A Comprehensive Overview on Microsoft's Cloud SIEM

E-book Microsoft Azure Sentinel Cloud-native security: a comprehensive overview on Microsoft’s cloud SIEM Wortell Enterprise Security Maarten Goet Table of Contents. 1. Not your daddy’s Splunk..................................................................................3 2. Graph Security API. ............................................................................................ 11 3. MITRE ATT&CK and Sigma. ........................................................................19 4. Automating Azure Sentinel. .......................................................................27 5. Machine Learning. ................................................................................................31 6. Dashboarding. .........................................................................................................40 7. Investigation. ........................................................................................................... 49 8. Threat hunting in the cloud. ..................................................................... 56 9. Malware analysis. .................................................................................................63 10. Design Considerations. ...................................................................................69 11. Access and authorization. ..........................................................................82 12. Putting it all together. ....................................................................................90 Use Case 1: Detect DNS tunneling .....................................................90 Use Case 2: Detect CVE-2019-0708 aka BlueKeep ........ 99 Use Case 3: Detect CurveBall ...............................................................108 3 1. Not your daddy’s Splunk. 1. Not your daddy’s Splunk. 4 OK, I must admit; this title of this chapter is misleading. I am not going to do a side by side comparison of Splunk and Azure Sentinel. Although that seems to be the thing that people on social media are talking about these days: how does Azure Sentinel compare to other SIEM solutions such as Splunk, etc. Instead, I’ll be focusing on what role Azure Sentinel plays in securing your enterprise. And while Azure Sentinel does provide the advanced SIEM capabilities and dashboarding that many companies need, I really want you to understand the broader picture as Azure Sentinel, as a cloud security solution, is set to disrupt the SOC. And with Microsoft owning and operating a big part of the technology you use every day in your workplace, along with making security a strategic investment and bet, I argue that they are becoming the biggest security company in the world. 1.1 Biggest security company in the world Microsoft is investing heavily in security in recent years. Not only have they upped their game in finding and fixing product defects, they for instance also have a big organi- zational unit around threat intelligence (Microsoft Threat Intelligence Center). They are investing tens if not hundreds of millions in developing security products and solutions for their platforms. 5 And while one could argue that the early days of their AV solution were not watertight, they certainly turned around that “ship”, and Microsoft should not be underestimated if they are taking security seriously. If you look at their evolved EDR solution today, Windows Defender is not only achiev- ing high scores, it also detects bad actors in ways and speed other vendors do not and cannot. Because Microsoft’s owns both one of the two biggest cloud platforms in the world, as well as sell the most used cloud endpoint (Windows), they are poised to become the biggest security player in the world. On top of this, it can leverage its immense computing power to use machines learning and artificial intelligence to really make a difference in how security is approached. You see this coming to life when you connect Microsoft De- fender to their Azure cloud; you start to receive threat intelligence feeds, and new malware is detected and remediated through machine learning in under 14 minutes (the example of Bad Rabbit malware). This is why Defender ATP is growing very strong in adoption at enterprises in recent months. 1.2 Traditional SIEM’s and the cloud: a sour-sweet combination By now, you know that Microsoft has an EDR solution called Microsoft Defender. But it has many more offerings. For instance, they also have specific solutions for protection your 6 valuable data such as Cloud App Security and Office 365 ATP. They can protect your identity with Azure AD, and Azure ATP. Microsoft also has Azure Security Center to protect the assets that run on Microsoft Azure, and there are many more security solutions in their portfolio. One thing that seemed to be lacking was a central orches- trator. A coordinator for all your security efforts. Something that ties this all together. In the past years, enterprises would hook up the alerts that Microsoft security solutions were generating and forward them back to their on-premise SIEM solution as part of their cloud security strategy. But they are struggling to keep pace with the increasing volume and variety of data they process. Unhappy users complained about the inability of their SIEMs to scale and the volume of alerts they must investigate. Enterprises struggling with the cost of data analysis and log storage often turn to open source tools like Elasticsearch, Logstash, and Kibana (ELK) or Hadoop to build their own on-premise data lakes. However, to gain useful insight from the data they collect, they realize the expense of building and administering these “free” tools is just as great as the cost of commercial tools. 1.3 Sentinel, orchestrating your security efforts This is where Azure Sentinel comes in; a central place to analyze your security data, across all parts of your environment. Cloud security solutions like Azure Sentinel are set to disrupt the SOC, Forrester concluded during RSA conference in 2019: “This week, as thousands of security pros gather in San Francisco for RSA, tech titans Microsoft and Google (Alphabet) launch cyber security tools that promise to disrupt the traditional way of taking in and analyzing security telemetry. Chronicle Backstory (an Alphabet company) and Microsoft Sentinel are cloud-based security analytics tools that are 7 addressing the challenges faced by SOC teams such as: ° Ingesting security data from multi-cloud and on-premise environments ° Analyzing large data volumes ° Alert triage ° Log management and storage ° Threat hunting Chronicle and Microsoft are making these challenges cloud native with virtually unlimited compute, scale, and storage. These vendors have a unique advantage over legacy on-premise tools since they also own their cloud infrastructures and aren’t dependent on buying cloud at list price from would-be competitors.” 1.4 Connecting any and all clouds One could lead to think that this will be an all-Microsoft centered approach. But nothing is truer. While Microsoft has not confirmed this publicly, they are indeed working with other cloud vendors to get their security data programmatically. If you take a look at the Data Connections section of Azure Sentinel, you see a connector for AWS CloudTrail. 8 1.5 The Graph Security API is at the center of this all In another chapter I’ll wrote in more detail about the Graph Security API, but here is a summary: “Microsoft describes ISG as a way to ‘build solutions that correlate alerts, get context for investigation, and automate security operations in a unified manner.” With the release of Azure Sentinel, it really amplifies that strategy and makes it come to life. The Graph Security API is a core piece of Sentinel’s backend to grab the relevant information from other Microsoft services such as Azure ATP, Defender ATP, Azure Security Center, etcetera. But not only for Microsoft services. Many vendors such as Palo Alto Networks, F5, Symantec, Fortinet and Check Point integrated their solutions into the Graph Security API. Azure Sentinel leverages those technical integrations to get events from the network. Using the dashboards technology already available in Azure, Sentinel is able to provide you with a single pane of glass on the security of your environment. And because of the graph, it provides detailed out of the box drill-down dashboards for those network vendors, as part of your investigation. 9 1.6 Azure Firewall is the perfect example But it doesn’t stop at getting even data from the network. Microsoft released a capability in its own Azure Firewall: Threat intelligence-based filtering. “Azure firewall can now be configured to alert and deny traffic to and from known malicious IP addresses and domains in near real-time. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed powered by The Microsoft Intelligent Security Graph.” Threat intelligence-based filtering is default- enabled in alert mode for all Azure Firewall deployments, providing logging of all matching indicators. Customers can adjust behavior to alert and deny. 1.7 Democratizing AI: meet Azure Sentinel FUSION Azure Sentinel features something Microsoft calls FUSION. As Microsoft is looking to democratize Artificial Intelligence, they are making it easy to use machine learning as part of your triage. 10 Instead of sifting through a sea of alerts, and correlate alerts from different products manually, ML technologies will help you quickly get value from large amounts of security data you are ingesting and

Load more