"
104 | $sp = Get-MgServicePrincipal -Filter "displayName eq '$app_name'"
105 |
106 | # Get the user to assign, and the service principal for the app to assign to
107 | $params = @{
108 | "PrincipalId" =$userId
109 | "ResourceId" =$sp.Id
110 | "AppRoleId" =($sp.AppRoles | Where-Object { $_.DisplayName -eq $app_role_name }).Id
111 | }
112 |
113 | # Assign the user to the app role
114 | New-MgUserAppRoleAssignment -UserId $userId -BodyParameter $params |
115 | Format-List Id, AppRoleId, CreationTime, PrincipalDisplayName,
116 | PrincipalId, PrincipalType, ResourceDisplayName, ResourceId
117 | ```
118 |
119 | ### 1.2.5 Enterprise Gov't Roles and Permissions Pt 2
120 |
121 | Use MS Graph PowerShell to check for federated domains:
122 | ```
123 | $fdomains = @($(Get-MgDomain | ?{$_.AuthenticationType -eq "Federated"}))[0]
124 | if ($fdomains) {
125 | $sts = Get-MgDomainFederationConfiguration -DomainId $fdomains.id;
126 | Write-Host "Federated domain ($($fdomains.id)) is using STS $($sts.IssuerUri)." -ForegroundColor Red
127 | } else {
128 | Write-Host "Pass: No federated domains found." -ForegroundColor Green
129 | }
130 | ```
131 |
132 |
133 |
134 |
135 |
136 |
--------------------------------------------------------------------------------
/DeviceTagging.md:
--------------------------------------------------------------------------------
1 | ```
2 | # Install necessary modules
3 | if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
4 | Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force
5 | }
6 | if (-not (Get-Module -ListAvailable -Name AzureAD)) {
7 | Install-Module AzureAD -Scope CurrentUser -Force
8 | }
9 |
10 | # Import modules
11 | Import-Module Microsoft.Graph.Authentication
12 | Import-Module AzureAD
13 |
14 | # Connect to Microsoft Graph using device authentication
15 | Connect-MgGraph -Scopes Application.Read.All, AppRoleAssignment.ReadWrite.All -UseDeviceAuthentication
16 |
17 | # Connect to Azure AD module (required for Get-AzureADServicePrincipal)
18 | Connect-AzureAD
19 |
20 | # Define the name of the Managed Identity
21 | $miName = "MDEDeviceTaggingtest"
22 | Write-Host "Searching for Managed Identity: $miName..."
23 |
24 | # Attempt to retrieve the Managed Identity (Service Principal)
25 | $managedIdentity = Get-AzureADServicePrincipal -Filter "displayName eq '$miName'"
26 |
27 | # Fallback: Ask for ObjectId if not found
28 | if ($null -eq $managedIdentity) {
29 | $miObjectId = Read-Host -Prompt "Managed Identity not found. Enter ObjectId manually:"
30 | } else {
31 | $miObjectId = $managedIdentity.ObjectId
32 | }
33 |
34 | # The app ID of the Microsoft Graph API where we want to assign the permissions
35 | $appId = "fc780465-2017-40d4-a0c5-307022471b92"
36 | $permissionsToAdd = @("Machine.ReadWrite.All")
37 |
38 | # Get the service principal for the target application
39 | $app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"
40 |
41 | # Assign each required permission to the Managed Identity
42 | foreach ($permission in $permissionsToAdd) {
43 | Write-Host "Assigning permission: $permission"
44 |
45 | # Find the matching AppRole in the service principal
46 | $role = $app.AppRoles | Where-Object { $_.Value -eq $permission -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
47 |
48 | if ($null -eq $role) {
49 | Write-Warning "Permission $permission not found in the application's AppRoles."
50 | continue
51 | }
52 |
53 | # Assign the role to the managed identity
54 | New-AzureADServiceAppRoleAssignment -ObjectId $miObjectId `
55 | -PrincipalId $miObjectId `
56 | -ResourceId $app.ObjectId `
57 | -Id $role.Id
58 | }
59 |
60 | # Disconnect sessions
61 | Disconnect-MgGraph
62 | Disconnect-AzureAD
63 | ```
64 |
--------------------------------------------------------------------------------
/EntraIDAssessment.md:
--------------------------------------------------------------------------------
1 | ## Microsoft Entra ID Assessment - Azure Monitor Agent
2 |
3 | Prerequisites.
4 |
5 |
6 | ## Getting Started - Info Call Out!
7 | Work with your CSAM on the [Getting Started w/ On-Demand Assessments](https://learn.microsoft.com/en-us/services-hub/unified/health/getting-started-with-on-demand-assessments). A few call outs that are on that link that should be mentioned here.
8 | Use the following checklist to ensure all steps in this section are completed before moving onto the next section.
9 |
10 | ***Azure Subscription*** - *Assessment person needs OWNER on the subscription and an email associated with that user account.*
11 | ***Services Hub Registration*** - *From prior, CSAM needs to invite that same OWNER w/ an associated email.*
12 | ***Link Azure Subscription and Log Analytics Workspace to Services Hub*** - *You will see this under your account icon>Edit Log Analytics Workspace.*
13 |
14 | You will negate these next two call outs that are on the link above and proceed with the build out.
15 | - Add the assessment(s) in Services Hub
16 | - Provide access to Log Analytics workspace
17 |
18 | ## Begin here!
19 |
20 |
21 | 1. Create Resource Group: 'Assessment'.
22 | 2. Create Log Analytics Workspace in Assessment RG: 'Assessment-LAW'.
23 | 3. Create AzureVM (Server 22): 'Assessment'.
24 | 4. Turn on "Enable Systemd Assigned Managed Identity", while building the VM, under the management blade. Verify after deployment it is enabled.
25 |
26 | 
27 |
28 | 
29 |
30 |
31 |
On-Demand Assessment Machine Configuration.
34 |
35 |
36 | ## Machine Configuration
37 |
38 | Log in as local administrator to the virtual machine.
39 |
40 | 1. Verify Endpoints.
41 |
42 | *Domain Environment - Required Azure Service Endpoints*
43 |
44 | | Endpoint | Desciprtion |
45 | | :--- | :----: |
46 | |management.azure.com | Azure Resource Manager|
47 | login.windows.net | Azure Active Directory|
48 | dc.services.visualstudio.com | Application Insights|
49 | agentserviceapi.azure-automation.net | Guest Configuration|
50 | *-agentservice-prod-1.azure-automation.net | Guest Configuration|
51 | *.his.hybridcompute.azure-automation.net | Hybrid Identity Service|
52 |
53 | 2. Utilize Test-NetConnection.
