Microsoft Sentinel Microsoft Sentinel

Level-500-Referenz für Architektur, Connectoren, Analytics, Hunting, SOAR, Multi-Tenant-Betrieb und Kostensteuerung in Microsoft Sentinel. Level-500 reference for architecture, connectors, analytics, hunting, SOAR, multi-tenant operations, and cost control in Microsoft Sentinel.

Architektur und Datenpfad Architecture and data path

Microsoft Sentinel baut auf Azure Monitor und einem Log-Analytics-Workspace auf. Eingehende Daten werden über native Connectoren, Azure Monitor Agent, Event Hub, REST-Workflows, CEF/Syslog oder benutzerdefinierte Ingestion APIs normalisiert und landen in Tabellen, die anschließend von Rules, Workbooks, UEBA, TI-Matching und Hunting verwendet werden. Microsoft Sentinel is built on Azure Monitor and a Log Analytics workspace. Incoming data is normalized through native connectors, Azure Monitor Agent, Event Hub, REST workflows, CEF/Syslog, or custom ingestion APIs and lands in tables that are then used by rules, workbooks, UEBA, TI matching, and hunting.

Architekturentscheidungen auf Level 500 betreffen vor allem Workspace-Topologie, DCR-Filterung, Hot-/Cold-Tier, Content-Isolation, Parser-Strategien, Multi-Tenant-Governance und die Frage, welche Daten dauerhaft im Workspace verbleiben und welche nach ADX oder Data Lake ausgelagert werden. Level 500 architecture decisions mainly concern workspace topology, DCR filtering, hot/cold tiering, content isolation, parser strategy, multi-tenant governance, and which data remains in the workspace versus being offloaded to ADX or a data lake.

Ingestion, Hot/Cold-Tier und Multi-Workspace Ingestion, hot/cold tiers, and multi-workspace

• Platziere hochkritische Datenquellen möglichst im gleichen Workspace wie die primären Analytics Rules, damit Join-Operationen, UEBA und Entity-Mapping konsistent bleiben. Place highly critical sources in the same workspace as primary analytics rules so join operations, UEBA, and entity mapping stay consistent.
• Behandle Parser, Functions und ASIM-Normalisierung als Architekturkomponente; uneinheitliche Feldnamen zerstören Wiederverwendbarkeit von Regeln. Treat parsers, functions, and ASIM normalization as architecture components; inconsistent field names destroy rule reuse.
• Plane Multi-Region-Datenhaltung gemeinsam mit Compliance, da Data Residency, Sovereign Clouds und MSSP-Modelle unterschiedliche Workspaces erzwingen können. Plan multi-region data placement with compliance because data residency, sovereign clouds, and MSSP models can require separate workspaces.
• Dokumentiere, welche Daten für Live-Erkennung nötig sind und welche nur für Forensik, Reporting oder regulatorische Langzeitaufbewahrung gesammelt werden. Document which data is needed for live detection and which is collected only for forensics, reporting, or regulatory retention.

Connector-Katalog nach Typ Connector catalog by type

Die folgende Referenz deckt mehr als 100 gängige Sentinel-Connectoren und Connector-Typen ab. In der Praxis werden viele Lösungen heute über den Content Hub installiert und kombinieren Connector, Parser, Workbook und Rules in einem Paket. The following reference covers more than 100 common Sentinel connectors and connector types. In practice, many solutions are now installed through Content Hub and package connectors, parsers, workbooks, and rules together.

