wagov / wasocautomationplaybook Goto Github PK
View Code? Open in Web Editor NEWFor testing playbooks
For testing playbooks
Automation Rule Name needs to be fixed to match naming schema.
Automation Rule Name needs to be fixed to match naming schema.
For testing duplication and overwriting of automation rules in Sentinel
Testing the initial deployment of the collated rules.
For testing
Rule is missing and "Log4j vulnerability exploit aka Log4Shell IP IOC" rule was created in its stead.
Related to #20
Unsure how to handle Defender for IoT incidents.
Rule appears to be triggered be creation of multiple other login related incidents/alerts
SecurityAlert
| where ProviderName == "IoTSecurity"
| where AlertName in ("Excessive Login Attempts","Excessive SMB login attempts","Password Guessing Attempt Detected","Excessive Number of Sessions")
| extend ExtendedProperties = parse_json(ExtendedProperties)
| where tostring(ExtendedProperties.isNew) == "True"
| extend DeviceId = tostring(ExtendedProperties.DeviceId),
SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress),
DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress),
RemediationSteps = tostring(parse_json(RemediationSteps)[0]),
Protocol = tostring(ExtendedProperties.Protocol),
AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
| project
TimeGenerated,
DeviceId,
ProductName,
ProductComponentName,
AlertSeverity,
AlertName,
Description,
Protocol,
SourceDeviceAddress,
DestDeviceAddress,
RemediationSteps,
Tactics,
Entities,
VendorOriginalId,
AlertLink,
AlertManagementUri,
Techniques
While I wouldn't normally say to fix the gap caused by MS in its formatting, there is a 15 line gap between the dot points and the KQL example.
Automation Rule Name needs to be fixed to match naming schema.
Third action is missing words:
"If the device(s) are domain controllers and , then the querying of domains could be usual activity and should be confirmed."
This should also cover something along the lines of "..or if the actions or entities are acting outside of normal guidelines/times" for the second action.
Not sure the reason for having this when we have "Admin promotion after Role Management Application Permission Grant"
Related to #19
Unsure how to correctly remediate Defender for IoT incidents
SecurityAlert
| where ProviderName == "IoTSecurity"
| where AlertName == "Suspicion of Denial Of Service Attack"
| extend ExtendedProperties = parse_json(ExtendedProperties)
| where tostring(ExtendedProperties.isNew) == "True"
| extend DeviceId = tostring(ExtendedProperties.DeviceId),
SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress),
DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress),
RemediationSteps = tostring(parse_json(RemediationSteps)[0]),
Protocol = tostring(ExtendedProperties.Protocol),
AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
| project
TimeGenerated,
DeviceId,
ProductName,
ProductComponentName,
AlertSeverity,
AlertName,
Description,
Protocol,
SourceDeviceAddress,
DestDeviceAddress,
RemediationSteps,
Tactics,
Entities,
VendorOriginalId,
AlertLink,
AlertManagementUri,
Techniques
search "<entity>"
| summarize count() by $table
(On a quick test 24 hour data set this improved from 58s > 9s to retrieve results)
Needed renaming for automation rule in json.
Automation Rule Name needs to be fixed to match naming schema.
Not sure the reason for having this when we have "Admin promotion after Role Management Application Permission Grant"
Disregard clicked on the wrong one
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.