54 |
55 | ```
56 | tnc management.azure.com -Port 443;
57 | tnc login.windows.net -port 443;
58 | tnc dc.services.visualstudio.com -port 443;
59 | tnc agentserviceapi.azure-automation.net -port 443
60 | ```
61 | 3. Patch the OS and reboot. *Disclaimer - .NET 4.8 is required. Server 2022 comes with this framework by default*.
62 |
63 | 4. Create folder directory. 'C:\Assessment\Entra'
64 | 5. Turn off IE EnchancedMode.
65 | 6. Start -> Run -> gpedit.msc-> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Log on as a batch job -> Add Adminstrators.
66 | 7. Start -> Run -> gpedit.msc-> Computer Configuration -> Administrative Template -> system -> user profile ->Do not forcefully unload the users registry at user logoff -> Click Enable.
67 | 8. Run PowerShell as Administrator and install four modules on the Assessment Server - DO NOT MISS THIS STEP!
68 | ```
69 | Install-Module Microsoft.Graph -Verbose -AllowClobber -Force
70 | Install-Module Msonline -verbose -allowclobber -force
71 | Install-Module AzureRM -verbose -allowclobber -Force
72 | Install-Module AzureADPreview -verbose -allowclobber -Force
73 | ```
74 | 9. Reboot and proceed.
75 |
76 |
Services Hub Configuration.
79 |
80 |
81 | ## Services Hub Configuration
82 |
83 | 1. Log into Services Hub and add your log analytics workspace.
84 |
85 | 2. Add the Azure AD Assessment.
86 |
87 | 3. Add the VM and the assessment path you used from the previous step. Installation will begin.
88 | 
89 |
90 | 4. The installation creates a Data Collection Rule, named 'Azure DCR Rule'.
91 |
92 | 5. Verify you see AzureAssessment, AssessmentPlatform AND AzureMonitorWindowsAgent
93 | 
94 |
95 | 6. Take note and if you see the extensions are out of date, STOP and update (select extensions what need updating and click update). Updates available will look like below, pay close attention to what version is available and use that number to replace the code below.
96 | 
97 |
98 | EXAMPLE code is below, if you want/have to do manually. You must first uninstall the extension then install using Azure PowerShell CLI.
99 | ```
100 | Set-AzVMExtension -ResourceGroupName "Assessment" `
101 | -VMName "Assessment" `
102 | -Name "AssessmentPlatform" `
103 | -Publisher "Microsoft.ServicesHub" `
104 | -ExtensionType "AssessmentPlatform" `
105 | -TypeHandlerVersion "4.5"
106 |
107 | Set-AzVMExtension -ResourceGroupName "Assessment" `
108 | -VMName "Assessment" `
109 | -Name "AzureAssessment" `
110 | -Publisher "Microsoft.ServicesHub" `
111 | -ExtensionType "AzureAssessment" `
112 | -TypeHandlerVersion "1.9"
113 | ```
114 |
115 | 8. After DCR kick off from Step #3 a new folder will be created on C:\ called 'ODA'. Leave this folder alone as it is reserved for system.
116 |
117 |
Create Assessment Application.
121 |
122 |
123 | ## Create 'Microsoft Assessment' Application
124 |
125 | 1. Verify that you have the Azure subscription Owner role on the Azure subscription on the same email ID that you use to login into Services Hub. Review [Linking Permissions](https://learn.microsoft.com/en-us/services-hub/unified/health/assessments-troubleshooting-ama#linking-and-permissions).
126 |
127 | 2. Create Application, reviewed [here](https://learn.microsoft.com/en-us/services-hub/unified/health/getting-started-entraid#setup-the-microsoft-microsoft-entra-id-assessment-on-the-data-collection-machine). Authentication to Entra as Global Administrator*- you will be prompted for MFA and after setup, you must consent to the application permissions. See application permissions that will be delegated [here](https://learn.microsoft.com/en-us/services-hub/unified/health/getting-started-microsoftassessmentapplication/permission-requirements).
128 | 3.
129 | 4. When prompted for the Subscription boundary. Chose only the subscription where the assessment VM resides. This step sets READER permission for the application service principal on the subscription.
130 |
131 | ```
132 | New-MicrosoftAssessmentsApplication -allowclobber -force
133 | ```
134 | If there are URL restrictions in place in order to correctly setup the assessment application, you will need to ensure you whitelist the
135 | following URLs:
136 |
137 | | Endpoint | Port |
138 | | :--- | :----: |
139 | | aadcdn.msauth.net|443|
140 | az818661.vo.msecnd.net|443|
141 | c.urs.microsoft.com|443|
142 | go.microsoft.com|443|
143 | iecvlist.microsoft.com|443|
144 | ieonline.microsoft.com|443|
145 | login.microsoftonline.com|443|
146 | oneget.org|443|
147 | psg-prod-eastus.azureedge.net|443|
148 | www.powershellgallery.com|443|
149 |
150 |
Create Scheduled Task.
153 |
154 |
155 | 1. Create Scheduled Task - run this task as the local admin with computername\localadmin as shown below.
156 | ```
157 | Add-AzureAssessmentTask -WorkingDirectory C:\Assessment\Entra -ScheduledTaskUsername Assessment\xadmin
158 | ```
159 | 2. Verify the Scheduled Task
160 | 
161 |
162 | 3. Right-Click the ST and click run. Adjust or remove schedule if needed. VM should be powered off between assessments.
163 |
164 | 4. After the ST has been kicked off. The C:\Assessment\Entra folder will being to populate with a numerical folder.
165 |
166 |
Verifying Data.
169 |
170 |
171 |
172 | ## Verifying Data to the Log Analytics Workspace ##
173 |
174 | ```
175 | //Viewing Failed Recommendation Results
176 | AzureAssessmentRecommendation
177 | | where TimeGenerated > ago (30d) //set time
178 | | where RecommendationResult contains ''
179 | | summarize count() by RecommendationResult, ['Week Starting']=startofweek(TimeGenerated)
180 | | sort by ['Week Starting'] desc, RecommendationResult asc
181 | ```
182 | 2. Once confirmed, you will see data trickle in over the next few hours populate in ServicesHub.
183 |
184 | 
185 |
186 |
Summary and Delivery.
