Workplace Analytics October 2020 feature updates

by Contributed | Oct 9, 2020 | Technology

This article is contributed. See the original author and article here.

The Workplace Analytics team is excited to announce our feature updates for October 2020. (You can see past blog articles here). This month’s update describes one enhancement to a query type and one preview of a major coming attraction:  

• Feature preview: Workplace Analytics Home page update  


• New attributes in ONA person-to-person queries  

Feature preview: Workplace Analytics Home page update

In mid-November of this year, Workplace Analytics will offer a series of research-based business outcomes that will show how your organization gets work done. This update to the Home page of Workplace Analytics lets you select from nine business outcomes to see how your business is doing right now and see recommended best practices that are available to help drive change for the good, moving forward.  

Business outcomes

Each of the nine outcomes is described on its own page that shows you analysis about your organization and research-based suggestions on how to maintain or drive change toward business success.  

• Enhance organizational resiliency – Small changes to collaboration practices can have transformative effects on organizational productivity at scale.  


• Boost employee engagement – Employees with high job satisfaction and a strong sense of belonging are more likely to produce high-quality work, identify business opportunities and remain at the organization.  


• Improve agility – Companies that redefine industries and lead markets are less bureaucratic and nimbly adapt to rapid changes in technology and customer needs.  


• Foster innovation – Employees who share information, prioritize learning, and protect time for deep thinking generate the new ideas needed for success in rapidly evolving markets.  


• Develop effective managers – Managers have a large impact on employee engagement, development, and performance, and are pivotal for driving organizational change.  


• Maximize operational effectiveness – Small changes to collaboration practices can have transformative effects on organizational productivity at scale.  


• Accelerate change – Slow adoption of new technology harms efforts to attract and retain top talent, improve productivity, and can lead to market failure.  


• Transform meeting culture – Meetings are essential for collaboration; however, unnecessary meetings and bad practices can harm engagement and limit productivity.  


• Increase customer focus – Companies that prioritize customer relationships and satisfaction grow revenue faster than competitors.  

On the card for each insight, you’ll see supporting evidence that links you to related information. This information includes Microsoft Workplace Insights that were researched and written by industry experts, and studies about organizations that have effectively used Workplace Analytics to improve their business outcomes. 

On each behavior page, a Take action section lets you select Find out more to see the most effective actions you can do now to drive positive change in your organization. For example, the Boost employee engagement behavior offers a “Best practices” page called Increase frequency of coaching: 

This page gives you recommendations for implementing these best practices – in this case, for example, by scheduling recurring 1:1 meetings and by enhancing manager coaching through MyAnalytics.

Who can use these insights?

You can view all of these insights if you have the analyst or limited analyst role of Workplace Analytics. If you are a people manager, you can only see insights about your own team; for more information, see Workplace Analytics Home for people managers. 

To request early access

If you want early access to the organizational insights, complete the Home page update preview form and we’ll follow up to discuss activation with you. 

New attributes in ONA person-to-person queries

The recently released Network: Person-to-person query lets analysts measure the quality of connections between people. In particular, it measures strong ties, when two people have many connections in common, and diverse ties, when they share fewer connections but nevertheless work closely together.  

We’ve added two new columns to the existing output of this query.  

• TieOrigin_GroupId 


• TieDestination_GroupId 

These columns can be used to aggregate members of a team. Their values are based on the organizational hierarchy data that admins upload to Workplace Analytics. In each of these metrics, the value of GroupId is a unique, de-identified, identifier that’s the same for members of the same team – in other words, they all report to one particular person in the organizational hierarchy.  

These columns are useful for looking up the existence of strong ties within a team to understand how cohesive that team is. They are also useful for looking up the existence of Diverse ties within a team to understand if there is an opportunity for novel information to flow into the team. For more information, see ONA person-to-person queries. 

What's new: New Fusion detections and BYOML in public preview!

by Contributed | Oct 9, 2020 | Technology

This article is contributed. See the original author and article here.

This installment is part of a broader series to keep you up to date with the latest features in Azure Sentinel. The installments will be bite-sized to enable you to easily digest the new content.

This blog is a collaboration between myself and my colleague, Sreedhar Ande.

