You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/concept-sentinel-integration.md
+60-33Lines changed: 60 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,49 +15,54 @@ Together with the new responsibilities, SOC teams deal with new challenges, incl
15
15
16
16
-**Siloed or inefficient communication and processes** between OT and SOC organizations.
17
17
18
-
-**Limited technology and tools**, including:
18
+
-**Limited technology and tools**, such as lack of visibility or automated security remediation for OT networks. You'll need to evaluate and link information across data sources for OT networks, and integrations with existing SOC solutions may be costly.
19
19
20
-
- Lack of visibility and insight into OT networks.
20
+
However, without OT telemetry, context and integration with existing SOC tools and workflows, OT security and operational threats may be handled incorrectly, or even go unnoticed.
21
21
22
-
- Limited insight about events across enterprise IT/OT networks, including tools that don't allow SOC teams to evaluate and link information across data sources in IT/OT environments.
22
+
## Integrate Defender for IoT and Microsoft Sentinel
23
23
24
-
- Low level of automated security remediation for OT networks.
24
+
Microsoft Sentinel is a scalable cloud service for security information event management (SIEM) security orchestration automated response (SOAR). SOC teams can use the integration between Microsoft Defender for Iot and Microsoft Sentinel to collect data across networks, detect and investigate threats, and respond to incidents.
25
25
26
-
- Costly and time-consuming effort needed to integrate OT security solutions into existing SOC solutions.
26
+
In Microsoft Sentinel, the Defender for IoT data connector and solution brings out-of-the-box security content to SOC teams, helping them to view, analyze and respond to OT security alerts, and understand the generated incidents in the broader organizational threat contents.
27
27
28
-
Without OT telemetry, context and integration with existing SOC tools and workflows, OT security and operational threats may be handled incorrectly, or even go unnoticed.
28
+
Install the Defender for IoT data connector alone to stream your OT network alerts to Microsoft Sentinel. Then, also install the **Microsoft Defender for IoT** solution the extra value of IoT/OT-specific analytics rules, workbooks, and SOAR playbooks, as well as incident mappings to [MITRE ATT&CK for ICS](https://collaborate.mitre.org/attackics/index.php/Overview).
29
29
30
-
##Integrate Defender for IoT and Microsoft Sentinel
30
+
### Integrated detection and response
31
31
32
-
Microsoft Sentinel is a scalable cloud solution for security information event management (SIEM) security orchestration automated response (SOAR). SOC teams can use Microsoft Sentinel to collect data across networks, detect and investigate threats, and respond to incidents.
32
+
The following table shows how both the OT team, on the Defender for IoT side, and the SOC team, on the Microsoft Sentinel side, can detect and respond to threats fast across the entire attack timeline.
33
33
34
-
The Defender for IoT and Microsoft Sentinel integration delivers out-of-the-box capabilities to SOC teams. This helps them to efficiently and effectively view, analyze, and respond to OT security alerts, and the incidents they generate in a broader organizational threat context.
34
+
|Microsoft Sentinel |Step |Defender for IoT |
35
+
|---------|---------|---------|
36
+
||**OT alert triggered**| High confidence OT alerts, powered by Defender for IoT's *Section 52* security research group, are triggered based on data ingested to Defender for IoT. |
37
+
|Analytics rules automatically open incidents *only* for relevant use cases, avoiding OT alert fatigue |**OT incident created**||
38
+
|SOC teams map business impact, including data about the site, line, compromised assets, and OT owners |**OT incident business impact mapping**||
39
+
|SOC teams move the incident to *Active* and start investigating, using network connections and events, workbooks, and the OT device entity page |**OT incident investigation**| Alerts are moved to *Active*, and OT teams investigate using PCAP data, detailed reports, and other device details |
40
+
|SOC teams respond with OT playbooks and notebooks |**OT incident response**| OT teams either suppress the alert or learn it for next time, as needed |
41
+
|After the threat is mitigated, SOC teams close the incident |**OT incident closure**| After the threat is mitigated, OT teams close the alert |
35
42
36
-
Bring Defender for IoT's rich telemetry into Microsoft Sentinel to bridge the gap between OT and SOC teams with the Microsoft Sentinel data connector for Defender for IoT and the **Microsoft Defender for IoT** solution.
43
+
## Microsoft Sentinel incidents for Defender for IoT
37
44
38
-
The **Microsoft Defender for IoT** solution installs out-of-the-box security content to your Microsoft Sentinel, including analytics rules to automatically open incidents, workbooks to visualize and monitor data, and playbooks to automate response actions.
45
+
After you've configured the Defender for IoT data connector and have IoT/OT alert data streaming to Microsoft Sentinel, use one of the following methods to create incidents based on those alerts:
39
46
40
-
Once Defender for IoT data is ingested into Microsoft Sentinel, security experts can work with IoT/OT-specific analytics rules, workbooks, and SOAR playbooks, as well as incident mappings to [MITRE ATT&CK for ICS](https://collaborate.mitre.org/attackics/index.php/Overview).
47
+
|Method |Description |
48
+
|---------|---------|
49
+
|**Use the default data connector rule**| Use the default, **Create incidents based on all alerts generated in Microsoft Defender for IOT** analytics rule provided with the data connector. This rule creates a separate incident in Microsoft Sentinel for each alert streamed from Defender for IoT. |
50
+
|**Use out-of-the-box solution rules**| Enable some or all of the [out-of-the-box analytics rules](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot?tab=Overview) provided with the **Microsoft Defender for IoT** solution.<br><br> These analytics rules help to reduce alert fatigue by creating incidents only in specific situations. For example, you might choose to create incidents for excessive login attempts, but for multiple scans detected in the network. |
51
+
|**Create custom rules**| Create custom analytics rules to create incidents based only on your specific needs. You can use the out-of-the-box analytics rules as a starting point, or create rules from scratch. <br><br>Add the following filter to prevent duplicate incidents for the same alert ID: `| where TimeGenerated <= ProcessingEndTime + 60m` |
41
52
42
-
### Workbooks
53
+
Regardless of the method you choose to create alerts, only one incident should be created for each Defender for IoT alert ID.
