You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/bookmarks.md
+57-62Lines changed: 57 additions & 62 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,77 +7,83 @@ manager: rkarlin
7
7
ms.assetid: 320ccdad-8767-41f3-b083-0bc48f1eeb37
8
8
ms.service: azure-sentinel
9
9
ms.subservice: azure-sentinel
10
-
ms.topic: conceptual
10
+
ms.topic: how-to
11
11
ms.custom: mvc
12
-
ms.date: 10/24/2019
12
+
ms.date: 11/01/2021
13
13
---
14
14
15
15
# Keep track of data during hunting with Azure Sentinel
16
16
17
-
> [!IMPORTANT]
18
-
>
19
-
> The features for mapping MITRE ATT&CK techniques and mapping an expanded set of entity types and identifiers for bookmarks are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
Threat hunting typically requires reviewing mountains of log data looking for evidence of malicious behavior. During this process, investigators find events that they want to remember, revisit, and analyze as part of validating potential hypotheses and understanding the full story of a compromise.
25
20
26
21
Hunting bookmarks in Azure Sentinel help you do this, by preserving the queries you ran in **Azure Sentinel - Logs**, along with the query results that you deem relevant. You can also record your contextual observations and reference your findings by adding notes and tags. Bookmarked data is visible to you and your teammates for easy collaboration.
27
22
28
23
Now you can identify and address gaps in MITRE ATT&CK technique coverage, across all hunting queries, by mapping your custom hunting queries to MITRE ATT&CK techniques.
29
-
Also in preview, you can investigate more types of entities while hunting with bookmarks by mapping the full set of entity types and identifiers supported by Microsoft Sentinel Analytics in your custom queries. This enables you to use bookmarks to explore the entities returned in hunting query results using Entity Pages, incidents and the investigation graph. If a bookmark captures results from a hunting query, it automatically inherits the MITRE ATT&CK technique and entity mappings. For additional information on the preview see our blog post here.
30
-
If you find something that urgently needs to be addressed while hunting in your logs, in a couple of clicks, you can create a bookmark and promote it to an incident, or add the bookmark to an existing incident. For more information about incidents, see Tutorial: Investigate incidents with Azure Sentinel.
31
24
32
-
You can revisit your bookmarked data at any time on the **Bookmarks** tab of the **Hunting** pane. You can use filtering and search options to quickly find specific data for your current investigation. Alternatively, you can view your bookmarked data directly in the **HuntingBookmark** table in your Log Analytics workspace. For example:
25
+
> [!IMPORTANT]
26
+
>
27
+
> The mapping of MITRE ATT&CK techniques to bookmarks is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
You can also investigate more types of entities while hunting with bookmarks, by mapping the full set of entity types and identifiers supported by Microsoft Sentinel Analytics in your custom queries. This enables you to use bookmarks to explore the entities returned in hunting query results using [entity pages](entities-in-azure-sentinel.md#entity-pages), [incidents](investigate-cases.md) and the [investigation graph](investigate-cases.md#use-the-investigation-graph-to-deep-dive). If a bookmark captures results from a hunting query, it automatically inherits the MITRE ATT&CK technique and entity mappings. For additional information on the preview see our blog post [here](BROKEN-LINK).
36
30
37
-
Viewing bookmarks from the table enables you to filter, summarize, and join bookmarked data with other data sources, making it easy to look for corroborating evidence.
31
+
> [!IMPORTANT]
32
+
>
33
+
> The mapping of an expanded set of entity types and identifiers to bookmarks is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
34
+
>
35
+
36
+
If you find something that urgently needs to be addressed while hunting in your logs, you can easily create a bookmark and either promote it to an incident or add it to an existing incident. For more information about incidents, see [Investigate incidents with Azure Sentinel](investigate-cases.md).
37
+
38
+
If you found something worth bookmarking, but that isn't immediately urgent, you can create a bookmark and then revisit your bookmarked data at any time on the **Bookmarks** tab of the **Hunting** pane. You can use filtering and search options to quickly find specific data for your current investigation.
38
39
39
-
Currently in preview, if you find something that urgently needs to be addressed while hunting in your logs, in a couple of clicks, you can create a bookmark and promote it to an incident, or add the bookmark to an existing incident. For more information about incidents, see [Tutorial: Investigate incidents with Azure Sentinel](investigate-cases.md).
40
+
You can visualize your bookmarked data by selecting **Investigate** from the bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.
40
41
41
-
Also in preview, you can visualize your bookmarked data, by clicking **Investigate** from the bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.
42
+
Alternatively, you can view your bookmarked data directly in the **HuntingBookmark** table in your Log Analytics workspace. For example:
43
+
44
+
:::image type="content" source="media/bookmarks/bookmark-table.png" alt-text="Screenshot of viewing hunting bookmarks table." lightbox="media/bookmarks/bookmark-table.png":::
45
+
46
+
Viewing bookmarks from the table enables you to filter, summarize, and join bookmarked data with other data sources, making it easy to look for corroborating evidence.