What truly sets Azure Sentinel apart from other SIEM tools or other security solutions in the market is the extensive use of machine learning to fuel built-in analytics and custom machine learning models. These capabilities are the culmination of decades of research and experience protecting Microsoft services at massive scale by Microsoft security experts. As you might already be aware, Microsoft Ignite 2020 announcements highlighted some of the most recent innovations in this space.

We are delighted to announce that 32 new Fusion detections and Build Your Own Machine Learning framework are now available in public preview! Below has a recap of what these features are and how they work.

Fusion Detections

What is Fusion technology in Azure Sentinel?

Using machine learning, Fusion detections combine low- and medium-severity alerts from Microsoft and 3^rd-party security products into high-severity incidents. By design, these incidents are low-volume, high-fidelity, and high-severity. Here is an example of how a Fusion incident looks like in Azure Sentinel portal.

Fusion incident

The main goals of Fusion detections can be summarized into two points.

• Fusion detects threats that fly under radar: Azure Sentinel can automatically detect multistage attacks by identifying combinations of anomalous behaviors and suspicious activities that are observed at various stages of the kill-chain. On the basis of these discoveries, Azure Sentinel generates incidents that would otherwise be difficult to catch. 


• Alert fatigue reduction: Fusion incorporates graph-based machine learning and a probabilistic kill chain to reduce alert fatigue by 90 percent.

For more details of how Fusion technology works behind the scene, please check out this excellent article by our colleague, Ram Shankar Siva Kumar.

What are the new Fusion detections?

Our Fusion team recently released 32 new Fusion detections in public preview, reaching a total of 70 Fusion incident types which are turned on by default in Azure Sentinel. These additional detections fall into eight scenario types.

MDATP + Palo Alto Network firewall:

1. Suspicious remote WMI execution followed by anomalous traffic flagged by Palo Alto Networks firewall


2. Suspected use of attack framework followed by anomalous traffic flagged by Palo Alto Networks firewall

AAD IP + MCAS:

1. Suspicious inbox manipulation rules set following suspicious Azure AD sign-in (5 distinct detections)


2. Multiple VM creation activities following suspicious Azure Active Directory sign-in (5 distinct detections)


3. Multiple VM delete activities following suspicious Azure AD sign-in (5 distinct detections)


4. Suspicious email deletion activity following suspicious Azure AD sign-in (5 distinct detections)


5. Multiple Power BI report sharing activities following suspicious Azure AD sign-in (5 distinct detections)


6. Suspicious Power BI report sharing following suspicious Azure AD sign-in (5 distinct detections)

How to enable and use Fusion detections

Under Analytics blade in Azure Sentinel portal, in your Active Rules view, a built-in rule of Fusion rule type named “Advanced Multistage Attack Detection” is enabled by default for all Sentinel workspaces. You have the option to disable the rule any time. There is no extra cost to use this detection rule on top of the normal data ingestion and storage cost. All you need for the rule to work is to have your data connectors configured and data ingested correctly. To see what data connector sources are required for each Fusion incident type, please refer to the documentation.

To get step-by-step instructions about Fusion in Azure Sentinel, please refer to our documentation, which has been revamped with updated detection descriptions, now includes MITRE ATT&CK Tactics and Techniques, and is now organized by threat classifications for easier navigation.

Build Your Own Machine Learning (BYO-ML)

Many security organizations understand the value of machine learning for security, though not many of them have the luxury of professionals who have expertise in both security and ML. We designed the framework Build-Your-Own ML (BYO-ML) for security organizations and professionals to grow with us in their ML journey. Organizations new to ML, or without the necessary expertise, can get significant protection value out of Azure Sentinel’s built-in ML capabilities.

ML detection models can adapt to individual environments and to changes in user behavior, to reduce false positives and identify threats that would not be found with a traditional approach. Azure Sentinel makes it easier for data scientists in these organizations to unlock these insights with a BYO-ML framework.

ML levels

What is the Build Your Own Machine Learning (BYO-ML) platform?

For organizations that have ML resources and would like to build customized ML models for their unique business needs, we offer the BYO-ML platform. The platform makes use of the Azure Databricks/Apache Spark environment and Jupyter Notebooks to produce the ML environment. It provides the following components:

• A BYO-ML package, which includes libraries to help you access data and push the results back to Log Analytics (LA), so you can integrate the results with your detection, investigation, and hunting.


