Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sentinel analytics health #9170

Closed
shipothana opened this issue Oct 6, 2023 · 36 comments
Closed

Sentinel analytics health #9170

shipothana opened this issue Oct 6, 2023 · 36 comments
Assignees
@v-rbajaj @v-sudkharat @v-muuppugund
Labels
question Further information is requested

Comments

@shipothana
Copy link

Hi,
Please provide me with KQL queries for no incidents triggered in the last 90 days in the incident tab.

Thanks,
@github-actions
Copy link
Contributor

github-actions bot commented Oct 6, 2023

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

@v-amolpatil v-amolpatil added the question Further information is requested label Oct 8, 2023
@v-sudkharat
Copy link
Contributor

Hi @shipothana, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 11-10-2023. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, based on the issue description, we are sharing the query -

  1. For Check number of incident in 90days-
SecurityIncident
| where TimeGenerated > ago(90d)
  1. For Checking the incident in Security Alert table -
SecurityAlert
| where TimeGenerated > ago(90d)
| where  IsIncident == "False"
| project TimeGenerated,DisplayName,AlertSeverity,AlertName,Description,VendorName

Hope this help,
if you have concern, please describe the more information about this issue.
Thanks!

@shipothana
Copy link
Author

Hi thanks for sharing the query!.
We have 300+ use cases, but only out of 20% are we triggering an incident, but I want to know which use cases have not triggered an incident in the last 90 days.

@v-sudkharat
Copy link
Contributor

Hi @shipothana, just want to know, the above shared query work for you?

@shipothana
Copy link
Author

Working for me.. but I want to know which use cases have not triggered an incident in the last 90 days query

@v-sudkharat
Copy link
Contributor

Hi @shipothana, thanks for sharing response, we are checking the KQL query, and we will update you by 13-10-2023 Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, we are sharing the query in which AlertName is referring to your use cases which not triggered an incident in last 90 days.

SecurityAlert
| where TimeGenerated > ago(90d)
| where  IsIncident == "False"
| project AlertName

if you want more details for use cases(AlertName), please refer below query -

SecurityAlert
| where TimeGenerated > ago(90d)
| where  IsIncident == "False"
| project AlertName, AlertSeverity, TimeGenerated, Description

Thanks!

@shipothana
Copy link
Author

Hi, thanks for sharing the query! ,
I want the SecurityIncident table to not trigger an incident in the last 90 days.

@v-sudkharat
Copy link
Contributor

Hi @shipothana, all the Incidents that are triggered saved under SecurityIncident table, could you please explain what are the use cases which is not trigger?

@shipothana
Copy link
Author

Hi,
Please find the use cases are trigger.

RunningRAT request parameters
Create incidents based on Microsoft Defender for Endpoint alerts
Mercury - Domain, Hash and IP IOCs - August 2022
Azure VM Run Command operation executed during suspicious login window
AV detections related to Europium actors
Changes to PIM Settings
Correlate Unfamiliar sign-in properties and atypical travel alerts
DSRM Account Abuse
SEABORGIUM C2 Domains August 2022
Dev-0228 File Path Hashes November 2021
Dev-0530 IOC - July 2022
Authentication Method Changed for Privileged Account
Addition of a Temporary Access Pass to a Privileged Account
CreepyDrive request URL sequence
AdminSDHolder Modifications
Missing Domain Controller Heartbeat
Dev-0270 WMIC Discovery
Known Barium domains
THALLIUM domains included in DCU takedown
AV detections related to SpringShell Vulnerability
AV detections related to Dev-0530 actors
TEARDROP memory-only dropper
AV detections related to Hive Ransomware
Admin promotion after Role Management Application Permission Grant
Authentication Methods Changed for Privileged Account
AV detections related to Tarrask malware
Correlate Unfamiliar sign-in properties & atypical travel alerts
Dev-0228 File Path Hashes November 2021
Dev-0270 Malicious Powershell usage
Dev-0270 Registry IOC - September 2022
Dev-0270 WMIC Discovery
DSRM Account Abuse
Dumping LSASS Process Into a File
Europium - Hash and IP IOCs - September 2022
Identify Mango Sandstorm powershell commands
Identify SysAid Server web shell creation

@v-sudkharat
Copy link
Contributor

v-sudkharat commented Oct 13, 2023 •
edited
Loading

Hi @shipothana, thanks for sharing the use cases with us, we are investigating the issue, and we'll let you know by 18-10-2023 Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, we are working on the KQL query, and we will update you by 20-10-2023. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, could you please check the below query and let us know you got the result. we have different use cases in our workspace.

SecurityAlert
| join kind=fullouter  (SecurityIncident) on Status
| where IncidentNumber >= 0 and TimeGenerated > ago(90d)
| project IncidentNumber, AlertName , AlertSeverity ,TimeGenerated, Description, Title

@shipothana
Copy link
Author

Thanks for your query. I'm looking here for no incident triggered in sentinel use case details

@v-sudkharat
Copy link
Contributor

Hi @shipothana, thanks for response, we will check the query and share with you. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, thank you for being with us. could you please run the below KQL query in your workspace and let us know you got the result which you are expecting. Actually, we have different use cases in our workspace.

