Darktrace connector (#1359)
* Darktrace Connector info initial 3 required files for connector PR * Update Darktrace.json added KQL query * Update Darktrace.svg removed xlink * Update Darktrace.svg Changed logo fill as requested * Darktrace Connector workbook added Added relevant files required for the darktrace workbook, which contains a variety of KQL queries. * Updated Connector Description Updated description to be more specific as per change request. * Update WorkbooksMetadata.json spaces added * Removing additional Character Removing additional Character at the beginning of the file in Darktrace workbook json Co-authored-by: v-jayakal <v-jayakal@microsoft.com>
This commit is contained in:
SunRift
GitHub
Родитель
53a8a28c08
Коммит
413fca0b8a
|
|
@ -0,0 +1,114 @@
|
|||
{
|
||||
"id": "DarktraceDarktrace",
|
||||
"title": "Darktrace",
|
||||
"publisher": "Darktrace",
|
||||
"descriptionMarkdown": "The Darktrace connector lets users connect Darktrace Model Breaches in real-time with Azure Sentinel, allowing creation of custom Dashboards, Workbooks, Notebooks and Custom Alerts to improve investigation. Azure Sentinel's enhanced visibility into Darktrace logs enables monitoring and mitigation of security threats.",
|
||||
"graphQueries": [
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "Darktrace",
|
||||
"baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"Darktrace\"\n| where DeviceProduct == \"Darktrace\""
|
||||
}
|
||||
],
|
||||
"sampleQueries": [
|
||||
{
|
||||
"description": "first 10 most recent data breaches",
|
||||
"query": "CommonSecurityLog\n| where DeviceVendor == \"Darktrace\"\n| where DeviceProduct == \"Darktrace\"\n| order by TimeGenerated desc \n| limit 10"
|
||||
}
|
||||
],
|
||||
"dataTypes": [
|
||||
{
|
||||
"name": "CommonSecurityLog (Darktrace)",
|
||||
"lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor == \"Darktrace\"\n| where DeviceProduct == \"Darktrace\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
|
||||
}
|
||||
],
|
||||
"connectivityCriterias": [
|
||||
{
|
||||
"type": "IsConnectedQuery",
|
||||
"value": [
|
||||
"CommonSecurityLog\n| where DeviceVendor == \"Darktrace\"\n| where DeviceProduct == \"Darktrace\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
|
||||
]
|
||||
}
|
||||
],
|
||||
"availability": {
|
||||
"status": 1,
|
||||
"isPreview": true
|
||||
},
|
||||
"permissions": {
|
||||
"resourceProvider": [
|
||||
{
|
||||
"provider": "Microsoft.OperationalInsights/workspaces",
|
||||
"permissionsDisplayText": "read and write permissions are required.",
|
||||
"providerDisplayName": "Workspace",
|
||||
"scope": "Workspace",
|
||||
"requiredPermissions": {
|
||||
"read": true,
|
||||
"write": true,
|
||||
"delete": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
|
||||
"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
|
||||
"providerDisplayName": "Keys",
|
||||
"scope": "Workspace",
|
||||
"requiredPermissions": {
|
||||
"action": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"instructionSteps": [
|
||||
{
|
||||
"title": "1. Linux Syslog agent configuration",
|
||||
"description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Azure Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace",
|
||||
"innerSteps": [
|
||||
{
|
||||
"title": "1.1 Select or create a Linux machine",
|
||||
"description": "Select or create a Linux machine that Azure Sentinel will use as the proxy between your security solution and Azure Sentinel this machine can be on your on-prem environment, Azure or other clouds."
|
||||
},
|
||||
{
|
||||
"title": "1.2 Install the CEF collector on the Linux machine",
|
||||
"description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Azure Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.",
|
||||
"instructions": [
|
||||
{
|
||||
"parameters": {
|
||||
"fillWith": [
|
||||
"WorkspaceId",
|
||||
"PrimaryKey"
|
||||
],
|
||||
"label": "Run the following command to install and apply the CEF collector:",
|
||||
"value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}"
|
||||
},
|
||||
"type": "CopyableLabel"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "2. Forward Common Event Format (CEF) logs to Syslog agent",
|
||||
"description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address."