• ML algorithm templates for you to customize to fit specific security problems in your organization.


• Sample notebooks to train the model and schedule the model scoring.

Besides all this, you can bring your own ML models, and/or your own Spark environment, to integrate with Azure Sentinel.

For more details on BYO-ML platform, please check out this excellent blog by our colleague, Andi Comisioneru. For supported use cases, please refer to the documentation.

How to use Build Your Own Machine Learning (BYO-ML) platform

To build custom ML models on your data, you have two options.

1. For smaller amounts of data, like alerts and anomalies, you can use Azure ML to run models hosted in the Azure Sentinel Notebooks (new menu option currently in Preview). Azure Machine Learning offers Intellisense for improved ease of use, support for existing Jupyter and JupyterLab experiences, as well as point-in-time notebook snapshots and a notebook file explorer for easy notebook collaboration. Dedicated compute and multiple pricing options provide increased flexibility and control. Take advantage of built-in security analytics via MSTICPy and Jupyter notebook templates help you get started.

Note: To use the Notebooks, you must first create an Azure Machine Learning (ML) workspace. For step-by-step instructions on how to create an Azure Machine Learning (ML) workspace, please refer to the documentation.

2. For development and operationalization of models built on larger data, like analyzing feeds of raw data, you will need to make this data accessible to the ML model in Azure Databricks.

Apache Spark™ provides a unified environment for building big data pipelines. Azure Databricks builds on this environment, providing a zero-management cloud platform, holistically addressing the platform needed for data analysts to develop their custom ML based security analysis.

You can either bring your raw data directly to the Azure Databricks ML environment, via EventHub or Azure Blobs or you can use the capabilities provided with Azure Sentinel, to export the data from Azure Sentinel Log Analytics tables. Regardless of the export methods used for raw data, you can use the libraries provided by BYO-ML framework to import the scoring of the ML model back into Sentinel Log Analytics tables for further processing and creating incidents.

Data flow

You can either set up a new Azure Databricks environment or use one already set up for other use. To set up a new Databricks environment, please refer to the quickstarts document (note that MMLSpark used by our algorithm requires Spark 2.4.5).

On Azure Sentinel roadmap, we plan to support Azure Synapse in addition to Azure Databricks as a BYO-ML development environment.

Get started today!

We encourage you to explore these machine learning innovations in the Azure Sentinel to detect and protect your organization from threats.

Try it out, and let us know what you think!

You can also contribute new Notebooks in Azure Sentinel. Get started now by joining the Azure Sentinel BYOML GitHub community.

Tasks in Microsoft Teams is now generally available!

by Contributed | Oct 9, 2020 | Technology

This article is contributed. See the original author and article here.

We have exciting news that’s more than a year in the making: Tasks in Microsoft Teams desktop is now 100% rolled out to everyone with a Microsoft 365 subscription across all non-government tenants. There’s more information about government cloud availability later in this post. Tasks in Teams lets you manage your team tasks from Planner and individual tasks from To Do in your hub for teamwork.

This announcement also moves us to the next stage in our naming sequence, where the app name in Teams changes to Tasks by Planner and To Do in desktop and Tasks in mobile. We will make this change over a weekend to reduce the likelihood of users seeing different names as the name change rolls out, and we expect to make the change by the end of October. We will make an update to our Message Center post when we kick off this change.

Our team has been working on Tasks in Teams around the clock since we first announced it at Microsoft Ignite 2019—and we couldn’t be more excited to bring it to all our users. Tasks in Teams brings together your team plans and individual tasks into one, collaborative space alongside all your chats, meetings, and files. Task management in the app replicates familiar tools and design from Planner and To Do, so there’s almost nothing new to learn. You can learn more about Tasks in Teams from our support page and public rollout blog post.

We’re also excited to report that Tasks in Teams for the Teams mobile app will soon begin rolling out to all users in non-government clouds and is scheduled to be completed in November.

When the Tasks app becomes available on your iOS or Android device, you can find it within the More (…) option at the bottom of the Teams mobile app interface. There’s nothing to download; Tasks will automatically appear in that menu. The Tasks app for Teams mobile is limited to the List view.

We’re working to make Tasks in Teams available for our government cloud offerings, with GCC going live in the coming months. GCC High and DoD will follow after that. We’ll keep you posted about those releases and any initial limitations soon.