190 |
191 |
192 | In ServicesHub, go to the Primary Navigation and select IT Health, then choose On-Demand Assessments. On the Assessments page, select the assessment and then click Download Executive Summary or Download All Recommendations to view the reports. Provide these to your CSA for the final review and delivery of the Assessment, along with any remediation tasks that will be assigned to you.
193 |
194 |
Troubleshooting.
197 |
198 |
199 | https://learn.microsoft.com/en-us/services-hub/unified/health/assessments-troubleshooting-ama#linking-and-permissions
200 |
201 | As of 11/7/2024, after upgrading the extensions to 4.5 and 1.9 there is a known issue of the AzureAssessment.execpkg being removed from the C:\ODA\Pakages folder. Before proceeding, please do the following.
202 |
203 | 1. Copy the AzureAssessment.execpkg file from "C:\Packages\Plugins\Microsoft.ServicesHub.AzureAssessment\1.9\bin" to "C:\ODA\Packages"
204 | 2. Proceed once confirmed you have copied this file. Again, COPY not CUT.
205 |
206 | 6. Install the Azure Monitor Agent Extension on the newly created VM (this can be seen from the Extensions blade on the VM). Run the below command from the Azure Portal PowerShell and verify.
207 |
208 | **!!DO NOT MISS THIS STEP!!**
209 |
210 | 
211 | ```
212 | Connect-AzAccount -UseDeviceAuthentication
213 | Set-AzVMExtension -Name AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName Assessment -VMName Assessment -Location EastUS -TypeHandlerVersion 1.0 -EnableAutomaticUpgrade $true
214 | ```
215 |
216 | ```
217 | Clear-MicrosoftAssessmentsApplication -IncludeAADApplication $true
218 | ```
219 |
Prerequisites.
7 |
8 |
9 | The [prerequisites](https://docs.microsoft.com/en-us/defender-for-identity/prerequisites) are pretty straight forward and have been updated. Please read this thoroughly for Customers in US Government, here is your [doc](https://docs.microsoft.com/en-us/defender-for-identity/us-govt-gcc-high). *Disclaimer* - depending on your govt environment, you may have to allow *atp.azure.us through your proxy instead *.atp.azure.com, just be aware.
10 |
11 | Test your prerequisites [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/prerequisites#test-your-prerequisites).
12 |
13 | Plan for capacity [here](https://docs.microsoft.com/en-us/defender-for-identity/capacity-planning).
14 |
15 |
Windows Event Collecting.
18 |
19 |
20 | Please review [Configure Windows Event Collection](https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection).
21 |
22 | In January 2024, Microsoft introduced a streamlined method for deploying 'Audit Policies' for Microsoft Defender for Identity using the PowerShell module 'DefenderForIdentity'. An overview is posted [here](https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/introducing-the-new-powershell-module-for-microsoft-defender-for/ba-p/4028734). This module simplifies the 'Auditing' setup compared to manual configuration.
23 |
24 | For improved clarity, a detailed guide has been created by [MSFTAdvocate](https://www.msftadvocate.com/configure-audit-policies-for-microsoft-defender-for-identity/). Please review this resource before proceeding to the next steps to ensure a coherent understanding of the process.
25 |
26 | In order to proceed please install the module (Install-Module DefenderForIdentity) OR manunally download from [PSGallery](https://www.powershellgallery.com/packages/DefenderForIdentity/1.0.0.0) on the Domain Controller OR on another Tier0 asset server.
27 |
28 | ***Note: The DefenderForIdentity module requires the ActiveDirectory and the GroupPolicy modules to be installed on the server. It is also advised against modifying default Group Policy Objects (GPOs), such as Default Domain Controllers or Default Domain GPOs. Instead, each operating system should adhere to its own hardened baseline, incorporating appropriate WMI filters. This also applies to Domain Controllers, which should use dedicated GPOs. As an administrator, it is crucial to ensure that the Group Policy Object precedence is correctly configured and functioning as intended.***
29 |
30 | ***Note: When using the MDIConfiguration module, it will create separate Group Policy Objects (GPOs). It is advisable to leave these policies unchanged, regardless of your existing baselines.***
31 |
32 |
33 | **1** - *Set Domain Controller Advanced Audit Policy.* Review [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection#configure-auditing-for-domain-controllers).
34 | ```
35 | Set-MDIConfiguration -Mode Domain -Configuration AdvancedAuditPolicysDCs
36 | ```
37 |
38 | **2** - *Set Domain Controller NTLM Auditing.* Review [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection#configure-ntlm-auditing).
39 | ```
40 | Set-MDIConfiguration -Mode Domain -Configuration NTLMAuditing
41 | ```
42 |
43 | **3** - *Configure Domain Object Auditing.* Review [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection#configure-domain-object-auditing).
44 | ```
45 | Set-MDIConfiguration -Mode Domain -Configuration DomainObjectAuditing
46 | ```
47 |
Configure Auditing on Configuration Container.
50 |
51 |
52 | ***1*** - *Configure auditing on the configuration container.* Review [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection#configure-auditing-on-the-configuration-container
53 | ).
54 |
55 | ```
56 | Set-MDIConfiguration -Mode Domain -Configuration ConfigurationContainerAuditing
57 | ```
58 |
59 |
Configure Directory Service Account.
62 |
63 |
64 | Review [Directory Service Account Recommendations](https://docs.microsoft.com/en-us/defender-for-identity/directory-service-accounts).
65 |
66 | ***Note: For optimal security, it is recommended to use a Group Managed Service Account (gMSA).***
67 |
68 |
69 | **1** - *Create Sensor Group.*
70 | ```
71 | $SensorGroup = 'MDISensors'
72 | $SensorGroupDesc = 'Members are allowing MDI gMSA attribute of -PrincipalsAllowedtoRetrieveManagedPassowrd.'
73 | New-ADGroup -Name $SensorGroup `
74 | -Path "OU=Groups,OU=Tier0,DC=gcccyberlorian,DC=net" `
75 | -GroupScope 'Universal' `
76 | -GroupCategory 'Security'
77 | ```
78 |
79 | **2** - *Create Group Managed Service Account.*
80 | ```
81 | $Identity= 'MDIgMSA' #The name of the gMSA to be created
82 | $Description = "MDI group managed service account"
83 | $DNS = 'MDIgMSA.gcccyberlorians.net' #This is the gmsa dns hostname
84 | $Principal = Get-ADGroup $SensorGroup #Setting attribute for MDI Sensor to -PrincipalsAllowedtoRetrieveManagedPassowrd.
