entities to your threat indicator lists. For more information, see:
60
97
61
98
-[Investigate incidents with Microsoft Sentinel](investigate-cases.md)
62
-
-[Incident relations group in the Microsoft Sentinel REST API](/rest/api/securityinsights/preview/incident-relations)
99
+
-[Understand threat intelligence in Microsoft Sentinel](understand-threat-intelligence.md)
100
+
-[Work with threat indicators in Microsoft Sentinel](work-with-threat-indicators.md)
-[New data sources for User and entity behavior analytics (UEBA) (Preview)](#new-data-sources-for-user-and-entity-behavior-analytics-ueba-preview)
32
33
-[Microsoft Sentinel Solution for SAP is now generally available](#microsoft-sentinel-solution-for-sap-is-now-generally-available)
33
34
35
+
### Add entities to threat intelligence (Preview)
36
+
37
+
When investigating an incident, you examine entities and their context as an important part of understanding the scope and nature of the incident. In the course of the investigation, you may discover an entity in the incident that should be labeled and tracked as an indicator of compromise (IOC), a threat indicator.
38
+
39
+
Microsoft Sentinel allows you to flag the entity as malicious, right from within the investigation graph. You'll then be able to view this indicator both in Logs and in the Threat Intelligence blade in Sentinel.
40
+
41
+
Learn how to [add an entity to your threat intelligence](add-entity-to-threat-intelligence.md).
42
+
34
43
### Azure resource entity page (Preview)
35
44
36
45
Azure resources such as Azure Virtual Machines, Azure Storage Accounts, Azure Key Vault, Azure DNS, and more are essential parts of your network. Threat actors might attempt to obtain sensitive data from your storage account, gain access to your key vault and the secrets it contains, or infect your virtual machine with malware. The new [Azure resource entity page](entity-pages.md) is designed to help your SOC investigate incidents that involve Azure resources in your environment, hunt for potential attacks, and assess risk.
0 commit comments