In other news, we announced at Ignite that you will soon be able to create tasks from Teams chats or channel conversations. This capability is one of the top requests from our users, so we’re excited to bring this to you soon.

This is just the beginning of an exciting few months, so keep checking our Tech Community Blogs site for all the latest news. And if you have feedback or ideas for Tasks in Teams, leave us a note on UserVoice.

******

“Tasks in Microsoft Teams” – The Intrazone podcast

In case you missed it, several members from our team sat down with the hosts of The Intrazone, a biweekly podcast series, to talk about Tasks in Teams and our journey on connecting task experiences across Microsoft 365. You can listen to that conversation below.

https://html5-player.libsyn.com/embed/episode/id/15346253/height/90/theme/custom/thumbnail/yes/direction/forward/render-playlist/no/custom-color/247ad3/

You might also enjoy:

Task management with Microsoft To Do

Protecting organizations from the latest evolution of mobile ransomware

by Contributed | Oct 9, 2020 | Technology

This article is contributed. See the original author and article here.

Microsoft researchers found a sophisticated Android malware that uses novel techniques to display its ransom note. The new malware, the latest variant of variant of a ransomware family that’s been in the wild for a while but has been evolving non-stop, exemplifies the rapid evolution of mobile threats that we have also observed on other platforms. Read our technical analysis here: Sophisticated new Android malware marks the latest evolution of mobile ransomware.

Microsoft Defender for Endpoint on Android detects this ransomware (AndroidOS/MalLocker.B) as well as other malicious apps and files using cloud-based protection powered by deep learning and heuristics, in addition to content-based detection. Microsoft Defender for Endpoint on Android, now generally available, extends Microsoft’s industry-leading endpoint protection to Android. Learn more about our mobile threat defense capabilities in Microsoft Defender for Endpoint on Android.

Threat data from endpoints are combined with signals from email and data, identities, and apps in Microsoft 365 Defender, which orchestrates detection, prevention, investigation, and response across domains, providing coordinated defense. Microsoft Defender for Endpoint on Android further enriches organizations’ visibility into malicious activity, empowering them to comprehensively prevent, detect, and respond to against attack sprawl and cross-domain incidents.

AV1 Hardware Accelerated Video on Windows 10

by Contributed | Oct 9, 2020 | Technology

This article is contributed. See the original author and article here.

This fall, Microsoft’s hardware partners are rolling out hardware accelerated AV1 video support on new Windows 10 systems with the latest GPUs. With video consuming an ever-increasing portion of the world’s internet traffic, better compression technology helps to improve video image quality while also reducing bandwidth consumption. AV1, which is developed by the Alliance for Open Media (AOM), can reach 50% better compression than H.264 and 20% better than VP9 for the same video content. Enabling hardware support for AV1 allows users to get the benefits of this improved video codec, and shifting decode work from software to hardware typically reduces power consumption and increases battery life on mobile devices.

Microsoft co-founded AOM with the goal of creating transformative, , open-source video codecs together with other leading technology companies.

Here are the components required to experience hardware accelerated AV1 video on Windows 10:

• One of these new GPUs or CPUs:
  
  
  
  • 11th Gen Intel Core processors with Intel Iris X^e Graphics 
  
  
  • NVIDIA GeForce RTX 30 Series GPUs
  
  
  • AMD Radeon™ RX 6000 Series Graphics (coming soon)
  
  
  
  


• Windows 10 build 1909 or later


• The AV1 Video Extension


• A web browser or other application with hardware acceleration support for AV1, including apps built on top of Media Foundation


• As is common with new features like this, you may need to update your graphics driver from time to time to get the latest features and improvements.

Once you have those pieces in place, you will see the benefits of hardware accelerated AV1 video as streaming services roll out more video content encoded with AV1.

If you want to look under the hood to see when you are receiving AV1, some streaming services have ways to show this information. For example, on YouTube you can right-click on the video and select “Stats for nerds”. When the video is AV1 encoded, you will see “av01…” in the “Codecs” line on the stats overlay.

To learn even more about AV1, check out AOM’s get started page. There is an open source AV1 decoder implementation, dav1d, developed by VideoLAN and FFmpeg and sponsored by AOM. Windows media developers who are using DirectX may want to look at the AV1 support in DirectX Video Acceleration (DXVA).