42
47
43
48
## Add a bookmark
44
49
45
-
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** to run queries for suspicious and anomalous behavior.
50
+
1. In the Azure portal, navigate to **Azure Sentinel** > **Threat management** > **Hunting** to run queries for suspicious and anomalous behavior.
46
51
47
-
2. Select one of the hunting queries and on the right, in the hunting query details, select **Run Query**.
52
+
1. Select one of the hunting queries and on the right, in the hunting query details, select **Run Query**.
53
+
54
+
1. Select **View query results**. For example:
55
+
56
+
:::image type="content" source="media/bookmarks/new-processes-observed-example.png" alt-text="Screenshot of viewing query results from Azure Sentinel hunting.":::
48
57
49
-
3. Select **View query results**. For example:
50
-
51
-
> [!div class="mx-imgBorder"]
52
-
> 
53
-
54
58
This action opens the query results in the **Logs** pane.
55
59
56
-
4. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.
60
+
1. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.
57
61
58
-
5. Select **Add bookmark**:
59
-
60
-
> [!div class="mx-imgBorder"]
61
-
> 
62
+
1. Select **Add bookmark**:
62
63
63
-
6. On the right, in the **Add bookmark** pane, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.
64
+
:::image type="content" source="media/bookmarks/add-hunting-bookmark.png" alt-text="Screenshot of adding hunting bookmark to query." lightbox="media/bookmarks/add-hunting-bookmark.png":::
64
65
65
-
7. In the **Query Information** section, use the drop-down boxes to extract information from the query results for the **Account**, **Host**, and **IP address** entity types. This action maps the selected entity type to a specific column from the query result. For example:
66
-
67
-
> [!div class="mx-imgBorder"]
68
-
> 
69
-
70
-
To view the bookmark in the investigation graph (currently in preview), you must map at least one entity type that is either **Account**, **Host**, or **IP address**.
66
+
1. On the right, in the **Add bookmark** pane, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.
67
+
68
+
1.**(Preview)** Bookmarks can be optionally mapped to MITRE ATT&CK techniques or sub-techniques. MITRE ATT&CK mappings are inherited from mapped values in hunting queries, but you can also create them manually. Select the MITRE ATT&CK tactic associated with the desired technique from the drop-down menu in the **Tactics & techniques** section of the **Add bookmark** pane (which for this purpose looks like the **Create custom query** wizard shown below). The menu will expand to show all the MITRE ATT&CK techniques, and you can select multiple techniques and sub-techniques in this menu.
69
+
70
+
:::image type="content" source="media/bookmarks/mitre-attack-mapping.png" alt-text="Screenshot of how to map Mitre Attack tactics and techniques to bookmarks.":::
71
71
72
-
5. Click **Save** to commit your changes and add the bookmark. All bookmarked data is shared with other investigators, and is a first step toward a collaborative investigation experience.
72
+
1.**(Preview)** Now an expanded set of entities can be extracted from bookmarked query results for further investigation. In the **Entity mapping** section, use the drop-downs to select [entity types and identifiers](entities-reference.md). Then map the column in the query results containing the corresponding identifier. For example:
73
+
74
+
:::image type="content" source="media/bookmarks/map-entity-types-bookmark.png" alt-text="Screenshot to map entity types for hunting bookmarks.":::
75
+
76
+
To view the bookmark in the investigation graph, you must map at least one entity. Entity mappings to account, host, IP, and URL entity types created before this preview are still supported, preserving backwards compatibility.
77
+
78
+
1. Click **Save** to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.
73
79
74
80
75
81
> [!NOTE]
76
82
> The log query results support bookmarks whenever this pane is opened from Azure Sentinel. For example, you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident (currently in preview). You can't create bookmarks when the **Logs** pane is opened from other locations, such as directly from Azure Monitor.
77
83
78
84
## View and update bookmarks
79
85
80
-
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting**.
86
+
1. In the Azure portal, navigate to **Azure Sentinel** > **Threat management** > **Hunting**.
81
87
82
88
2. Select the **Bookmarks** tab to view the list of bookmarks.
83
89
@@ -89,42 +95,31 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
89
95
90
96
## Exploring bookmarks in the investigation graph
91
97
92
-
> [!IMPORTANT]
93
-
> Exploring bookmarks in the investigation graph and the investigation graph itself are currently in public preview.
94
-
> These features are provided without a service level agreement, and not recommended for production workloads.
95
-
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
98
+
1. In the Azure portal, navigate to **Azure Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to investigate.
96
99
97
-
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to investigate.
