PART 2 OF A 3 PART SERIES

 

In my last post, Microsoft Defender ATP Telemetry: Viewing MITRE ATT&CK Context, I discussed how an analyst can use Defender ATP to visualize MITRE ATT&CK and Technique information from Advanced Hunting queries. There are some limitations with Advanced Hunting queries: reports need to manually run and we are limited to 30 days of data. To overcome those limitations this post will demonstrate a way to pull DATP data into an Azure Log Analytics workspace using an Azure Logic App.

 

 

In my Azure portal, I will search for and select the Log Analytics icon to create a new Log Analytics workspace as seen in the image below.

 

 

Choose your pricing tier.

 

 

Add any tags.

 

 

Review and create.

 

 

Once the workspace is created click Go to resource.

 

 

The Overview section of the newly created workspace will show the Subscription ID, Workspace Name and ID.

 

 

Next click Advanced settings on the left-hand side and note the Workspace ID and Primary Key when they appear.

 

 

Create a new Logic App using the same Resource group used in the Log Analytic workspace.

 

 

Add any necessary parameters, including the Subscription, Resource group, and Logic App Name.

 

 

Add any needed tags if necessary and Create.

 

 

Once created, click Go to resource.

 

 

Create a Blank Logic App.

 

 

Search for schedule and add a recurrence. In this example, I am going to perform an action, once daily starting today.

 

 

The scheduled recurrence will trigger once daily, starting on 5-13-2020.

 

 

Next, the recurrence needs to do perform some sort of action at this time. I want the app to perform an Advanced Hunting query from Microsoft Defender ATP.

 

Choose New step.

 

 

Search for Microsoft Defender.

 

 

You may be prompted to sign into Defender to create the connection.

 

 

Select Action and choose Advanced Hunting.

 

 

Now we will add the same query used in DATP, only we will add a where statement to select all events that happened in the last 24 hours to coincide with our daily reoccurrence.

 

 

DeviceAlertEvents
| where Timestamp> ago(24h)
| where Category == "InitialAccess"
or Category == "Execution"
or Category == "Persistence"
or Category == "PrivilegeEscalation"
or Category == "DefenseEvasion"
or Category == "CredentialAccess"
or Category == "Discovery"
or Category == "LateralMovement"
or Category == "Collection"
or Category == "CommandAndControl"
or Category == "Exfiltration"
or Category == "Impact"


 

Next we need to do something with the results that the Advance Hunting query produces. Search for “Control” and then select “For each” under Actions.

 

 

Next define the what the “For each” is. In this case, it will be the results of the query.

 

 

Within the same frame, we need to add an action.

 

 

Search for “Azure Analytics” and select “Azure Log Analytics Data Collector.”

 

 

Under the Action tab select “Send Data.”

 

 

The JSON Request body will be the “Current item.” The Custom Log Name will be the name of the new log table that we can search for with KQL.

 

 

I now get a prompt to create a name for the connection, the Workspace ID and Workspace (Primary) Key will be the information noted in the earlier steps.

 

 

After the connection is made, we need to add one additional parameter in the “Time-generated-field.” I choose to use UTC. The “For each” step should look like the one in the picture below. There are no additional steps in creating the Logic App and we can run a test.

 

 

The Logic App that was created can be tested by clicking “Run.”

 

 

Note: I choose to change the Timestamp window for this test to (30d), which produces 30 days of data. This was only used to produce more data for later sections. After the initial test, I changed it back to (24h) and saved the app.

 

 

If all goes well, you will see green checkmarks on the right side of each step.

 

 

If we move back to the Log Analytics workspace and take a look at the logs, we should see the name of our newly defined custom logs.

 

 

 

Running a limit search on the Custom Logs shows that data is being collected. Now once a day the workspace will ingest new log data filtered to include Defender ATP alerts containing MITRE Tactic and Technique information. In the next and last post in this series we will walkthrough creating a workbook to create chats to visualize the data from the log workspace.

 

Read more from this 3 part series.
Microsoft Defender ATP Telemetry: Viewing MITRE ATT&CK Context (Part 1)
Microsoft Defender ATP Telemetry: Workbook Visualizations (Part 3)