Learn how to customize and optimize Copilot for Security with the custom Data Security plugin

by Contributed | Aug 21, 2024 | Technology

This article is contributed. See the original author and article here.

This is a step-by-step guided walkthrough of how to use the custom Copilot for Security pack for Microsoft Data Security and how it can empower your organization to understand the cyber security risks in a context that allows them to achieve more. By focusing on the information and organizational context to reflect the real impact/value of investments and incidents in cyber. We are working to add this to our native toolset as well, we will update once ready.

Prerequisites

• License requirements for Microsoft Purview Information Protection depend on the scenarios and features you use. To understand your licensing requirements and options for Microsoft Purview Information Protection, see the Information Protection sections from Microsoft 365 guidance for security & compliance and the related PDF download for feature-level licensing requirements. You also need to be licensed for Microsoft Copilot for Security, more information here.


• Consider setting up Azure AI Search to ingest policy documents, so that they can be part of the process.

Step-by-step guided walkthrough

In this guide we will provide high-level steps to get started using the new tooling. We will start by adding the custom plugin.

1. Go to securitycopilot.microsoft.com


2. Download the DataSecurityAnalyst.yml file from here.


3. Select the plugins icon down in the left corner.

4. Under Custom upload, select upload plugin.

5. Select the Copilot for Security plugin and upload the DataSecurityAnalyst.yml file.

6. Click Add


7. Under Custom you will now see the plug-in

 The custom package contains the following prompts

 Under DLP you will find this if you type /DLP

Under Sensitive you will find this if you type sensitive

Let us get started using this together with the Copilot for Security capabilities

• Anomalies detection sample.


• Access to sensitive information by compromised accounts.


• Document accessed by possible compromised accounts.


• CVE or proximity to ISP/IPTags.


• Tune Exchange DLP policies sample.


• Purview unlabelled operations.


• Applications accessing sensitive content.


• Hosts that are internet accessible accessing sensitive content


• Exchange incident sample prompt book.


• SharePoint sample prompt book.

Anomalies detection sample

The DLP anomaly is checking data from the past 30 days and inspect on a 30m interval for possible anomalies. Using a timeseries decomposition model.

The sensitivity content anomaly is using a slightly different model due to the amount of data. It is based on the diffpatterns function that compares week 3,4 with week 1,2.

Access to sensitive information by compromised accounts.

This example is checking the alerts reported against users with sensitive information that they have accessed.

Who has accessed a Sensitive e-mail and from where?

We allow for organizations to input message subject or message Id to identify who has opened a message. Note this only works for internal recipients.

You can also ask the plugin to list any emails classified as Sensitive being accessed from a specific network or affected of a specific CVE.

Document accessed by possible compromised accounts.

You can use the plugin to check if compromised accounts have been accessing a specific document.

CVE or proximity to ISP/IPTags

This is a sample where you can check how much sensitive information that is exposed to a CVE as an example. You can pivot this based on ISP as well.

Tune Exchange DLP policies sample.

If you want to tune your Exchange, Teams, SharePoint, Endpoint or OCR rules and policies you can ask Copilot for Security for suggestions.

Purview unlabelled operations

How many of the operations in your different departments are unlabelled?  Are any of the departments standing out?

In this context you can also use Copilot for Security to deliver recommendations and highlight what the benefit of sensitivity labels are bringing.

Applications accessing sensitive content.

What applications have been used to access sensitive content? The plugin supports asking for applications being used to access sensitive content. This can be a fairly long list of applications, you can add filters in the code to filter out common applications.

If you want to zoom into what type of content a specific application is accessing.

What type of network connectivity has been made from this application?

Or what if you get concerned about the process that has been used and want to validate the SHA256?

Hosts that are internet accessible accessing sensitive content

Another threat vector could be that some of your devices are accessible to the Internet and sensitive content is being processed. Check for processing of secrets and other sensitive information.

Promptbooks

Promptbooks are a valuable resource for accomplishing specific security-related tasks. Consider them as a way to practically implement your standard operating procedure (SOP) for certain incidents. By following the SOP, you can identify the various dimensions in an incident in a standardized way and summarize the outcome. For more information on prompt books please see this documentation.

Exchange incident sample prompt book

Note: The above detail is currently only available using Sentinel, we are working on Defender integration.

SharePoint sample prompt book

Posts part of this series

• Cyber Security in a context that allows your organization to achieve more
  https://techcommunity.microsoft.com/t5/security-compliance-and-identity/cyber-security-in-a-context-that-allows-your-organization-to/ba-p/4120041


• Guided walkthrough of the Microsoft Purview extended report experience https://techcommunity.microsoft.com/t5/security-compliance-and-identity/guided-walkthrough-of-the-microsoft-purview-extended-report/ba-p/4121083 


• How to build the Microsoft Purview extended report experience https://techcommunity.microsoft.com/t5/security-compliance-and-identity/how-to-build-the-microsoft-purview-extended-report-experience/ba-p/4122028 

Comprehensive coverage and cost-savings with Microsoft Sentinel’s new data tier

by Contributed | Aug 20, 2024 | Technology

This article is contributed. See the original author and article here.