|
||||
},
|
||||
{
|
||||
"title": "3. Validate connection",
|
||||
"description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine",
|
||||
"instructions": [
|
||||
{
|
||||
"parameters": {
|
||||
"fillWith": [
|
||||
"WorkspaceId"
|
||||
],
|
||||
"label": "Run the following command to validate your connectivity:",
|
||||
"value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}"
|
||||
},
|
||||
"type": "CopyableLabel"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "4. Secure your machine ",
|
||||
"description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90.79 99.09">
|
||||
<path d="M79.1,19.2a6.61,6.61,0,1,1,3.81-8.54A6.62,6.62,0,0,1,79.1,19.2Z" transform="translate(0 0)" fill="#2f3a56" opacity="0.65"/>
|
||||
<path d="M88.9,8.36A13.1,13.1,0,0,0,76.74,0a12.84,12.84,0,0,0-4.66.87,13,13,0,0,0-7.51,16.78h0a12.58,12.58,0,0,0,1.74,3.15l-16,15.4a21.76,21.76,0,0,0-30.08,1l-7.72-6.54a3.43,3.43,0,0,0,.23-.52,6.47,6.47,0,0,0-.12-5,6.59,6.59,0,1,0-6,9.26,6.43,6.43,0,0,0,2.66-.57,7.09,7.09,0,0,0,1.08-.6l7.78,6.59a21.75,21.75,0,0,0,17.72,34.4A21.29,21.29,0,0,0,40,73.81l2.9,10.36a7.92,7.92,0,1,0,11.26,4.59v-.05a7.9,7.9,0,0,0-7.54-5.5h-.48L43.25,72.92l.39-.15A21.8,21.8,0,0,0,56.19,44.64a21.22,21.22,0,0,0-3.53-6l16-15.4A13,13,0,0,0,88.9,8.36ZM48,95.53a4.39,4.39,0,0,1-1.39.22,4.58,4.58,0,0,1-1.4-8.94,4.71,4.71,0,0,1,1.4-.22A4.58,4.58,0,0,1,48,95.53Zm-39.74-64a4,4,0,0,1-1.67.36,4.13,4.13,0,1,1,3.77-5.8,4.05,4.05,0,0,1,.08,3.15,4.13,4.13,0,0,1-2.18,2.3ZM42.45,69.65a18.44,18.44,0,1,1,10.24-24c.08.2.16.4.23.6A18.34,18.34,0,0,1,42.45,69.65ZM76.74,22.71a9.68,9.68,0,1,1,3.46-.64A9.68,9.68,0,0,1,76.74,22.71Z" transform="translate(0 0)" fill="#2f3a56"/>
|
||||
<path d="M40.77,65.39a13.76,13.76,0,1,1,7.92-17.78h0a13.77,13.77,0,0,1-7.91,17.78Z" transform="translate(0 0)" fill="#f49c14"/>
|
||||
<path d="M7.39,29.83A2.21,2.21,0,1,1,8.64,27v0h0A2.21,2.21,0,0,1,7.39,29.83Z" transform="translate(0 0)" fill="#2f3a56" opacity="0.65"/>
|
||||
<path d="M47.68,94a3,3,0,1,1,.08,0Z" transform="translate(-1 0)" fill="#2f3a56" opacity="0.65"/>
|
||||
</svg>
|
||||
|
||||
|
После Ширина: | Высота: | Размер: 1.5 KiB |
|
|
@ -0,0 +1,25 @@
|
|||
DeviceEventClassID,LogSeverity,OriginalLogSeverity,DeviceAction,SimplifiedDeviceAction,Computer,CommunicationDirection,DeviceFacility,DestinationPort,DestinationIP,DeviceAddress,DeviceName,Message,Protocol,SourcePort,SourceIP,RemoteIP,RemotePort,MaliciousIP,ThreatSeverity,IndicatorThreatType,ThreatDescription,ThreatConfidence,ReportReferenceLink,MaliciousIPLongitude,MaliciousIPLatitude,MaliciousIPCountry,DeviceVersion,Activity,ApplicationProtocol,EventCount,DestinationDnsDomain,DestinationServiceName,DestinationTranslatedAddress,DestinationTranslatedPort,DeviceDnsDomain,DeviceExternalID,DeviceInboundInterface,DeviceNtDomain,DeviceOutboundInterface,DevicePayloadId,ProcessName,DeviceTranslatedAddress,DestinationHostName,DestinationMACAddress,DestinationNTDomain,DestinationProcessId,DestinationUserPrivileges,DestinationProcessName,DeviceTimeZone,DestinationUserID,DestinationUserName,DeviceMacAddress,ProcessID,ExternalID,FileCreateTime,FileHash,FileID,FileModificationTime,FilePath,FilePermission,FileType,FileName,FileSize,ReceivedBytes,OldFileCreateTime,OldFileHash,OldFileID,OldFileModificationTime,OldFileName,OldFilePath,OldFilePermission,OldFileSize,OldFileType,SentBytes,RequestURL,RequestClientApplication,RequestContext,RequestCookies,RequestMethod,SourceHostName,SourceMACAddress,SourceNTDomain,SourceDnsDomain,SourceServiceName,SourceTranslatedAddress,SourceTranslatedPort,SourceProcessId,SourceUserPrivileges,SourceProcessName,SourceUserID,SourceUserName,EventType,DeviceCustomIPv6Address1,DeviceCustomIPv6Address1Label,DeviceCustomIPv6Address2,DeviceCustomIPv6Address2Label,DeviceCustomIPv6Address3,DeviceCustomIPv6Address3Label,DeviceCustomIPv6Address4,DeviceCustomIPv6Address4Label,DeviceCustomFloatingPoint1,DeviceCustomFloatingPoint1Label,DeviceCustomFloatingPoint2,DeviceCustomFloatingPoint2Label,DeviceCustomFloatingPoint3,DeviceCustomFloatingPoint3Label,DeviceCustomFloatingPoint4,DeviceCustomFloatingPoint4Label,DeviceCustomNumber1,DeviceCustomNumber1Label,DeviceCustomNumber2,DeviceCustomNumber2Label,DeviceCustomNumber3,DeviceCustomNumber3Label,DeviceCustomString1,DeviceCustomString1Label,DeviceCustomString2,DeviceCustomString2Label,DeviceCustomString3,DeviceCustomString3Label,DeviceCustomString4,DeviceCustomString4Label,DeviceCustomString5,DeviceCustomString5Label,DeviceCustomString6,DeviceCustomString6Label,DeviceCustomDate1,DeviceCustomDate1Label,DeviceCustomDate2,DeviceCustomDate2Label,FlexDate1,FlexDate1Label,FlexNumber1,FlexNumber1Label,FlexNumber2,FlexNumber2Label,FlexString1,FlexString1Label,FlexString2,FlexString2Label,AdditionalExtensions,StartTime [UTC],EndTime [UTC],Type,_ResourceId
|
||||
26,7,,,,,,,443,127.0. 0.1,127.0. 0.1,deviceNameExample.com,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1907243,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://darktrace.com/#modelbreach/1907243 ,,,CommonSecurityLog,
|
||||
26,7,,,,,,,443,127.0. 0.1,10.12.13.14,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,slammar.iotrap.com,,,,,,,,,,,1907242,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://darktrace.com/#modelbreach/1907242 ,,,CommonSecurityLog,
|
||||
17,6,,,,,,,445,127.0. 0.1.22,10.20.15.10,,,,,,,,,,,,,,,,,4.1,Anomalous Server Activity/Anomalous External Activity from Critical Network Device,,,,,,,,,,,,,,,,,,,,,,,,,,1907249,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,darktraceUrl=https://darktrace.com/#modelbreach/1907249 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,3389,127.0. 0.1.11,10.40.30.20,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,s1-ip6da,00:15:5d:24:03:4a,,,,,,,,,,1900990,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://darktrace.com/#modelbreach/1900990 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,3389,127.0. 0.1.11,127.0. 0.1.11,s1-ip6da,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,00:15:5d:24:03:4a,,,,,,,,,,1900991,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=00:15:5d:24:03:4a;message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://darktrace.com/#modelbreach/1900991 ,,,CommonSecurityLog,
|
||||
17,6,,,,,,,445,127.0. 0.1.22,10.20.15.10,,,,,,,,,,,,,,,,,4.1,Anomalous Server Activity/Anomalous External Activity from Critical Network Device,,,,,,,,,,,,,,,,,,,,,,,,,,1900999,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,darktraceUrl=https://darktrace.com/#modelbreach/1900999 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,443,52.112.212.77,10.180.18.1,username-XPS-13-9350,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1874731,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=c8:ff:28:b6:2c:d7;darktraceUrl=https://darktrace.com/#modelbreach/1874731 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,3389,10.180.80.45,10.180.1.18,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1875106,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://darktrace.com/#modelbreach/1875106 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,3389,10.180.80.45,10.180.80.45,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1875108,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://darktrace.com/#modelbreach/1875108 