Skip to content

Commit c0d66e7

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#13148 from fgravato/lookout/v3.0.1-final
Lookout v3.0.1: Parser fixes, comprehensive and executive dashboards
2 parents 4e9184f + e39e868 commit c0d66e7

File tree

69 files changed

+8963
-235
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+8963
-235
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/LookoutEvents.json‎

Lines changed: 290 additions & 30 deletions
Large diffs are not rendered by default.

‎.script/tests/KqlvalidationsTests/CustomTables/LookoutMtdV2_CL.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Name": "LookoutMtdV2_CL",
3+
"Properties": [
4+
{"Name": "TimeGenerated", "Type": "DateTime"},
5+
{"Name": "log_type", "Type": "String"},
6+
{"Name": "event_type", "Type": "String"},
7+
{"Name": "id", "Type": "String"},
8+
{"Name": "change_type", "Type": "String"},
9+
{"Name": "enterprise_guid", "Type": "String"},
10+
{"Name": "threat", "Type": "dynamic"},
11+
{"Name": "device", "Type": "dynamic"},
12+
{"Name": "actor", "Type": "dynamic"},
13+
{"Name": "target", "Type": "dynamic"},
14+
{"Name": "audit", "Type": "dynamic"},
15+
{"Name": "smishing_alert", "Type": "dynamic"},
16+
{"Name": "device_activation_status", "Type": "String"},
17+
{"Name": "device_checkin_time", "Type": "DateTime"},
18+
{"Name": "device_activated_at", "Type": "DateTime"},
19+
{"Name": "device_deactivated_at", "Type": "DateTime"},
20+
{"Name": "device_customer_id", "Type": "String"},
21+
{"Name": "device_group_guid", "Type": "String"},
22+
{"Name": "client_lookout_sdk_version", "Type": "String"},
23+
{"Name": "client_ota_version", "Type": "String"},
24+
{"Name": "client_package_name", "Type": "String"},
25+
{"Name": "client_package_version", "Type": "String"},
26+
{"Name": "mdm_connector_id", "Type": "String"},
27+
{"Name": "mdm_connector_uuid", "Type": "String"},
28+
{"Name": "mdm_external_id", "Type": "String"},
29+
{"Name": "device_permissions", "Type": "dynamic"},
30+
{"Name": "device_settings", "Type": "dynamic"},
31+
{"Name": "device_vulns", "Type": "dynamic"},
32+
{"Name": "risky_config", "Type": "dynamic"},
33+
{"Name": "audit_attribute_changes", "Type": "dynamic"},
34+
{"Name": "smishing_detections", "Type": "dynamic"}
35+
]
36+
}