As digital environments grow across platforms and clouds, organizations are faced with the dual challenges of collecting relevant security data to improve protection and optimizing costs of that data to meet budget limitations. Management complexity is also an issue as security teams work with diverse datasets to run on-demand investigations, proactive threat hunting, ad hoc queries and support long-term storage for audit and compliance purposes. Each log type requires specific data management strategies to support those use cases. To address these business needs, customers need a flexible SIEM (Security Information and Event Management) with multiple data tiers.

Microsoft is excited to announce the public preview of a new data tier Auxiliary Logs and Summary Rules in Microsoft Sentinel to further increase security coverage for high-volume data at an affordable price.  

Auxiliary Logs supports high-volume data sources including network, proxy and firewall logs. Customers can get started today in preview with Auxiliary Logs today at no cost. We will notify users in advance before billing begins at $0.15 per Gb (US East). Initially Auxiliary Logs allow long term storage, however on-demand analysis is limited to the last 30 days.  In addition, queries are on a single table only.  Customers can continue to build custom solutions using Azure Data Explorer however the intention is that Auxiliary Logs cover most of those use-cases over time and are built into Microsoft Sentinel, so they include management capabilities. 

Summary Rules further enhance the value of Auxiliary Logs. Summary Rules enable customers to easily aggregate data from Auxiliary Logs into a summary that can be routed to Analytics Logs for access to the full Microsoft Sentinel query feature set. The combination of Auxiliary logs and Summary rules enables security functions such as Indicator of Compromise (IOC) lookups, anomaly detection, and monitoring of unusual traffic patterns. Together, Auxiliary Logs and Summary Rules offer customers greater data flexibility, cost-efficiency, and comprehensive coverage. 

Some of the key benefits of Auxiliary Logs and Summary Rules include: 

• Cost-effective coverage: Auxiliary Logs are ideal for ingesting large volumes of verbose logs at an affordable price-point. When there is a need for advanced security investigations or threat hunting, Summary Rules can aggregate and route Auxiliary Logs data to the Analytics Log tier delivering additional cost-savings and security value.  

• On-demand analysis: Auxiliary Logs supports 30 days of interactive queries with limited KQL, facilitating access and analysis of crucial security data for threat investigations. 

• Flexible retention and storage: Auxiliary Logs can be stored for up to 12 years in long-term retention. Access to these logs is available through running a search job. 

Microsoft Sentinel’s multi-tier data ingestion and storage options 

Microsoft is committed to providing customers with cost-effective, flexible options to manage their data at scale. Customers can choose from the different log plans in Microsoft Sentinel to meet their business needs. Data can be ingested as Analytics, Basic and Auxiliary Logs. Differentiating what data to ingest and where is crucial. We suggest categorizing security logs into primary and secondary data.  

• Primary logs (Analytics Logs): Contain data that is of critical security value and are utilized for real-time monitoring, alerts, and analytics. Examples include Endpoint Detection and Response (EDR) logs, authentication logs, audit trails from cloud platforms, Data Loss Prevention (DLP) logs, and threat intelligence.  
  
  
  
  • Primary logs are usually monitored proactively, with scheduled alerts and analytics, to enable effective security detections.  
  
  
  • In Microsoft Sentinel, these logs would be directed to Analytics Logs tables to leverage the full Microsoft Sentinel value. 
  
  
  • Analytics Logs are available for 90 days to 2 years, with 12 years long-term retention option. 
  
  
  
  

• Secondary logs (Auxiliary Logs): Are verbose, low-value logs that contain limited security value but can help draw the full picture of a security incident or breach. They are not frequently used for deep analytics or alerts and are often accessed on-demand for ad-hoc querying, investigations, and search.  
  
  
  
  • These include NetFlow, firewall, and proxy logs, and should be routed to Basic Logs or Auxiliary Logs. 
    
    
    
    • Auxiliary logs are appropriate when using Log Stash, Cribl or similar for data transformation. 
    
    
    • In the absence of transformation tools, Basic Logs are recommended.  
    
    
    
    
  
  
  • Both Basic and Auxiliary Logs are available for 30 days, with long-term retention option of up to 12 years. 
  
  
  • Additionally, for extensive ML, complex hunting tasks and frequent, extensive long-term retention customers have the choice of ADX. But this adds additional complexity and maintenance overhead. 
  
  
  
  

Microsoft Sentinel’s native data tiering offers customers the flexibility to ingest, store and analyze all security data to meet their growing business needs.  