Microsoft 365, Entra ID und Defender Microsoft 365, Entra ID, and Defender

Azure Control Plane und Plattform Azure control plane and platform

Windows, Linux, Syslog und CEF Windows, Linux, Syslog, and CEF

SaaS, IAM und Collaboration SaaS, IAM, and collaboration

AWS und Multi-Cloud AWS and multi-cloud

Custom APIs, Event Hubs und Spezialfälle Custom APIs, Event Hubs, and special cases

Analytics Rules und KQL-Muster Analytics rules and KQL patterns

Erfolgreiche Sign-ins aus mehreren Ländern am selben Tag Successful sign-ins from multiple countries on the same day

    SigninLogs
    | where ResultType == 0
    | summarize Countries = make_set(LocationDetails.countryOrRegion), IPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1d)
    | where array_length(Countries) > 1 and IPs > 1
    | project TimeGenerated, UserPrincipalName, Countries, IPs
        

MFA-Fatigue durch wiederholte Prompt-Ablehnungen MFA fatigue through repeated prompt denials

    SigninLogs
    | where ResultType != 0
    | where Status.failureReason has_any ("MFA denied", "user declined", "fraud")
    | summarize Denials = count(), Apps = make_set(AppDisplayName) by UserPrincipalName, IPAddress, bin(TimeGenerated, 15m)
    | where Denials >= 5
        

Rollenänderungen in privilegierten Entra-Gruppen Role changes in privileged Entra groups

    AuditLogs
    | where OperationName has_any ("Add member to role", "Add eligible member to role")
    | extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName)
    | project TimeGenerated, OperationName, InitiatedByUser, TargetResources
        

Verdächtige OAuth-Consent-Gewährung Suspicious OAuth consent grants

    AuditLogs
    | where OperationName has_any ("Consent to application", "Add delegated permission grant")
    | project TimeGenerated, OperationName, InitiatedBy, TargetResources, AdditionalDetails
        

Encoded PowerShell auf Endpunkten Encoded PowerShell on endpoints

    DeviceProcessEvents
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("-enc", "-encodedcommand", "FromBase64String")
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine
        

Seltene ausgehende Domains Rare outbound domains

    DeviceNetworkEvents
    | where isnotempty(RemoteUrl)
    | summarize Hits = count(), Devices = dcount(DeviceName) by RemoteUrl
    | where Hits < 5 and Devices < 3
    | order by Hits asc
        

Mailbox-Forwarding und Inbox-Regeln Mailbox forwarding and inbox rules

    OfficeActivity
    | where OfficeWorkload == "Exchange"
    | where Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
    | where Parameters has_any ("ForwardTo", "RedirectTo", "DeliverToMailboxAndForward")
    | project TimeGenerated, UserId, Operation, Parameters
        

Massendownloads in SharePoint/OneDrive Mass downloads in SharePoint/OneDrive

    OfficeActivity
    | where OfficeWorkload in ("SharePoint", "OneDrive")
    | where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
    | summarize Downloads = count(), Files = dcount(SourceFileName) by UserId, bin(TimeGenerated, 30m)
    | where Downloads > 250 or Files > 100
        

GuardDuty High Severity Findings GuardDuty high severity findings

    AWSGuardDuty
    | where Severity >= 7
    | summarize Findings = count() by Title, AccountId, Region, bin(TimeGenerated, 1h)
    | order by Findings desc
        

Firewall-Deny-Spikes aus CEF Firewall deny spikes from CEF

    CommonSecurityLog
    | where DeviceAction =~ "Deny"
    | summarize Denies = count() by DeviceVendor, SourceIP, DestinationPort, bin(TimeGenerated, 10m)
    | where Denies > 100
        

Threat-Intelligence-Matches Threat intelligence matches

    let ti = ThreatIntelligenceIndicator
    | where Active == true and ExpirationDateTime > now()
    | project IndicatorId, NetworkIP, DomainName, Url;
    DeviceNetworkEvents
    | join kind=innerunique ti on $left.RemoteIP == $right.NetworkIP
    | project Timestamp, DeviceName, RemoteIP, IndicatorId
        

UEBA High Investigation Priority UEBA high investigation priority

    BehaviorAnalytics
    | where InvestigationPriority >= 5
    | summarize Entities = make_set(Entities), Signals = count() by UserName, ActivityType, bin(TimeGenerated, 1d)
    | order by Signals desc
        

NRT-Kandidat für Password Spray NRT candidate for password spray

    SigninLogs
    | where ResultType != 0
    | summarize Failed = count(), Users = dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m)
    | where Failed > 25 and Users > 10
        