85 | $Kerb = 'AES128,AES256' #2016 and above OS STIG level - verify encryption used in env.
86 | New-ADServiceAccount -Name $Identity `
87 | -Description $Description `
88 | -DNSHostName $DNS `
89 | -ManagedPasswordIntervalInDays 30 `
90 | -PrincipalsAllowedToRetrieveManagedPassword $Principal `
91 | -Enabled $True `
92 | -KerberosEncryptionType $Kerb `
93 | -PassThru
94 | ```
95 | **3** - *Set all Domain Controllers to be members of Sensor Group.*
96 | ```
97 |
98 | $sourceGroupName = "Domain Controllers"
99 | $targetGroupName = $SensorGroup
100 |
101 | # Retrieve the distinguished name (DN) of the source and target groups
102 | $sourceGroup = Get-ADGroup -Identity $sourceGroupName
103 | $targetGroup = Get-ADGroup -Identity $targetGroupName
104 |
105 | if ($sourceGroup -and $targetGroup) {
106 | # Get all members of the source group
107 | $members = Get-ADGroupMember -Identity $sourceGroup.DistinguishedName
108 |
109 | # Add each member to the target group
110 | foreach ($member in $members) {
111 | Add-ADGroupMember -Identity $targetGroup.DistinguishedName -Members $member.SamAccountName
112 | }
113 |
114 | Write-Output "All members of '$sourceGroupName' have been added to '$targetGroupName'."
115 | } else {
116 | Write-Output "One or both of the specified groups could not be found."
117 | }
118 | ```
119 |
120 | **4** - *Set gMSA $Identity with [permission](https://learn.microsoft.com/en-us/defender-for-identity/deploy/create-directory-service-account-gmsa#verify-that-the-gmsa-account-has-the-required-rights).*
121 |
122 | ***Note: Add this to the Domain Controller OS-Based STIG, and if using it in conjunction with ADFS/CA, also include it in the ADFS/CA OS-Based STIG. I cannot stress how crucial this step is. In the past, this step was omitted from current documentation, but I am pleased it has now been added. However, it remains an easy oversight. Without this in place, nothing will work.***
123 |
124 | **5** - *Test gMSA 'LogOnAsAService' permission after policy set in Step 4.*
125 | ```
126 | Get-ADServiceAccount -Identity $Identity -Properties * | select Prin*
127 | Test-ADServiceAccount -Identity $Identity
128 | ```
129 |
130 |
Grant Directory Service Account permissions on all objects (READ).
133 |
134 |
135 |
136 | **1** - *Declare the identity that you want to add read access to the deleted objects container.*
137 | ```
138 | $Identity = 'MDIgMSA'
139 | ```
140 |
141 | ***2*** - *Create a group and add the gMSA to it to configure permissions for the group and incorporate the gMSA within..*
142 | ```
143 | $groupName = 'MDIDeletedObjRead'
144 | $groupDescription = 'Members of this group are allowed to read the objects in the Deleted Objects container in AD'
145 | if(Get-ADServiceAccount -Identity $Identity -ErrorAction SilentlyContinue) {
146 | $groupParams = @{
147 | Name = $groupName
148 | SamAccountName = $groupName
149 | DisplayName = $groupName
150 | GroupCategory = 'Security'
151 | GroupScope = 'Universal'
152 | Description = $groupDescription
153 | }
154 | $group = New-ADGroup @groupParams -PassThru
155 | Add-ADGroupMember -Identity $group -Members ('{0}$' -f $Identity)
156 | $Identity = $group.Name
157 | }
158 |
159 | # Get the deleted objects container's distinguished name:
160 | $distinguishedName = ([adsi]'').distinguishedName.Value
161 | $deletedObjectsDN = 'CN=Deleted Objects,{0}' -f $distinguishedName
162 |
163 | # Take ownership on the deleted objects container:
164 | $params = @("$deletedObjectsDN", '/takeOwnership')
165 | C:\Windows\System32\dsacls.exe $params
166 |
167 | # Grant the 'List Contents' and 'Read Property' permissions to the user or group:
168 | $params = @("$deletedObjectsDN", '/G', ('{0}\{1}:LCRP' -f ([adsi]'').name.Value, $Identity))
169 | C:\Windows\System32\dsacls.exe $params
170 |
171 | # To remove the permissions, uncomment the next 2 lines and run them instead of the two prior ones:
172 | # $params = @("$deletedObjectsDN", '/R', ('{0}\{1}' -f ([adsi]'').name.Value, $Identity))
173 | # C:\Windows\System32\dsacls.exe $params
174 | ```
175 |
Configure SAM-R for lateral movement.
178 |
179 |
180 | ***Note: This is a DENY Group Policy Object to Domain Controllers. On a STIG level, you could add these settings to each OS based or standalone GPO at the top level down. Plan according on this (layout).***
181 |
182 | ***1*** - *Configure SAM-R required permissions [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/remote-calls-sam#configure-sam-r-required-permissions).*
183 |
184 | ***2*** - *Configure DENY for Domain Controllers on the GPO.*
185 |
186 | 
187 |
188 |
Sensor Installation.
191 |
192 |
193 | ***Note: Before installing the sensor it is important to add the gMSA (DSA) to the 'Directory Service Accounts' blade in the XDR portal.***
194 |
195 | ***1*** - *[Configure the gMSA in 365 Defender](https://docs.microsoft.com/en-us/defender-for-identity/directory-service-accounts#configure-directory-service-account-in-microsoft-365-defender).*
196 |
197 | 
198 |
199 | ***2*** - *Download the [sensor](https://docs.microsoft.com/en-us/defender-for-identity/download-sensor).*
200 |
201 | ***3*** - *Test Connectivity to Defender for Identity (check again). If failure, refer to [Test Connectivity](https://learn.microsoft.com/en-us/defender-for-identity/deploy/test-connectivity).*
202 | ```
203 | Test-MDISensorApiConnection
204 | ```
205 |
206 | ***4*** - *Install Sensor [setup](https://learn.microsoft.com/en-us/defender-for-identity/deploy/install-sensor).*
207 |
208 |
Additional Scenarios.
211 |
212 |
213 | Continue to follow on with addition scenarions listed [here](https://learn.microsoft.com/en-us/defender-for-identity/deploy/active-directory-federation-services).
214 |
215 |
90 | -If you are going via a proxy, check the doc [here](https://docs.microsoft.com/en-us/defender-for-identity/configure-proxy).
91 | -After extracting the contents, install Npcap first - DO NOT MISS THIS STEP!