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,443,152.179.58.165,10.161.1.2,C02Z85AYLVDC,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1875226,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=a4:83:e7:9d:c1:f9;darktraceUrl=https://darktrace.com/#modelbreach/1875226 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,5229,27.220.55.34,112.24.71.20,Galaxy-S6,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1875651,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=00:ae:fa:65:f4:24;darktraceUrl=https://darktrace.com/#modelbreach/1875651 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,443,217.41.245.117,112.24.71.170,LA-365,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1872713,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=f8:ff:c2:04:f8:6a;message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://darktrace.com/#modelbreach/1872713 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,443,187.167.182.111,10.20.30.4,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1874089,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate validation failed with (self signed certificate);darktraceUrl=https://darktrace.com/#modelbreach/1874089 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,443,187.167.182.111,187.167.182.111,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1874090,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate validation failed with (self signed certificate);darktraceUrl=https://darktrace.com/#modelbreach/1874090 ,,,CommonSecurityLog,
|
||||
390,6,,,,,,,,14.74.114.220,14.74.114.220,,,,,,,,,,,,,,,,,4.1,User/Unusual External Source for Credential Use,,,,,,,,,,,,,,,,,,,,,,,,,,1893897,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . Unusual source for use of zanda.ntombela@darktrace.com from AS2905 TICSA-ASN. zanda.ntombela@darktrace.com;darktraceUrl=https://darktrace.com/#modelbreach/1893897 ,,,CommonSecurityLog,
|
||||
349,7,,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,4.1,System/System,,,,,,,,,,,,,,,,,,,,,,,,,,1870730,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . Probe error;darktraceUrl=https://darktrace.com/#modelbreach/1870730 ,,,CommonSecurityLog,
|
||||
26,7,,,,,,,443,201.67.185.30,10.180.18.1,username-XPS-13-9350,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1878552,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=c8:ff:28:b6:2c:d7;darktraceUrl=https://darktrace.com/#modelbreach/1878552 ,,,CommonSecurityLog,
|
||||
26,6,,,,,,,443,201.67.180.22,10.110.10.8,FFMZJD0SJC67,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1878553,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=56:fb:e2:58:37:4a;darktraceUrl=https://darktrace.com/#modelbreach/1878553 ,,,CommonSecurityLog,
|
||||
465,6,,,,,,,443,14.74.114.220,14.74.114.11,,,,,,,,,,,,,,,,,4.1,Antigena/Network/External Threat/Antigena Quarantine Example test client,,,,,,,,,,,,,,,,,,,,,,,,,,1837581,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,darktraceUrl=https://darktrace.com/#modelbreach/1837581 ,,,CommonSecurityLog,
|
||||
26,6,,,,,,,443,14.74.114.220,14.74.114.2,username-XPS-13-9350,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1898432,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,deviceMacAddress=c8:ff:28:b6:2c:d7;darktraceUrl=https://darktrace.com/#modelbreach/1898432 ,,,CommonSecurityLog,
|
||||
17,6,,,,,,,445,127.0. 0.1.22,10.180.80.54,,,,,,,,,,,,,,,,,4.1,Anomalous Server Activity/Anomalous External Activity from Critical Network Device,,,,,,,,,,,,,,,,,,,,,,,,,,1909925,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,darktraceUrl=https://darktrace.com/#modelbreach/1909925 ,,,CommonSecurityLog,