‎Solutions/Lookout/ARCHITECTURE_DIAGRAM.md‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
# Lookout Mobile Risk API v2 Architecture Overview
2+
3+
## Current Architecture
4+
5+
```mermaid
6+
graph TD
7+
A[Lookout Mobile Risk API v2] -->|Server-Sent Events| B[Azure Data Collection Endpoint]
8+
B --> C[Data Collection Rule - Basic Transform]
9+
C --> D[LookoutMtdV2_CL Table - Limited Fields]
10+
D --> E[Legacy Parser - Lookout_CL Target]
11+
E --> F[Basic Analytics Rules]
12+
E --> G[Simple Workbook]
13+
14+
style A fill:#e1f5fe
15+
style D fill:#fff3e0
16+
style E fill:#ffebee
17+
```
18+
19+
## Enhanced v2 Architecture
20+
21+
```mermaid
22+
graph TD
23+
A[Lookout Mobile Risk API v2] -->|Enhanced Event Stream| B[Azure Data Collection Endpoint]
24+
B --> C[Enhanced DCR - Comprehensive Transform]
25+
C --> D[Expanded LookoutMtdV2_CL Table]
26+
D --> E[Enhanced Parser - v2 Field Support]
27+
E --> F[Legacy Analytics Rules - Backward Compatible]
28+
E --> G[Enhanced Threat Detection Rules]
29+
E --> H[Advanced Workbook Visualizations]
30+
E --> I[Hunting Queries - v2 Fields]
31+
32+
J[Event Types] --> A
33+
J1[DEVICE Events] --> J
34+
J2[THREAT Events] --> J
35+
J3[AUDIT Events] --> J
36+
J4[SMISHING_ALERT Events] --> J
37+
38+
K[Enhanced Field Categories] --> D
39+
K1[Device Management] --> K
40+
K2[Threat Intelligence] --> K
41+
K3[Audit Trail] --> K
42+
K4[MDM Integration] --> K
43+
K5[Client Information] --> K
44+
45+
style A fill:#e8f5e8
46+
style C fill:#e8f5e8
47+
style D fill:#e8f5e8
48+
style E fill:#e8f5e8
49+
style G fill:#fff3e0
50+
style H fill:#fff3e0
51+
style I fill:#fff3e0
52+
```
53+
54+
## Data Flow Enhancement Details
55+
56+
### Phase 1: Infrastructure Enhancement
57+
```mermaid
58+
graph LR
59+
A[Current 11 Fields] --> B[Enhanced 50+ Fields]
60+
B --> C[Improved DCR Transform]
61+
C --> D[Backward Compatible Parser]
62+
63+
style B fill:#e8f5e8
64+
style C fill:#e8f5e8
65+
style D fill:#e8f5e8
66+
```
67+
68+
### Phase 2: Analytics Enhancement
69+
```mermaid
70+
graph LR
71+
A[Basic Threat Detection] --> B[Enhanced Threat Classification]
72+
B --> C[Device Compliance Monitoring]
73+
C --> D[Advanced Correlation Rules]
74+
75+
style B fill:#fff3e0
76+
style C fill:#fff3e0
77+
style D fill:#fff3e0
78+
```
79+
80+
### Phase 3: Advanced Features
81+
```mermaid
82+
graph LR
83+
A[Static Workbooks] --> B[Dynamic Visualizations]
84+
B --> C[Hunting Queries]
85+
C --> D[Threat Intelligence Integration]
86+
87+
style B fill:#f3e5f5
88+
style C fill:#f3e5f5
89+
style D fill:#f3e5f5
90+
```
91+
92+
## Component Interaction Matrix
93+
94+
| Component | Current State | Enhanced State | Dependencies |
95+
|-----------|---------------|----------------|--------------|
96+
| **Table Schema** | 11 basic fields | 50+ comprehensive fields | DCR updates |
97+
| **DCR Transform** | Basic field mapping | Comprehensive extraction | API v2 understanding |
98+
| **Parser** | Legacy Lookout_CL target | Dual compatibility | Table schema |
99+
| **Analytics Rules** | Basic threat detection | Multi-layered detection | Parser updates |
100+
| **Workbooks** | Simple visualizations | Rich dashboards | Enhanced data |
101+
| **Hunting Queries** | Limited scope | Comprehensive coverage | All above |
102+
103+
## Security and Compliance Flow
104+
105+
```mermaid
106+
graph TD
107+
A[Raw API Data] --> B[Data Classification]
108+
B --> C[Field Validation]
109+
C --> D[Transformation Rules]
110+
D --> E[Secure Storage]
111+
E --> F[Access Control]
112+
F --> G[Audit Logging]
113+
114+
H[Compliance Requirements] --> B
115+
I[Data Retention Policies] --> E
116+
J[Privacy Controls] --> F
117+
118+
style A fill:#ffebee
119+
style E fill:#e8f5e8
120+
style G fill:#e3f2fd
121+
```
122+
123+
## Implementation Phases
124+
125+
### Phase 1: Core Infrastructure (Weeks 1-2)
126+
- Expand table schema
127+
- Update DCR transformations
128+
- Enhance parser compatibility
129+
130+
### Phase 2: Analytics Enhancement (Weeks 3-4)
131+
- Update existing analytics rules
132+
- Create new threat detection rules
133+
- Enhance workbook visualizations
134+
135+
### Phase 3: Advanced Features (Weeks 5-6)
136+
- Create hunting queries
137+
- Implement advanced correlation
138+
- Add comprehensive validation
139+
140+
## Risk Mitigation Strategy
141+
142+
```mermaid
143+
graph TD
144+
A[Backward Compatibility] --> B[Gradual Migration]
145+
B --> C[Parallel Testing]
146+
C --> D[Rollback Capability]
147+
148+
E[Data Validation] --> F[Error Handling]
149+
F --> G[Monitoring Alerts]
150+
G --> H[Performance Optimization]
151+
152+
style A fill:#e8f5e8
153+
style E fill:#fff3e0
154+
```
155+
156+
## Success Metrics
157+
158+
1. **Data Completeness**: 95%+ field population rate
159+
2. **Performance**: <10% increase in ingestion latency
160+
3. **Compatibility**: 100% backward compatibility maintained
161+
4. **Detection Enhancement**: 30%+ improvement in threat detection coverage
162+
5. **User Adoption**: Analytics rules utilizing new fields within 30 days