Fusion-Nachverfolgung über SecurityAlert Fusion follow-up through SecurityAlert

    SecurityAlert
    | where ProductName =~ "Azure Sentinel"
    | where AlertName has "Fusion"
    | project TimeGenerated, AlertName, CompromisedEntity, ExtendedProperties
        

Incident Aging und SOC Backlog Incident aging and SOC backlog

    SecurityIncident
    | extend AgeHours = datetime_diff('hour', now(), CreatedTime)
    | summarize OpenIncidents = count(), AvgAge = avg(AgeHours) by Severity, Status
        

Neu auftretende Prozesse pro Host New processes per host

    DeviceProcessEvents
    | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, FileName, SHA1
    | where FirstSeen > ago(24h)
    | order by FirstSeen desc
        

MITRE ATT&CK, Incidents und Investigation Graph MITRE ATT&CK, incidents, and investigation graph

SOAR: Automation Rules und Playbooks SOAR: automation rules and playbooks

PowerShell mit Az.SecurityInsights PowerShell with Az.SecurityInsights

    Connect-AzAccount
    Select-AzSubscription -SubscriptionName "Contoso-SOC"
    Get-AzOperationalInsightsWorkspace -ResourceGroupName "rg-sentinel" -Name "law-soc-prod"
    Get-AzSentinelIncident -ResourceGroupName "rg-sentinel" -WorkspaceName "law-soc-prod" |
        Where-Object { $_.Severity -eq "High" -and $_.Status -eq "New" } |
        Select-Object Title, Severity, Status, Owner
        

    $rule = Get-AzSentinelAlertRule -ResourceGroupName "rg-sentinel" -WorkspaceName "law-soc-prod" -Name "scheduled-passwordspray"
    $rule.DisplayName = "Password Spray - Entra ID NRT Follow-up"
    $rule.Enabled = $true
    Set-AzSentinelAlertRule -ResourceGroupName "rg-sentinel" -WorkspaceName "law-soc-prod" -AlertRule $rule
        

Workbooks, UEBA und Threat Intelligence Workbooks, UEBA, and threat intelligence

Hunting, Bookmarks, Livestream und Notebooks Hunting, bookmarks, livestream, and notebooks

Advanced Hunting in Sentinel ist nicht nur KQL auf Tabellen. Effektive Hunting-Programme standardisieren Bookmark-Konventionen, nutzen Livestream für aktive Incidents, korrelieren Defender-XDR-Tabellen mit Netzwerkdaten und dokumentieren Hypothesen in wiederverwendbaren Hunt-Queries. Advanced hunting in Sentinel is not just KQL on tables. Effective hunting programs standardize bookmark conventions, use livestream during active incidents, correlate Defender XDR tables with network data, and document hypotheses in reusable hunt queries.

    let suspiciousIps = materialize(
        SigninLogs
        | where TimeGenerated > ago(1d)
        | where ResultType == 0
        | summarize Users = dcount(UserPrincipalName) by IPAddress
        | where Users > 20
    );
    DeviceNetworkEvents
    | where Timestamp > ago(1d)
    | join kind=inner suspiciousIps on $left.RemoteIP == $right.IPAddress
    | summarize Connections = count() by DeviceName, RemoteIP, RemoteUrl
        

    from msticpy.data import QueryProvider
    qry = QueryProvider("MSSentinel")
    qry.connect(workspace="law-soc-prod")
    result = qry.exec_query("SigninLogs | take 10")
    result.head()
        

Content Hub, Watchlists und Repositories Content Hub, watchlists, and repositories

Kostenmanagement und Datensteuerung Cost management and data control

    Usage
    | where TimeGenerated > ago(14d)
    | summarize GB = sum(Quantity) / 1024 by DataType, Solution, bin(TimeGenerated, 1d)
    | order by TimeGenerated desc, GB desc
        

Multi-Tenant, Lighthouse und Migration Multi-tenant, Lighthouse, and migration