SecurityAlert
| join kind=fullouter  (SecurityIncident) on Status
| where TimeGenerated > ago(90d)
| where  IsIncident == "True"
| project IncidentNumber, AlertName , AlertSeverity ,TimeGenerated, Description, Title

Please let us know if the issue persists so that we can set up a call.

Thanks!

@shipothana
Copy link
Author

shipothana commented Oct 27, 2023 via email

@v-sudkharat
Copy link
Contributor

v-sudkharat commented Oct 27, 2023 •
edited
Loading

Hi @shipothana, could you please let us know your convenient time so we can set up a call.
And please share you mail id with us.

Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, We are waiting for your response. Thanks!

@shipothana
Copy link
Author

Hi
 My working hours in the IST time zone, please send me a meeting invitation.

@v-sudkharat
Copy link
Contributor

@shipothana, Could you please share your mail id with us? so, we can send a meeting invitation. Thanks!

@shipothana
Copy link
Author

I am free now please send me the meeting invite: Pothana.Sivaramakrishna@alcon.com

@v-sudkharat
Copy link
Contributor

Hi @shipothana, we sent an invite, please check. Thanks

@v-sudkharat
Copy link
Contributor

Hi @shipothana, Could you please run the below query and check you got the expected results .

SecurityIncident
| join kind= fullouter (SecurityAlert) on $left.Title==$right.AlertName
| where AlertIds !contains SystemAlertId
| project AlertName, SystemAlertId, AlertIds, IncidentName, IncidentNumber

We tested this query in our workspace, in which an analytic rule is created but we disabled the Incident creation for query testing -
image

After running the query, we got the Analytic rule which is created but not triggered an Incident.
image

Earlier, same analytic rule the incident is triggered.
image

Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, could you please have a look on above comment? and share response with us. Thanks!

@shipothana
Copy link
Author

shipothana commented Nov 6, 2023 via email

@v-sudkharat
Copy link
Contributor

@shipothana, what result you got? after running below query -

SecurityIncident
| where TimeGenerated > ago(90d)
| join kind= fullouter (SecurityAlert) on $left.Title==$right.AlertName
| where AlertIds !contains SystemAlertId
| project AlertName, SystemAlertId, AlertIds, IncidentName, IncidentNumber

Could you please share the query result with us?
You can share in Our Team's group as well.

Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, Could you please share the screenshot of what issue you are facing in AnalyticsEfficiency.json workbook? it would be helpful for us to more investigate.
Additionally, we have same workbook in SOC Handbook solution, could you please install the latest solution from Content Hub and check the workbook.
Sharing the screenshot for reference-
image

Please let us know still you are getting same issue. Thanks!

@v-muuppugund
Copy link
Contributor

Hi @shipothana ,Could you please check the above mentioned steps and update issue as resolved or not?

@v-sudkharat
Copy link
Contributor

Hi @shipothana, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond to it in the next 2 days. If we don't receive a response by 22-11-2023 date, we will be closing this issue.
Thanks!

@shipothana
Copy link
Author

Thanks for supporting us!

could you please elaborate more details about SOC Handbook solution for Microsoft Sentinel?

@v-sudkharat
Copy link
Contributor

Hi @shipothana, Sure, we are pleased to elaborate on this SOC Handbook solution. with the reference of solution description, The SOC Handbook Microsoft Sentinel solution is a collection of resources designed to assist SOC Analysts. and these resources help to a analysts gain a better understanding of the security status of an organization's resources at any given time.

For Example - the SOC Handbook solution includes an AnalyticsEfficiency workbook. This workbook provides detailed information about Analytic rules in the form of charts.
In reference to your problem statement, the AnalyticsEfficiency workbook allows you to select the Analytic rules (Use Cases) which created in your subscription or workspace. However, these rules require attention because they either didn't create any alerts during the selected period, or they are auto disabled.
As shown in the screenshot below, we have selected a few Rules (Use Cases) that were created and enabled in the workspace. However, these rules appear in the "Rules that require attention" section in the workbook because they did not generate any alerts during the selected time frame (e.g., 1 day, 7 days, or 90 days).

  1. Select your Subscription and Workspace -
    image

  2. Select the Analytic rules -
    image

image

We hope this provides a satisfactory answer to your question.

If you are facing any issue in that workbook, please let us know, so we can connect via call. It would be helpful for us to understand the issue.

Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, Could you please have a look at above comment? and share response with us. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond to it in the next 2 days. If we don't receive a response by 28-11-2023 date, we will be closing this issue.
Thanks!

@v-sudkharat
Copy link
Contributor

Hi @shipothana, since we have not received a response in the last 5 days, we are closing your issue #9170 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@v-rbajaj v-rbajaj

@v-sudkharat v-sudkharat

@v-muuppugund v-muuppugund

Labels
question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@v-amolpatil @v-rbajaj @shipothana @v-sudkharat @v-muuppugund