‎Solutions/Lookout/Analytic Rules/LookoutAuditEventV2.yaml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
id: 6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d
2+
name: Lookout - Critical Audit and Policy Changes (v2)
3+
description: |
4+
'Monitors critical audit events and policy changes from Lookout Mobile Risk API v2. Detects unauthorized configuration changes, policy modifications, security setting adjustments, and administrative actions that could impact mobile security posture. Provides comprehensive audit trail for compliance and security governance.'
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: LookoutAPI
9+
dataTypes:
10+
- LookoutEvents
11+
queryFrequency: 15m
12+
queryPeriod: 1h
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- DefenseEvasion
17+
- Persistence
18+
- PrivilegeEscalation
19+
- Impact
20+
relevantTechniques:
21+
- T1629
22+
- T1626
23+
query: |
24+
LookoutEvents
25+
| where EventType == "AUDIT"
26+
| where AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE", "USER_MANAGEMENT", "CONFIGURATION_CHANGE")
27+
| extend
28+
ChangeImpact = case(
29+
AuditType == "POLICY_CHANGE", "High",
30+
AuditType == "SECURITY_SETTING_CHANGE", "High",
31+
AuditType == "USER_MANAGEMENT", "Medium",
32+
AuditType == "CONFIGURATION_CHANGE", "Medium",
33+
"Low"
34+
),
35+
RiskLevel = case(
36+
ActorType == "SYSTEM" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Automated Change",
37+
ActorType == "ADMIN_USER" and AuditType == "POLICY_CHANGE", "Administrative Change",
38+
ActorType == "USER" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Unauthorized Change",
39+
ActorType == "UNKNOWN", "Suspicious Change",
40+
"Standard Change"
41+
)
42+
| extend SecurityImplications = case(
43+
AuditAttributeChanges has "threat_response_level" and AuditAttributeChanges has "LOW", "Threat Response Weakened",
44+
AuditAttributeChanges has "auto_quarantine_enabled" and AuditAttributeChanges has "false", "Auto-Quarantine Disabled",
45+
AuditAttributeChanges has "compliance_enforcement" and AuditAttributeChanges has "false", "Compliance Enforcement Disabled",
46+
AuditAttributeChanges has "device_wipe_enabled" and AuditAttributeChanges has "false", "Device Wipe Disabled",
47+
AuditAttributeChanges has "admin" or AuditAttributeChanges has "privilege", "Privilege Changes",
48+
"Configuration Update"
49+
)
50+
| extend ComplianceRisk = case(
51+
SecurityImplications in ("Threat Response Weakened", "Auto-Quarantine Disabled", "Compliance Enforcement Disabled"), "Critical",
52+
SecurityImplications == "Device Wipe Disabled", "High",
53+
SecurityImplications == "Privilege Changes", "High",
54+
RiskLevel == "Unauthorized Change", "High",
55+
RiskLevel == "Suspicious Change", "Medium",
56+
"Low"
57+
)
58+
| extend ChangeDetails = case(
59+
isnotempty(AuditAttributeChanges), strcat("Attribute changes: ", tostring(AuditAttributeChanges)),
60+
isnotempty(TargetGuid), strcat("Target: ", TargetType, " (", TargetGuid, ")"),
61+
"General audit event"
62+
)
63+
| project
64+
TimeGenerated,
65+
EventId,
66+
AuditType,
67+
ChangeImpact,
68+
RiskLevel,
69+
SecurityImplications,
70+
ComplianceRisk,
71+
ChangeDetails,
72+
AuditAttributeChanges,
73+
ActorType,
74+
ActorGuid,
75+
TargetType,
76+
TargetGuid,
77+
TargetEmailAddress,
78+
ChangeType,
79+
EnterpriseGuid
80+
entityMappings:
81+
- entityType: Account
82+
fieldMappings:
83+
- identifier: FullName
84+
columnName: ActorGuid
85+
- identifier: Name
86+
columnName: TargetEmailAddress
87+
- entityType: Host
88+
fieldMappings:
89+
- identifier: HostName
90+
columnName: TargetGuid
91+
customDetails:
92+
AuditType: AuditType
93+
ChangeImpact: ChangeImpact
94+
RiskLevel: RiskLevel
95+
SecurityImpact: SecurityImplications
96+
ComplianceRisk: ComplianceRisk
97+
ActorType: ActorType
98+
TargetType: TargetType
99+
ChangeType: ChangeType
100+
alertDetailsOverride:
101+
alertDisplayNameFormat: "Critical Audit Event: {{SecurityImplications}} by {{ActorType}}"
102+
alertDescriptionFormat: "{{AuditType}} by {{ActorType}} with {{ComplianceRisk}} risk"
103+
alertTacticsColumnName: SecurityImplications
104+
alertSeverityColumnName: ComplianceRisk
105+
incidentConfiguration:
106+
createIncident: true
107+
groupingConfiguration:
108+
enabled: true
109+
reopenClosedIncident: false
110+
lookbackDuration: P1D
111+
matchingMethod: Selected
112+
groupByEntities:
113+
- Account
114+
groupByAlertDetails:
115+
- AuditType
116+
- ActorGuid
117+
groupByCustomDetails:
118+
- SecurityImpact
119+
- ComplianceRisk
120+
- ActorType
121+
eventGroupingSettings:
122+
aggregationKind: AlertPerResult
123+
suppressionEnabled: false
124+
suppressionDuration: PT30M
125+
version: 2.0.3
126+
kind: Scheduled

0 commit comments

Comments
 (0)