54
+
55
+
## Microsoft Sentinel workbooks for Defender for IoT
43
56
44
57
To visualize and monitor your Defender for IoT data, use the workbooks deployed to your Microsoft Sentinel workspace as part of the **Microsoft Defender for IoT** solution.
45
58
46
59
Defender for IoT workbooks provide guided investigations for OT entities based on open incidents, alert notifications, and activities for OT assets. They also provide a hunting experience across the MITRE ATT&CK® framework for ICS, and are designed to enable analysts, security engineers, and MSSPs to gain situational awareness of OT security posture.
47
60
48
-
For example, workbooks can display alerts by any of the following dimensions:
49
-
50
-
- Type, such as policy violation, protocol violation, malware, and so on
51
-
- Severity
52
-
- OT device type, such as PLC, HMI, engineering workstation, and so on
53
-
- OT equipment vendor
54
-
- Alerts over time
55
-
56
-
Workbooks also show the result of mapping alerts to MITRE ATT&CK for ICS tactics, plus the distribution of tactics by count and time period. For example:
61
+
Workbooks can display alerts by type, severity, OT device type or vendor, or alerts over time. Workbooks also show the result of mapping alerts to MITRE ATT&CK for ICS tactics, plus the distribution of tactics by count and time period. For example:
57
62
58
63
:::image type="content" source="media/concept-sentinel-integration/mitre-attack.png" alt-text="Image of MITRE ATT&CK graph":::
59
64
60
-
###SOAR playbooks
65
+
## SOAR playbooks for Defender for IoT
61
66
62
67
Playbooks are collections of automated remediation actions that can be run from Microsoft Sentinel as a routine. A playbook can help automate and orchestrate your threat response. It can be run manually or set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively.
63
68
@@ -67,19 +72,41 @@ For example, use SOAR playbooks to:
67
72
68
73
- Send an email to relevant stakeholders when suspicious activity is detected, for example unplanned PLC reprogramming. The mail may be sent to OT personnel, such as a control engineer responsible on the related production line.
69
74
70
-
## Integrated incident timeline
71
75
72
-
The following table shows how both the OT team, on the Defender for IoT side, and the SOC team, on the Microsoft Sentinel side, can detect and respond to threats fast across the entire attack timeline.
73
76
74
-
|Microsoft Sentinel |Step |Defender for IoT |
75
-
|---------|---------|---------|
76
-
||**OT alert triggered**| High confidence OT alerts, powered by Defender for IoT's *Section 52* security research group, are triggered based on data ingested to Defender for IoT. |
77
-
|Analytics rules automatically open incidents *only* for relevant use cases, avoiding OT alert fatigue |**OT incident created**||
78
-
|SOC teams map business impact, including data about the site, line, compromised assets, and OT owners |**OT incident business impact mapping**||
79
-
|SOC teams move the incident to *Active* and start investigating, using network connections and events, workbooks, and the OT device entity page |**OT incident investigation**| Alerts are moved to *Active*, and OT teams investigate using PCAP data, detailed reports, and other device details |
80
-
|SOC teams respond with OT playbooks and notebooks |**OT incident response**| OT teams either suppress the alert or learn it for next time, as needed |
81
-
|After the threat is mitigated, SOC teams close the incident |**OT incident closure**| After the threat is mitigated, OT teams close the alert |
77
+
## Comparing Defender for IoT events, alerts, and incidents
78
+
79
+
This section clarifies the differences between Defender for IoT events, alerts, and incidents in Microsoft Sentinel. Use the listed queries to view a full list of the current events, alerts, and incidents for your OT networks.
80
+
81
+
You'll typically see more Defender for IoT *events* in Microsoft Sentinel than *alerts*, and more Defender for IoT *alerts* than *incidents*.
82
+
83
+
84
+
-**Events**: Each alert log that streams to Microsoft Sentinel from Defender for IoT is an *event*. If the alert log reflects a new or updated alert in Defender for IoT, a new record is added to the **SecurityAlert** table.
85
+
86
+
To view all Defender for IoT events in Microsoft Sentinel, run the following query on the **SecurityAlert** table:
87
+
88
+
```kql
89
+
SecurityAlert
90
+
| where ProviderName == 'IoTSecurity' or ProviderName == 'CustomAlertRule'
91
+
Instead
92
+
```
93
+
94
+
- **Alerts**: Microsoft Sentinel creates alerts based on your current analytics rules and the alert logs listed in the **SecurityAlert** table. If you don't have any active analytics rules for Defender for IoT, Microsoft Sentinel considers each alert log as an *event*.
95
+
96
+
To view alerts in Microsoft Sentinel, run the following query on the **SecurityAlert** table:
97
+
98
+
```kql
99
+
SecurityAlert
100
+
| where ProviderName == 'ASI Scheduled Alerts' or ProviderName == 'CustomAlertRule'
101
+
```
102
+
103
+
- **Incidents**. Microsoft Sentinel creates incidents based on your analytics rules. You might have several alerts grouped in the same incident, or you may have analytics rules configured to *not* create incidents for specific alert types.
104
+
105
+
To view incidents in Microsoft Sentinel, run the following query:
0 commit comments