92 | -Install the [sensor](https://docs.microsoft.com/en-us/defender-for-identity/install-sensor), see the Prerequisites. As I stated above, install the Npcap driver first before the sensor install. Or, Pcap will install.
93 |
94 | Once installation has completed. Check the MDI portal and see the health of your sensor. If you have followed each step all should be well.
95 |
96 | Now go connect MDI/365 to Sentinel and be complete!
97 |
98 |
99 |
100 |
101 |
102 |
103 |
--------------------------------------------------------------------------------
/MISPTISetup.md:
--------------------------------------------------------------------------------
1 | ## MISP Open Source Threat Intelligence Platform to Microsoft Sentinel. Authored by: Matt Larkin and Michael Crane. ##
2 |
3 | After the announcement of the free, LIMO Threat Intelligence injestion was deemed to be End of Life. Many of us have been after a replacement. This guide will associate a cost, check cost workbook, and a VM cost. However, it will have an automated process of TI into your Sentinel instance. See MISP [here](https://www.misp-project.org/).
4 |
5 |
6 | *Pre-req* - Create a Ubuntu VM, I am using Azure for this use case. Don't need anything crazy to keep the cost low for this use case. Being this is owned by the SecOps team, the VM lives within my SecOps subscription in Azure.
7 |
8 | *Disclaimer* - You can use the default account that is created when you stand up the server, initially or create a user called MISP. Regardless, a user account named 'MISP' will be created during the install. I chose to use my default admin account and then change the password later for RDP access.
9 |
10 | ## This installs the MISP TI Platform
11 |
12 | ```
13 | # Ssh to the new Ubuntu VM. The following commands can be copied and pasted into the ssh session.
14 |
15 | # Update/Upgrade System, if needed.
16 | sudo apt-get update -y && sudo apt-get upgrade -y
17 |
18 | # Reboot
19 | sudo systemctl reboot
20 |
21 | # Please check the installer options first to make the best choice for your install
22 | wget -O /tmp/INSTALL.sh https://raw.githubusercontent.com/MISP/MISP/2.4/INSTALL/INSTALL.sh
23 | bash /tmp/INSTALL.sh
24 |
25 | # This will install MISP Core - Install will pause to create user MISP, chose yes to run as MISP.
26 | wget -O /tmp/INSTALL.sh https://raw.githubusercontent.com/MISP/MISP/2.4/INSTALL/INSTALL.sh
27 | bash /tmp/INSTALL.sh -c
28 | ```
29 |
30 | ## Copy the content from the output in a notepad/shared file, temporarily. You need the AuthKey.
31 |
32 | This key can be pulled later by: cat /home/misp/MISP-authkey.txt
33 |
34 | 
35 |
36 |
37 | ```
38 | # Now, create a local password for MISP user. I chose to wait until AFTER the script ends.
39 | sudo passwd misp
40 |
41 | # Install Xfce4 Desktop.
42 | sudo DEBIAN_FRONTEND=noninteractive apt-get -y install xfce4
43 | sudo apt install xfce4-session
44 |
45 | # Install XRDP.
46 | sudo apt-get -y install xrdp
47 | sudo systemctl enable xrdp
48 | sudo ufw allow 3389
49 | sudo service xrdp restart
50 | sudo adduser misp ssl-cert
51 | echo xfce4-session >~/.xsession
52 | sudo service xrdp restart
53 |
54 | # Install Firefox Browser - this needs to be installed to configure MISP to Sentinel Feeds.
55 | sudo apt install firefox -y
56 |
57 | ```
58 |
59 | # Configure MISP TI Platform
60 |
61 | 1. RDP to the Ubuntu server with the MISP user created during the MISP install.
62 |
63 | 2. Log into the server as seen below. The default username and password were provided earlier.
64 |
65 | 
66 |
67 | 3. Enter default password will prompt you to change the password
68 |
69 | 4. After logging in, navigate to 'Sync Actions'>'List Feeds'. Select both default feeds, enable and cache. Once done, click 'Fetch and store all feed data'. These two are by default, you can add more from the proper MISP website [here](https://www.misp-project.org/feeds/).
70 |
71 | .
72 |
73 | 5. Retrieve your key from earlier. if you forgot - cat /home/misp/MISP-authkey.txt, hang on to it!
74 |
75 | ## Create AAD App Reg in Azure AD.
76 |
77 | 1. Open the Application Registration Portal and click New registration on the menu bar.
78 | 2. Enter a name, and choose Register, other options can be left with their defaults.
79 | 3. Note down the Application (client) ID and Directory (tenant) ID. You will need to enter these into the script’s configuration file.
80 | 4. Under Certificates & secrets, click New client secret enter a description and click Add. A new secret will be displayed. Copy this for later entry into the script.
81 | 5. Under API permissions, choose Add a permission > Microsoft Graph.
82 | 6. Under Application Permissions, add ThreatIndicators.ReadWrite.OwnedBy.
83 | .
84 |
85 | ## Enable the Sentinel Connector
86 | Open your Azure Sentinel workspace, click ‘Data connectors’ and then look for the ‘Threat Intelligence Platforms’ connection. Open the connector and click Connect.
87 | 
88 |
89 | ## Setup the script for MISP-Sentinel API Calls. RDP as MISP first.
90 |
91 | 1. Run the below script.
92 |
93 | ```
94 | sudo apt-get install python3-venv
95 | python3 -m venv mispToSentinel
96 | cd mispToSentinel
97 | source bin/activate
98 | git clone https://github.com/microsoftgraph/security-api-solutions
99 | cd security-api-solutions/Samples/MISP/
100 | pip3 install requests requests-futures pymisp
101 | nano config.py
102 | ```
103 | 2. After opening config.py, edit the file as seen below, replacing with your information. Remember your Auth Key is at: cat /home/misp/MISP-authkey.txt
104 |
105 | 
106 |
107 | 3. Use CTRL+O to write-out, save and CTRL-X to exit.
108 |
109 | 4. Run the following now to sync the feeds to Sentinel.
110 | ```
111 | python3 script.py
112 | ```
113 | Confirm ingestion by navigating to the TI workbook in Sentinel.
114 |
115 | 
116 |
117 | ## Cron job setup.
118 |
119 | Below is a CRONTAB entry example of running the script every day at midnight. You can use the generator [here](https://crontab-generator.org/).