100
+
2. In the bookmark details, ensure that at least one entity is mapped.
98
101
99
-
2. In the bookmark details, ensure that at least one entity is mapped. For example, for **ENTITIES**, you see entries for **IP**, **Machine**, or **Account**.
100
-
101
-
3. Click **Investigate** to view the bookmark in the investigation graph.
102
+
3. Select **Investigate** to view the bookmark in the investigation graph.
102
103
103
104
For instructions to use the investigation graph, see [Use the investigation graph to deep dive](investigate-cases.md#use-the-investigation-graph-to-deep-dive).
104
105
105
106
## Add bookmarks to a new or existing incident
106
107
107
-
> [!IMPORTANT]
108
-
> Adding bookmarks to a new or existing incident is currently in public preview.
109
-
> This feature is provided without a service level agreement, and it's not recommended for production workloads.
110
-
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
108
+
1. In the Azure portal, navigate to **Azure Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to add to an incident.
111
109
112
-
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to add to an incident.
110
+
2. Select **Incident actions** from the command bar:
113
111
114
-
2. Select **Incident actions (Preview)** from the command bar:
115
-
116
-
> [!div class="mx-imgBorder"]
117
-
> 
112
+
:::image type="content" source="media/bookmarks/incident-actions.png" alt-text="Screenshot of adding bookmarks to incident.":::
118
113
119
-
3. Select either **Create new incident** or **Add to existing incident**, as required. Then:
114
+
3. Select either **Create new incident** or **Add to existing incident**, as appropriate. Then:
120
115
121
116
- For a new incident: Optionally update the details for the incident, and then select **Create**.
122
117
- For adding a bookmark to an existing incident: Select one incident, and then select **Add**.
123
118
124
-
To view the bookmark within the incident: Navigate to **Sentinel** > **Threat management** > **Incidents** and select the incident with your bookmark. Select **View full details**, and then select the **Bookmarks** tab.
119
+
To view the bookmark within the incident: Navigate to **Azure Sentinel** > **Threat management** > **Incidents** and select the incident with your bookmark. Select **View full details**, and then select the **Bookmarks** tab.
125
120
126
121
> [!TIP]
127
-
> As an alternative to the **Incident actions (Preview)** option on the command bar, you can use the context menu (**...**) for one or more bookmarks to select options to **Create new incident**, **Add to existing incident**, and **Remove from incident**.
122
+
> As an alternative to the **Incident actions** option on the command bar, you can use the context menu (**...**) for one or more bookmarks to select options to **Create new incident**, **Add to existing incident**, and **Remove from incident**.
128
123
129
124
## View bookmarked data in logs
130
125
@@ -136,19 +131,18 @@ To view bookmarked queries, results, or their history, select the bookmark from
136
131
137
132
You can also view the raw bookmark data for all bookmarks by selecting **Bookmark Logs** from the command bar on the **Hunting** > **Bookmarks** tab:
:::image type="content" source="media/bookmarks/bookmark-logs.png" alt-text="Screenshot of bookmark logs command.":::
141
135
142
-
This view shows all your bookmarks with associated metadata. You can use [Keyword Query Language](/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference) (KQL) queries to filter down to the latest version of the specific bookmark you are looking for.
136
+
This view shows all your bookmarks with associated metadata. You can use [Kusto Query Language](/azure/data-explorer/kql-quick-reference) (KQL) queries to filter down to the latest version of the specific bookmark you are looking for.
143
137
144
138
> [!NOTE]
145
139
> There can be a significant delay (measured in minutes) between the time you create a bookmark and when it is displayed in the **Bookmarks** tab.
146
140
147
141
## Delete a bookmark
148
142
149
-
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to delete.
143
+
1. In the Azure portal, navigate to **Azure Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to delete.
150
144
151
-
2. Right-click your selections, and select the option to delete the bookmark or bookmarks. For example, **Delete bookmark** if you selected just one bookmark, and **Delete 2 bookmarks** if you selected two bookmarks.
145
+
2. Right-click your selections, and select the option to delete the number of bookmarksyou have selected.
152
146
153
147
Deleting the bookmark removes the bookmark from the list in the **Bookmark** tab. The **HuntingBookmark** table for your Log Analytics workspace will continue to contain previous bookmark entries, but the latest entry will change the **SoftDelete** value to true, making it easy to filter out old bookmarks. Deleting a bookmark does not remove any entities from the investigation experience that are associated with other bookmarks or alerts.
154
148
@@ -159,4 +153,5 @@ In this article, you learned how to run a hunting investigation using bookmarks
159
153
160
154
161
155
-[Proactively hunt for threats](hunting.md)
162
-
-[Use notebooks to run automated hunting campaigns](notebooks.md)
156
+
-[Use notebooks to run automated hunting campaigns](notebooks.md)
157
+
-[Threat hunting with Azure Sentinel (Learn module)](/learn/modules/hunt-threats-sentinel/)
0 commit comments