Hunt for Threats Using the Microsoft

Sentinel Portal

Michael J. Teske
Principal Author Evangelist-Pluralsight
Hunt for Threats Using the Microsoft Sentinel
Portal

Perform advanced hunting with notebooks

Create custom hunting queries
- Run hunting queries manually
- Convert a hunting query to an analytical rule

Use hunting bookmarks for data investigations

- Track query results with bookmarks
Monitor hunting queries by using Livestream
Perform Advanced Hunting with Notebooks
Perform Advanced Hunting with Notebooks

Data store is accessed by a common API

- Azure Portal
- Azure Sentinel tools
- Jupyter notebooks
- Python
Use notebooks for:
- Perform analytics
- Create data visualizations
- Integrate external data sources
Requirements

Machine Learning Workspace

- Storage account
- Key vault
- Application insights
- Networking
• Public or private endpoint
- Advanced
• System or user assigned identity
• Credential or Identity-based storage
account access
• Microsoft or customer managed keys
 Permissions Required for Notebooks

Microsoft Sentinel Permissions Azure Machine Learning Permissions

Microsoft Sentinel Reader Default roles
Microsoft Sentinel Responder Azure ML Data Scientist
Microsoft Sentinel Contributor Reader
Contributor
Owner
Jupyter Notebooks
Create Custom Hunting Queries
Custom Queries
Custom Queries
Custom Hunting Queries

Queries, but for threat hunting, but still KQL

queries
Modify query in details pane and run
Save modified query as a new query
Custom Hunting Queries
Custom Hunting Queries
Convert a Hunting Query to an Analytical Rule

Hunting queries expose data you might want

to monitor

Data returned is consistent and constant

Important enough to add to your normal
alerting system
Allows you to convert from manual monitoring
to automated analysis
Convert a Hunting Query to an Analytical Rule
Use Hunting Bookmarks for
Data Investigations
Hunting Bookmarks

Used to preserve queries ran in Microsoft

Sentinel
- Includes query results
- Record observations
- Reference findings via notes

Visible to you and your team for collaboration

Allows you to address urgent findings
Hunting Bookmarks
Hunting Bookmarks
# PowerShell Azure Sentinel Bookmark commands

Get-AzSentinelBookmark

New-AzSentinelBoomark

Remove-AzSentinelBoomark

Update-AzSentinelBoomark

Hunting Bookmarks Using PowerShell

# Create a bookmark named MyBookmark

New-AzSentinelBookmark -ResourceGroupName “ps-course-rg" -WorkspaceName "MyWorkspace“ `

-DisplayName "MyBookmark" -Query "SecurityAlert | take 1“

Hunting Bookmarks Using PowerShell

Hunting Bookmarks
Hunting Bookmarks
Monitor Hunting Queries by Using Livestream
Monitor Hunting Queries by Using Livestream

Livestream allows users quickly create

sessions using any Analytics query
- Real time monitoring
Monitor Hunting Queries by Using Livestream
Monitor Hunting Queries by Using Livestream
Monitor Hunting Queries by Using Livestream
Demo Review Jupyter Notebooks
Manage custom queries
- Convert query to analytics rule
- Hunting bookmarks
- Create Livestream session
 Perform advanced hunting with notebooks
- Running cell blocks
- Requires an Azure Machine Learning
workspace
Summary
- Must have:
• Sentinel reader, responder and
contributor roles
• Default Azure ML roles

Create custom hunting queries

- Run hunting queries manually
- Convert a hunting query to an
analytical rule
• Add to your normal security monitoring
 Use hunting bookmarks for data
investigations
Summary
- Track query results with bookmarks
• Provides ability to return to the
investigation
Monitor hunting queries by using
Livestream
- Monitoring hunting queries as they occur
in real time
Up Next:
Configure SOAR in Microsoft Sentinel