☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Azure Monitor for Threat Hunting
  • Key Features of Azure Monitor for Threat Hunting
  • How Azure Monitor Supports Threat Hunting
  • Microsoft Documentation: Azure Monitor
  • Microsoft Documentation: Azure Monitor RBAC Built-In Roles
  1. Azure Logging References
  2. Logging

Azure Monitor

Azure Monitor for Threat Hunting

Azure Monitor is a comprehensive monitoring service provided by Microsoft Azure that offers a unified solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. It enables threat hunters to proactively search for and identify threats within an Azure environment, leveraging advanced data analytics, customizable visualizations, and automated responses to enhance security operations.

Key Features of Azure Monitor for Threat Hunting

  1. Data Collection: Collect telemetry from Azure resources, on-premises environments, and custom sources, including logs, metrics, and activity data.

  2. Log Analytics: Utilize Azure Log Analytics to query and analyze vast amounts of log data using Kusto Query Language (KQL).

  3. Security Integration: Seamlessly integrate with Azure Security Center and Azure Sentinel for advanced threat detection and incident response.

  4. Alerts: Set up sophisticated alerting mechanisms to notify you of suspicious activities and potential threats.

  5. Dashboards and Workbooks: Create customizable and interactive dashboards and workbooks to visualize and drill down into security data.

  6. Automation: Automate threat response actions using Azure Automation and Logic Apps.

How Azure Monitor Supports Threat Hunting

Data Collection and Integration

Azure Monitor consolidates data from a variety of sources, providing a comprehensive view of your security environment:

  • Azure Activity Logs: Capture all control-plane actions, providing a detailed record of management operations.

  • Resource Logs: Collect logs from Azure resources such as virtual machines, databases, and storage accounts to monitor operational and security events.

  • Azure Security Center: Integrate with Azure Security Center to gain insights into vulnerabilities and threat intelligence.

  • Azure Sentinel: Leverage Azure Sentinel, a cloud-native SIEM and SOAR solution, for enhanced threat detection, investigation, and response.

Log Analytics for Threat Hunting

Log Analytics in Azure Monitor allows threat hunters to perform complex queries on collected log data. By using KQL, threat hunters can identify anomalies, investigate incidents, and uncover potential threats.

  • Example Query: Detect unusual login attempts:

    kustoCopy codeSecurityEvent
    | where EventID == 4625
    | summarize count() by bin(TimeGenerated, 1h), Account
    | order by count_ desc

Alerts and Notifications

Set up alerts to be notified of suspicious activities, enabling prompt investigation and response:

  • Create Alert Rules: Define specific conditions for alerts, such as multiple failed login attempts from a single IP address within a short timeframe.

  • Action Groups: Configure action groups to determine the response actions when an alert is triggered, such as sending an email, creating an incident in Azure Sentinel, or executing an automated response.

Dashboards and Workbooks

Visualize and analyze security data using customizable dashboards and workbooks:

  • Dashboards: Provide an overview of key security metrics and alert statuses, helping you quickly identify areas of concern.

  • Workbooks: Use workbooks to create detailed, interactive reports that allow you to drill down into specific data points and conduct in-depth investigations.

    • Example Workbook: Threat Hunting for Suspicious Login Activity:

      • Failed Logins Query:

        SecurityEvent
        | where EventID == 4625
        | summarize count() by bin(TimeGenerated, 1h), Account, IPAddress
      • Successful Logins Query:

        SecurityEvent
        | where EventID == 4624
        | summarize count() by bin(TimeGenerated, 1h), Account, IPAddress
      • Visualizations: Use time charts, bar charts, and tables to display the data and identify patterns or anomalies.

Automation

Automate threat response actions to improve efficiency and reduce response time:

  • Logic Apps: Create workflows to automatically respond to detected threats, such as blocking IP addresses or isolating compromised resources.

  • Azure Automation: Use runbooks to automate routine tasks and incident response procedures, ensuring consistent and timely actions.

Microsoft Documentation: Azure Monitor

Microsoft Documentation: Azure Monitor RBAC Built-In Roles

Last updated 9 months ago

Azure Monitor documentation - Azure MonitorMicrosoftLearn
Logo
Azure built-in roles for Monitor - Azure RBACMicrosoftLearn
Logo