120 | ```
121 | * 0 * * * home/misp/mispToSentinel/security-api-solutions/Samples/python3 script.py >/dev/null 2>&1
122 | ```
123 |
124 |
--------------------------------------------------------------------------------
/MaliciousActivityandSentinelP1.md:
--------------------------------------------------------------------------------
1 | ## Part-1: Malicious traffic in Sentinel. ##
2 |
3 | *Disclaimer* - Per the Executive Order, M-21-31, [page 16](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf) states that NSG flow logs are to be captured and lists the retention settings. If you are using the workbook in Sentinel, look at (EL0)>IDS/IPS section to view the call out. This entire series follows that mandate as well as others. Don't forget to navigate with the [Maturity Model for Event Log Management (M-21-31) Workbook for Microsoft Sentinel](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336).
4 |
5 | *Pre-req* - Network Watcher and Storage account. I personally would keep the NetworkWatcher and storage account used in this situation under the SOC/Infosec resource group.
6 |
7 | I hope I caught your attention with the title. Now that I have your attention, how do we capture the "bad" traffic hitting our environment. We do this by creating an [NSG](https://docs.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-policy-portal) (network security group) Flow Log to [Traffic Analyitcs](https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-policy-portal) and send them off to Sentinel. This is an important note: You can accomplish NSG Flow Logs & Traffic Anayltics Azure Policy by using **"Configure network security groups to use specific workspace, storage account and flowlog retention policy for traffic analytics"**, so use the latter and call it a day. Pre-reqs you will need an azure storage account for the flow logs and to enable [NetworkWatcher](https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-create).
8 |
9 | *Disclaimer* - By default "Retention (days)" on the Flow logs settings is set to 30 with this new policy. Think about how you want to set this, in this case, because I am going to Sentinel I am going to set to 1 day as Sentinel/LAW is my retention.
10 |
11 | ### Configure network security groups to use specific workspace, storage account and flow log retention policy for traffic analytics - by Azure Policy ###
12 | Some quick notes on the image below. The parameters call for "ID" - you can find this ID by going to the resource, overview tab, resource JSON and pull the ResourceID string). Enter the parameters below and hit next to Remediation tab.
13 | 1. Parameter 1 - DeployifNotExists
14 | 2. Parameter 2 - Chose NSG Region. The NSG, NetworkWatcher and storage account need to be same.
15 | 3. Parameter 3 - Storage ResourceID of the storage account.
16 | 4. Parameter 4 - Unchecking the "only show parameters" will allow you to pick 10 or (default 60).
17 | 5. Parameter 5 - Sentinel ResourceID (json view) - obtain the workspace ID for the Sentinel Log Analytics Workspace.
18 | 6. Parameter 6 - Chose Workspace Region.
19 | 7. Parameter 7 - Sentinel WorkspaceID - This is Sentinels LAW WorkspaceID NOT ResourceID.
20 | 8. Parameter 8 - Set the Network Watcher Resource Group where Network Watcher resides.
21 | 9. Parameter 9 - Set the NAME of the Network Watcher (within the same region in Network Watcher RG).
22 | 10. Parameter 10 - Set the Number of days to retain flowlogs.
23 |
24 | 
25 |
26 | The next step will consist of creating a remediation task. Caveat and pleast take note! In order for this to work the managed identity has to have permissions at the highest tier of what you are setting and sending to Sentinel LAW. I.e., Do not set a one subscription and expect the policy to write on another subscrition where the parameters are set. Once completed, hit review and save.
27 | 1. Create a remediation task
28 | 2. Create a system assigned managed identity
29 |
30 | 
31 |
32 | **Verifying Azure Traffic Analytics has made it to Sentinel.**
33 | 1. Navigate to Sentinel LAW.
34 | 2. Type "AzureNetworkAnalytics_CL" as seen below.
35 | 3. Please read more detail on [Traffic Analytics Schema](https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-schema).
36 |
37 | 
38 |
39 | **Verifying Azure Traffic Analytics is capturing data and you are receiving proper traffic and visualization.**
40 | 1. For demo purposes the malicious RED is botnet activity.
41 |
42 | 
43 |
44 |
45 |
46 | ## [Continue to Part-2: Malicious traffic in Sentinel](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP2.md). ##
--------------------------------------------------------------------------------
/MaliciousActivityandSentinelP2.md:
--------------------------------------------------------------------------------
1 | ## Part-2: Malicious traffic in Sentinel. ##
2 |
3 | In [Part-1](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP1.md) of this series I showed you how to connect NSG Flow logs with Network Watcher, Traffic Analytics and sending it all to the final destination of Sentinel. Ok, so where do we go from here? First, lets focus on what we did in [Part-1](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP1.md). The last picture I displayed was Traffic Analyitcs, so let us focus there for a minute. Head on over to the Network Watcher we setup, then Traffic Analytics. Disclaimer: I have malicious traffic ONLY because I have a honeypot with allowed traffic - do this at your own risk. However and a big however, this very well could be you or your customers environment. Remember in Part-1 when I stated I had a customer with a bad NSG? Well, this is how it went down in real time and I am just playing out the steps for you all, step by step.
4 |
5 | The image below, in my environment you see my honeypot allowing botnets into my environment (Malicious = RED) on the overview page. I recommend learning this blade as much as possible as you can go pretty deep in the weeds. Click on "View Map" under "Deployed Azure Regions" and it will bring up the heat map.
6 |
7 | 
8 |
9 | This image is the heat map of my malicious activity. I can enhance this as much as I would like by clicking on any of the endpoints, connecting the dots and clicking on any of the fields at the top menu.
10 |
11 | 
12 |
13 | Head back to the main Traffic Analytics blade now and click on "Malicious IPs", where the red arrow is pointing.
14 |
15 | 
16 |
17 | That last step I had you do has led you to the log analytics workspace of Sentinel. Are the pre-reqs starting to make sense? What you are seeing below is a KQL query from the flow logs of 'MaliciousFlow' with IP, PublicIp, Location, ThreatType and Description. Yup! Those are Botnets and NO they should NOT be overlooked as "Oh, those are just botnets doing probing against our environment". You're going to see why.
18 |
19 | 
20 |
21 | I recommend, and at your own risk, stand up a honeypot in your own environment. Rod Trent had posted this [honeypot](https://thoor.tech/blog/rdp-honeypot-ms-sentinel-workbook/?WT.mc_id=modinfra-00000-rotrent) article on behalf of Pierre Thoor. So, that has saved me from doing a full write up and I thank them. The article is wonderful and you should follow it. However, for my "Malicious traffic in Sentinel" series just stand up a VM with an NSG allowing any/any in. Keep in mind though, this series is not only to help you learn in your environment but to take these steps in each part of the series and use on any production tenant. Flip a quarter and that is your chance on seeing Malicious traffic in your production environments you are supporting.
22 |
23 | In conclusion of Part-2, I hope you are starting to get the visualization of where I am about to bring you. Hang on because it's about to get nuts.
24 |
25 | ## [Continue to Part-3: Malicious traffic in Sentinel](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP3.md) ##
--------------------------------------------------------------------------------
/MaliciousActivityandSentinelP3.md:
--------------------------------------------------------------------------------
1 | ## Part-3: Malicious traffic in Sentinel. ##
2 |
3 | [Part-2](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP2.md) showed us how bring together Traffic Analytics and malicious activity in Network Watcher as well as sending the logs to Sentinels LAW. Let's start getting into the juicy data.
4 |
5 | What I want you to do next is open your Sentinel workspace, navigate to Workbooks add "Azure Network Watcher" and save it.
6 |
7 | 
8 |
9 | Navigate back to the Workbook in Sentinel and open it up. I am only going to focus on the Malicious IP activity but please navigate through this work as it will show NIC, VM, Traffic flows, Attached resources, NSGs being attacked and etc. Please navigate to "Malicious Actors" in the workbook. Here we see Malicious IPs and allowed IN (please dig into this workbook and get a feel for it).
10 |
11 | 
12 |
13 | Lets just get into Sentinel already! We need a rule to trigger an alert, don't we? This workbook nor Traffic Analytics does that by default. So, I have one ready to [go](https://github.com/Cyberlorians/Sentinel/blob/main/Analytic%20Rules/Custom%20-%20Malicious%20IP%20Allowed%20IN.json) to eliminate any FPs (False Positives). How did I start that query rule? Well, navigate back to "Network Watcher>Traffic Analytics", and click the RED inblound.
14 |
15 | 
16 |
17 | Now, we see the basics of [my analytic rule](https://github.com/Cyberlorians/Sentinel/blob/main/Analytic%20Rules/Custom%20-%20Malicious%20IP%20Allowed%20IN.json) and your upcoming analytic rule.
18 |
19 | 
20 |
21 | Lets head to Part-4
22 | ## [Continue to Part-4: Malicious traffic in Sentinel](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP4.md) ##
--------------------------------------------------------------------------------
/MaliciousActivityandSentinelP4.md:
--------------------------------------------------------------------------------
1 | ## Part-4: Malicious traffic in Sentinel. ##
2 |
3 | [Part-3](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP3.md) showed us Network Watcher workbook, the basics of "Malicious Actors", and AzureNetworkAnalytics_CL custom log showing inbound flows. Lets get right into the nitty gritty and import the playbook first, then the analytic rule. The playbook you will import is called "IP2GEOComments", which will add comments to the Malicious traffic incident. The comments will be IP origin and IP information.
4 |
5 | In the Azure Portal, search for Custom Deployment and "Build your own template in the editor".
6 |
7 | 
8 |
9 | Paste the content from [IP2GEOComments](https://github.com/Cyberlorians/Sentinel/blob/main/Playbooks/IP2GEOComments.json), hit apply and continue to create on the next step of the deployment.
10 |
11 | Disclaimer: You MAY or SHOULD chose to use the [IP2GEOComments-Incidents Playbooks](https://github.com/Cyberlorians/Sentinel/blob/main/Playbooks/IP2GEOComments-Incident.json)
12 |
13 | 
14 |
15 | 
16 |
17 | After the playbook has imported we need to configure permissions for the logic app. Disclaimer: the logic app runs as a mananged identity but will need Microsoft Sentinel Responder permissions. To begin, navigate to your new IP2GEOComments logic app and go to "Identity" tab. You should see the status is "On". Now click on "Azure Role Assignments".
18 |
19 | 
20 |
21 | After clicking on "Azure Role Assignments" tab, click "Add role assignment (Preview). Chose your subscription, resource group and Role as shown in the image. Disclaimer: for this setup the only option is to set the permissions at the same resource group for "Microsoft Sentinel Responder" permission as the most least privilege assignment. You can set the SAME permission at the Sentinel Log Analytics Workspace for more granularity. After adding, save the permissions.
22 |
23 | 
24 |
25 | Back on the left hand side of the logic app blade, head to "API Connections" and you will see the the API connection that is associated with the logic app.
26 |
27 | 
28 |
29 | Click on the API connection and double check that it is in a ready state.
30 |
31 | 
32 |
33 | Lastly, go back to the left hand side of the logic app and under "Development Tools", chose "Logic app designer". Open each step and verify that the managed identity is connected. It should be but if it is not, chose "Change connection" and add the managed identity that is associated with the logic app.
34 |
35 | 
36 |
37 | On to the next step which is the Analytical rule. Open your Sentinel workspace and navigate to Anayltics. Click on import and import [Custom - Malicious IP Allowed IN](https://github.com/Cyberlorians/Sentinel/blob/main/Analytic%20Rules/Custom%20-%20Malicious%20IP%20Allowed%20IN.json) rule.
38 |
39 | 
40 |
41 | That was easy, right? Now, that we have the rule imported, click "Edit" on your new rule. Disclaimer: you may edit this rule now or later based on your preferences.
42 |
43 | 
44 |
45 | In the Analytics rule wizard, navigate to "Automated Reponse" tab and under "alert automation", add the new IP2GEOComments playbooks. Click review and then save.
46 |
47 | 
48 |
49 | If you have followed all steps and you are indeed having malicious traffic inbound your rule will kick off and the playbook will add comments as seen below.
50 |
51 | 
52 |
53 | Disclaimer: Again, you may chose to use the [IP2GEOComments-Incidents Playbooks](https://github.com/Cyberlorians/Sentinel/blob/main/Playbooks/IP2GEOComments-Incident.json), here as well with the same type of setup. Just make sure it is connected with the managed identity and the api is ready to roll.
54 |
55 | Cool huh! I think so too but we could use a bit more detail on those IPs. Following the SAME steps as above, deploy [Get-VirusTotalIPReport](https://github.com/Cyberlorians/Sentinel/blob/main/Playbooks/Get-VirusTotalIPReport.json). I adjusted this playbook from the Sentinel community to run as a managed identity AND who will have "whois" data. Disclaimer: and you CANNOT miss this step. Please sign up a [VirusTotal](https://www.virustotal.com/gui/home/upload) which is free for the API Key and on the logic app designer connector you will have to enter your api-key, name and update. *Disclaimer* - the logic app needs managed identity permissions of "Microsoft Sentinel Responder". It is best to put the logic app within the same resource group as Sentinel/LAW.
