Azure Sentinel: Using rule templates

by Contributed | Jan 4, 2021 | Technology

This article is contributed. See the original author and article here.

Microsoft’s Azure Sentinel, our Security Incident and Event Management (SIEM) solution, enables you to connect activity data from different sources into a shared workspace. That data ingestion is just the first step in the process though. The power comes from what you can now do with that data, including investigating incident alerts, building your own dashboards with workbooks, responding to threats with security playbooks and hunting for security threats.

Let’s take a look at some of the built-in rule templates that you can activate, to query and alert on that data.

Built-in rule templates
Your active rules and the list of available rule templates can be found in Azure Sentinel under ConfigurationAnalytics:

Azure Sentinel Analytics menu

The rule templates are published by Microsoft and are updated and added to as new events and threats are detected, classified as low, medium or high severity. There are currently just under 200 rule templates covering 38 different data sources, both from Microsoft and third parties.

Some of the rule templates in Azure Sentinel

Examples

There are rule templates to create incidents in Azure Sentinel based on alerts from Azure Security Center, Office 365 Advanced Threat Protection (Preview) and Microsoft Defender Advanced Threat Protection. This helps you build one place to manage and investigate threats across different Microsoft products.

There are individual rules for Microsoft and non-Microsoft products:

There are also rules that combine more than one product, linking events that could indicate a possible incident: 

And there are rules that detect a known threat from different data sources:

Anatomy of a rule template
As well as a severity and a list of the data source/s for this rule, a description tells you why this rule is important and may give you links to other relevant information.

Azure Sentinel rule template description

The rule type can be:
Microsoft Security – these rules automatically create Azure Sentinel incidents from alerts generated in other Microsoft security products, in real time.
Scheduled – these run periodically based on the settings you configure and allow you to alter the query logic.
ML Behaviour Analytics – these are based on proprietary Microsoft machine learning algorithms, so you can’t see of change the query logic.
Fusion – this detects multistage attacks by identifying combinations of anomalous behaviors and suspicious activities observed at various stages of the kill chain. By design, these incidents are low-volume, high-fidelity, and high-severity, which is why this detection is turned ON by default. For more information on Fusion incident types, visit Advanced multistage attack detection in Azure Sentinel. 

The tactics icons show what kind of threat this rule is related to:
Credential access, command and control, initial access, impact, defence evasion, collection, persistence, lateral movement, privilege escalation.

You can also see the details of the rule query, written in Kusto Query Language (KQL).

Scheduled rules have a frequency, a rule period and a rule threshold, and may allow event grouping, suppression, the creation of incidents from this alert and alert grouping.

Rule template settings for a scheduled rule

Creating a rule from a rule template
To turn a rule template into an active rule for your environment, you just select the Create rule button. With the wizard, you can then customize any rule settings or the rule logic itself (if appropriate) and you will be warned if you don’t have the required data sources connected.

Choosing your rules

Azure Sentinel gives you a very powerful security capability, but it’s up to you to decide how to apply it to your organization. The built-in rule templates are a great start, or you may also choose to build your own queries. Take a look at the data sources across your environment and what security incident and event monitoring tools and processes you already have in place. What in particular do you need to monitor – network attacks? logins of administrative accounts? events from different systems that may be related?

In addition, the Azure security baseline for Azure Sentinel takes guidance from the Azure Security Benchmark‘s security controls.   

Learn more:

MS Learn – Cloud-native security operations with Azure Sentinel

Docs – Tutorial: Detect threats out of the box

Docs – Tutorial: Create custom analytics rules to detect threats

Docs – Extend Azure Sentinel across workspaces and tenants

Certificate rotation Azure Service Fabric Standalone cluster

by Contributed | Jan 4, 2021 | Technology

This article is contributed. See the original author and article here.

To keep Service Fabric cluster running the old certificate are needed to be replaced with new certificates the below steps can help you rotate the old certificate with new certificates. This article assumes you are running cluster with thumbprint approach. In general the common name approach is recommended for easy certificate management. More information about certificate on Standalone cluster refer to Secure a cluster on Windows by using certificates – Azure Service Fabric | Microsoft Docs

Service Fabric with certificates that aren’t expired (cluster running with near expiry or non-expired certificates) 

Important Note: Before you change below config, you should install all certificate on all nodes i.e. New certificate should be present and acled to Network Service before you start this operation on all nodes.

1. Open the Clusterconfig.json file for editing, and find the following section. If a secondary thumbprint is defined, you need to clean up old Service Fabric certificates before you go any further. i.e. trigger an upgrade to remove secondary certificate section first.  

"security": {
    "metadata":  "The Credential type X509 indicates this cluster is secured using X509 Certificates. 
    The thumbprint format is - d5 ec 42 3b 79 cb e5 07 fd 83 59 3c 56 b9 d5 31 24 25 42 64.",
    "ClusterCredentialType":  "X509",
    "ServerCredentialType":  "X509",
    "CertificateInformation":  {
        "ClusterCertificate":  {
                                   "X509StoreName":  "My",
                                    "Thumbprint": "*Old server thumbprint(Star/SF)*"
                               },
        "ServerCertificate":   {
                                    "X509StoreName":  "My",
 									"Thumbprint": "*Old server thumbprint(Star/SF)*"
                               },
        "ClientCertificateThumbprints":  [
                                   {
                                        "CertificateThumbprint": "*Old client thumbprint*",
                                        "IsAdmin":  true
                                   }
                                         ]
                               }
            },

2.  Replace that section in the file with following section.

"security":  {
    "metadata":  "The Credential type X509 indicates this cluster is secured using X509 Certificates. 
    The thumbprint format is - d5 ec 42 3b 79 cb e5 07 fd 83 59 3c 56 b9 d5 31 24 25 42 64.",
    "ClusterCredentialType":  "X509",
    "ServerCredentialType":  "X509",
    "CertificateInformation":  {
        "ClusterCertificate":  {
                                   "X509StoreName":  "My",
                                    "Thumbprint": "*New server thumbprint(Star/SF)*",
                                    "ThumbprintSecondary": "Old server thumbprint(Star/SF)"
                               },
        "ServerCertificate":   {
                                    "X509StoreName":  "My",
 									"Thumbprint": "*New server thumbprint(Star/SF)*",
                                    "ThumbprintSecondary": "Old server thumbprint(Star/SF)"
                               },
        "ClientCertificateThumbprints":  [
                                   {
                                        "CertificateThumbprint": "*Old client thumbprint*",
                                        "IsAdmin":  false
                                   },
                                   {
                                        "CertificateThumbprint": "*New client thumbprint*",
                                        "IsAdmin":  true
                                   }
                                         ]
                               }
            },

{
"name": "myclustername",
"clusterConfigurationVersion": "2.0.0",

# Connect to the Service Fabric cluster
Connect-ServiceFabricCluster

# Get path of ClusterConfig.json for following command
# Note that after running the following command, you need to manually cancel using the red button (Stop Operation) in Windows PowerShell ISE or Ctrl+C in Windows PowerShell, otherwise you will receive the following notification, "Start-ServiceFabricClusterConfigurationUpgrade : Operation timed out.". Be aware that the upgrade will proceed.
Start-ServiceFabricClusterConfigurationUpgrade -ClusterConfigPath ClusterConfig.json

# To monitor the status of the upgrade, run the following 
Get-ServiceFabricClusterUpgrade