Use case example: Auxiliary Logs and Summary Rules Coverage for Firewall Logs 

Firewall event logs are a critical network log source for threat hunting and investigations. These logs can reveal abnormally large file transfers, volume and frequency of communication by a host, and port scanning. Firewall logs are also useful as a data source for various unstructured hunting techniques, such as stacking ephemeral ports or grouping and clustering different communication patterns.  

In this scenario, organizations can now easily send all firewall logs to Auxiliary Logs at an affordable price point. In addition, customers can run a Summary Rule that creates scheduled aggregations and route them to the Analytics Logs tier. Analysts can use these aggregations for their day-to-day work and if they need to drill down, they can easily query the relevant records from Auxiliary Logs. Together Auxiliary Logs and Summary Rules help security teams use high volume, verbose logs to meet their security requirements while minimizing costs. 

Figure 1: Ingest high volume, verbose firewall logs into an Auxiliary Logs table. 

Figure 2: Create aggregated datasets on the verbose logs in Auxiliary Logs plan.  

Customers are already finding value with Auxiliary Logs and Summary Rules as seen below: 

“The BlueVoyant team enjoyed participating in the private preview for Auxiliary logs and are grateful Microsoft has created new ways to optimize log ingestion with Auxiliary logs. The new features enable us to transform data that is traditionally lower value into more insightful, searchable data.” 

Mona Ghadiri 

Senior Director of Product Management, BlueVoyant 

“The Auxiliary Log is a perfect fusion of Basic Log and long-term retention, offering the best of 
both worlds. When combined with Summary Rules, it effectively addresses various use cases for ingesting large volumes of logs into Microsoft Sentinel.” 

Debac Manikandan 

Senior Cybersecurity Engineer, DEFEND 

Looking forward 

Microsoft is committed to expanding the scenarios covered by Auxiliary Logs over time, including data transformation and standard tables, improved query performance at scale, billing and more. We are working closely with our customers to collect feedback and will continue to add more functionality. As always, we’d love to hear your thoughts.  

Learn more 

• Log retention plans in Microsoft Sentinel | Microsoft Learn 

• Plan costs and understand pricing and billing – Microsoft Sentinel | Microsoft Learn 

• What’s new in Microsoft Sentinel | Microsoft Learn 

• Reduce costs for Microsoft Sentinel | Microsoft Learn 

• When to use Auxiliary Logs in Microsoft Sentinel | Microsoft Learn 

• Aggregate Microsoft Sentinel data with summary rules | Microsoft Learn 

• Set up a table with the Auxiliary plan for low-cost data ingestion and retention in your Log Analytics workspace – Azure Monitor | Microsoft Learn 

• Microsoft Sentinel Pricing | Microsoft Azure 

OneDrive community call | August 2024 | Join in

by Contributed | Aug 19, 2024 | Technology

This article is contributed. See the original author and article here.

Are you ready to connect with OneDrive product makers this month? We’re gearing up for the next call. And a small FYI, we are approaching production a little different: The call broadcasts from the Microsoft Tech Community, within the OneDrive community hub. Same value. Same engagement. New and exciting home.

Join the OneDrive product team live each month on our monthly OneDrive Community Call (previously ‘Office Hours’) to hear what’s top of mind, get insights into roadmap updates, and dig into a special topic. Each call includes live Q&A where you’ll have a chance to ask the OneDrive product team any question about OneDrive – The home of your files.

 Use this link to register and join live: https://aka.ms/OneDriveCommunityCall. Each call is recorded and made available on demand shortly after. Our next call is Wednesday, August 21st, 2024, 8:00am – 9:00am PDT. This month’s special topic: “Copilot in OneDrive” with @Arjun Tomar, Senior Product Manager on the OneDrive team at Microsoft. “Add to calendar” (.ics file) and share the event page with anyone far and wide.

OneDrive Community Call – August 21, 2024, 8am PDT. Special guest, Arjun Tomar, to share more about our special topic this month: “Copilot in OneDrive.”

Our goal is to simplify the way you create and access the files you need, get the information you are looking for, and manage your tasks efficiently. We can’t wait to share, listen, and engage – monthly! Anyone can join this one-hour webinar to ask us questions, share feedback, and learn more about the features we’re releasing soon and our roadmap.

Note: Our monthly public calls are not an official support tool. To open support tickets, go to see Get support for Microsoft 365; distinct support for educators and education customers is available, too.

Stay up to date on Microsoft OneDrive adoption on adoption.microsoft.com. Join our community to catch all news and insights from the OneDrive community blog. And follow us on Twitter: @OneDrive. Thank you for your interest in making your voice heard and taking your knowledge and depth of OneDrive to the next level.

You can ask questions and provide feedback in the event Comments below and we will do our best to address what we can during the call. 
 Register and join live: https://aka.ms/OneDriveCommunityCall 

See you there, Irfan Shahdad (Principal Product Manager – OneDrive, Microsoft)