56 |
57 | Once deployed, you will see three API connectors. Listed below.
58 |
59 | 1 - "azureloganalyticsdatacollector-Get-VirusTotalIPReport" - Edit API connect and Enter the WorkspaceID and WorkspaceKey. Click SAVE.
60 | 2 - "virustotal-Get-VirusTotalIPReport" - Edit API connect and Enter your new "x-api_key". Click SAVE.
61 | 3 - "azuresentinel-Get-VirusTotalIPReport" - This connector is the managed identity connector piece. So, for this one go back to to the logic app>identity blade and give it the "Microsoft Sentinel Responder" Role on the Sentinel LAW. Once that is complete just verify this API states it is "Ready".
62 |
63 | Head back to Seninel and on the Incident, scroll over and click on the ellipsis and chose "Run Playbook (Preview)"
64 |
65 | 
66 |
67 | Chose the new, "Get-VirusTotalIPReport" and click "Run".
68 |
69 | 
70 |
71 | Go back into your new incident and under the comments section you will see any and all Virus Total IP Reports.
72 |
73 | 
74 |
75 | To sum this all up. You now have IP2GEOComments which will auto run when an incident triggers AND you now have the ability to run Get-VirusTotalIPReport for FREE. Disclaimer: you can run the Virus Total playbook on any investigation of your choice now.
76 |
77 | Lets head to Part-5
78 | ## [Continue to Part-5: Malicious traffic in Sentinel - Summary Rules](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP5.md) ##
79 |
80 | ## [Back to Part-1: Malicious traffic in Sentinel](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP1.md) ##
81 | ## [Back to Part-2: Malicious traffic in Sentinel](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP2.md) ##
82 | ## [Back to Part-3: Malicious traffic in Sentinel](https://github.com/Cyberlorians/Articles/blob/main/MaliciousActivityandSentinelP3.md) ##
83 |
--------------------------------------------------------------------------------
/MaliciousActivityandSentinelP5.md:
--------------------------------------------------------------------------------
1 | ## Part-5: Malicious traffic in Sentinel - Summary Rules. ##
2 |
3 | Flow logs can become quite detailed, particularly when an open port is allowing incoming malicious activity. To manage this, we can use Summary Rules to consolidate and focus on the Allowed Malicious IN activity. What exactly are Summary Rules?
4 |
5 | Per [Microsoft](https://learn.microsoft.com/en-us/azure/sentinel/summary-rules) on Summary Rules.
6 |
7 | Use summary rules in Microsoft Sentinel to aggregate large sets of data in the background for a smoother security operations experience across all log tiers. Summary data is precompiled in custom log tables and provide fast query performance, including queries run on data derived from low-cost log tiers. Summary rules can help optimize your data for:
8 |
9 | - Analysis and reports, especially over large data sets and time ranges, as required for security and incident analysis, month-over-month or annual business reports, and so on.
10 |
11 | - Cost savings on verbose logs, which you can retain for as little or as long as you need in a less expensive log tier, and send as summarized data only to an Analytics table for analysis and reports.
12 |
13 | - Security and data privacy, by removing or obfuscating privacy details in summarized shareable data and limiting access to tables with raw data.
14 |
15 | Let’s create a Summary Rule to focus on only ‘Allowed-IN’
16 |
17 | 1 - Enter the following below.
18 |
19 | 
20 |
21 | 2- Enter the KQL logic below into the snippet you see below. You can adjust the Query scheduling to your liking or default.
22 |
23 | ```
24 | AzureNetworkAnalytics_CL
25 | | where SubType_s == 'FlowLog' and FlowType_s == 'MaliciousFlow'
26 | | where AllowedInFlows_d == 1
27 | | summarize make_set(SrcIP_s), make_set(FlowType_s) by AllowedInFlows_d, DestIP_s, NSGList_s, DestPort_d
28 | ```
29 |
30 | 
31 |
32 | 3 - Review & Create.
33 |
34 | 
35 |
36 | 4 - Review the new Summary Rule data.
37 |
38 | ```
39 | MaliciousIN_CL
40 | | where _RuleName == "MaliciousIN"
41 | | project-away _BilledSize, _BinSize, _RuleLastModifiedTime, _RuleName, _BinStartTime, TenantId, Type
42 | ```
43 |
44 |
45 | 
46 |
--------------------------------------------------------------------------------
/ODA.md:
--------------------------------------------------------------------------------
1 | 1 - Getting Started with On-Demand Assessment
2 |
3 |
4 | This will auto expand but able to expand back. Verbiage from here ![https://learn.microsoft.com/en-us/services-hub/unified/health/getting-started-windows-client]. Needs to be streamlined and cleaned up with snippets at each step.
5 |
6 |
9 | 2 - Configure Microsoft On-Demand Assessments MAIN TITLE
10 | All items from current ODA need to lie here, GPO, Network, OS etc and consolidated as a point back for the "On-Demand Assessments".
11 |
12 |
13 | 2.1 - System and Network Requirements
14 |
28 |
41 |
42 |
48 |
55 |
56 |
57 |
58 |
59 | Working with Results
60 |
61 |
62 | Troubleshooting
65 |
66 |
67 | Configure Microsoft On-Demand Assessment Collector
72 |
73 | *** This section could be in the "Configuration main section if all assessments are equal. ***
74 |
75 |
76 | 1. Create Resource Group: 'Assessment'.
77 | 2. Create Log Analytics Workspace in Assessment RG: 'Assessment'.
78 | 3. Create Azure Virtual Machine (Server 22): 'Assessment'.
79 | 4. Turn on "Enable Systemd Assigned Managed Identity", while building the virtual machine, under the management blade. Verify after deployment it is enabled.
80 |
81 | 
82 |
83 | 
84 |
85 | 6. Install the Azure Monitor Agent Extension on the newly created virtual machine (this can be seen from the Extensions blade on the VM). Run the below command from the Azure Portal PowerShell and verify.
86 |
87 | **!!DO NOT MISS THIS STEP!!**
88 |
89 | 
90 | ```
91 | Connect-AzAccount -UseDeviceAuthentication
92 | Set-AzVMExtension -Name AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName Assessment -VMName Assessment -Location EastUS -TypeHandlerVersion 1.0 -EnableAutomaticUpgrade $true
93 | ```
94 |
95 |