PART 3 OF A 3 PART SERIES

 

In my first post, Microsoft Defender ATP Telemetry: Viewing MITRE ATT&CK Context, in this series I explained how clients can visualize MITRE Tactic and Technique charts from Advanced Hunting queries in Defender ATP. In the second post, Microsoft Defender ATP Telemetry: Azure Log Analytics Workspace, I went over how these logs can be ingested into a newly created workspace with a Logic App. In this final post I will go over creating a simple Log Analytics workbook to visualize the data in a way that I prefer.

 

Under the General section choose “Workbooks” and then select “Empty” on the right-hand side under quick start.

 

 

The first thing I am going to do is add some text to describe the Workbook.

 

 

This text can be anything you choose. This is just a description for the analyst.

 

 

I chose to save the Workbook and edit the title at this point before moving on.

 

 

Next I decided to add URL links to each of the MITRE ATT&CK Tactic sections.

 

 

Add Links

 

 

The link style was changed to Navigation.

 

 

This produces a clean links section.

 

 

Next I wanted to add two pie charts in the same group to show Tactics seen this week and Tactics seen the previous week. I accomplished this by adding a group to start.

 

Add a group

 

 

Rename the group

 

 

We are going to add a query using Add parameters

 

 

The first query is going to search the DefenderTTPs_CL Logs (or whatever your custom log name is), with an event timestamp from 1 minute ago to 7 days ago, and summarize the results. The results were rendered in a pie chart as seen under the visualization drop down. This is seen in the image below.

 

Note: I included a where statement of when the TimeGenerated was not equal to empty. I wanted to focus on the Timestamp_t field. I am sure there are other ways to do this during ingestion or with parameters, but this serves as a workaround.

 

DefenderTTPs_CL
//TimeGenerated is set to not blank because in this example we are using the Timestamp_t.
| where TimeGenerated != ""
| where Timestamp_t between (ago(7d) .. ago(1m))
| summarize count() by Category


 

 

Under Advanced Settings I chose to have the data be CSV exportable.

 

 

The Style of the chart needs to be changed so that an additional pie chart can be placed next to it in the workbook.

 

 

The results are shown in the pie chart below. Note: If “Other” is listed, is not representative of an ATT&CK category, but a consolidation of lesser values.

 

 

Once again we need to add a query to the group.

 

 

This query is similar to the one above only that the Timestamp of results is between the last 14-7 days as seen below. Also note that Time Range is set to set in query.

 

DefenderTTPs_CL
//TimeGenerated is set to not blank because in this example we are using the Timestamp_t.
| where TimeGenerated !=""
| where Timestamp_t between (ago(14d) .. ago(7d))
| summarize count() by Category


 

 

 

 

Next we are going to create a bar chart of techniques used in the environment over a period of our choosing leveraging a drop-down box to select the time. First thing to do is to add a new parament.

 

 

The new parameter will be called TimeRange and will be a Time range picker. Check that it is required. I have optionally unchecked all time under 24 hours.

 

 

Once saved you should see something like this.

 

 

Next we need to add a new query. There is an added where statement to make the Timestamp value of the alert equal to the time range value. Otherwise we would be getting TimeGenerated back in the results and not the actual time of the alert. Note the green arrow. In order to test this query a time range needs to be selected.

 

DefenderTTPs_CL
| where AttackTechniques_s != ""
| where Timestamp_t {TimeRange}
| mvexpand todynamic(AttackTechniques_s)
| summarize count() by tostring(AttackTechniques_s) | order by AttackTechniques_s desc


 

 

When completed, the workbook should look like the one below.

 

 

Now we have a workbook with links to MITRE ATT&CK categories, category charts for the current and previous weeks regarding ATT&CK and a selectable time range that shows the alerts with techniques used. This is just one example of how Defender ATP log data can be visualized. Azure workbooks allow for a lot of customization to visualize data. Keep in mind we’ve only scratched the surface on this example.

 

Read more from this 3 part series.
Microsoft Defender ATP Telemetry: Viewing MITRE ATT&CK Context (Part 1)
Microsoft Defender ATP Telemetry: Azure Log Analytics Workspace (Part 2)