|
||||
26,7,,,,,,,3389,254.169.184.82,10.30.40.20,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1902616,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://darktrace.com/#modelbreach/1902616 ,,,CommonSecurityLog,
|
||||
26,8,,,,,,,3389,254.169.184.82,254.169.184.82,,,,,,,,,,,,,,,,,4.1,Anomalous Connection/Anomalous SSL without SNI to New External,,,,,,,,,,,,,,,,,,,,,,,,,,1902617,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://darktrace.com/#modelbreach/1902617 ,,,CommonSecurityLog,
|
||||
465,5,,,,,,,443,14.74.114.220,120.239.186.158,,,,,,,,,,,,,,,,,4.1,Antigena/Network/External Threat/Antigena Quarantine Example test client,,,,,,,,,,,,,,,motd.ubuntu.com,,,,,,,,,,,1902823,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,darktraceUrl=https://darktrace.com/#modelbreach/1902823 ,,,CommonSecurityLog,
|
||||
|
|
|
@ -0,0 +1,362 @@
|
|||
{
|
||||
"version": "Notebook/1.0",
|
||||
"items": [
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## Darktrace Model Breaches\n---\n\nDisplaying Darktrace model breach summary determined by the Timeframe set below"
|
||||
},
|
||||
"name": "text - 2"
|
||||
},
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "e12ee2fa-c488-4c2f-9463-f6add28055b5",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "Timeframe",
|
||||
"type": 4,
|
||||
"description": "Select a timeframe to display Darktrace model breaches",
|
||||
"value": {
|
||||
"durationMs": 5184000000
|
||||
},
|
||||
"typeSettings": {
|
||||
"selectableValues": [
|
||||
{
|
||||
"durationMs": 300000
|
||||
},
|
||||
{
|
||||
"durationMs": 900000
|
||||
},
|
||||
{
|
||||
"durationMs": 1800000
|
||||
},
|
||||
{
|
||||
"durationMs": 3600000
|
||||
},
|
||||
{
|
||||
"durationMs": 14400000
|
||||
},
|
||||
{
|
||||
"durationMs": 43200000
|
||||
},
|
||||
{
|
||||
"durationMs": 86400000
|
||||
},
|
||||
{
|
||||
"durationMs": 172800000
|
||||
},
|
||||
{
|
||||
"durationMs": 259200000
|
||||
},
|
||||
{
|
||||
"durationMs": 604800000
|
||||
},
|
||||
{
|
||||
"durationMs": 1209600000
|
||||
},
|
||||
{
|
||||
"durationMs": 2419200000
|
||||
},
|
||||
{
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
{
|
||||
"durationMs": 5184000000
|
||||
},
|
||||
{
|
||||
"durationMs": 7776000000
|
||||
}
|
||||
]
|
||||
},
|
||||
"timeContext": {
|
||||
"durationMs": 86400000
|
||||
}
|
||||
}
|
||||
],
|
||||
"style": "pills",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces"
|
||||
},
|
||||
"name": "parameters - 2"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "CommonSecurityLog | where DeviceVendor == \"Darktrace\" | summarize count() by TimeGenerated \n",
|
||||
"size": 0,
|
||||
"title": "Breaches Over Time",
|
||||
"color": "orange",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"timeBrushParameterName": "Timeframe",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"visualization": "timechart",
|
||||
"tileSettings": {
|
||||
"showBorder": false
|
||||
},
|
||||
"graphSettings": {
|
||||
"type": 0,
|
||||
"topContent": {
|
||||
"columnMatch": "LogSeverity",
|
||||
"formatter": 9,
|
||||
"formatOptions": {
|
||||
"palette": "red"
|
||||
}
|
||||
},
|
||||
"nodeIdField": "TimeGenerated",
|
||||
"sourceIdField": "TimeGenerated",
|
||||
"targetIdField": "LogSeverity",
|
||||
"graphOrientation": 3,
|
||||
"showOrientationToggles": false,
|
||||
"nodeSize": null,
|
||||
"staticNodeSize": 100,
|
||||
"colorSettings": null,
|
||||
"hivesMargin": 5
|
||||
},
|
||||
"chartSettings": {
|
||||
"showMetrics": false,
|
||||
"ySettings": {
|
||||
"numberFormatSettings": {
|
||||
"unit": 0,
|
||||
"options": {
|
||||
"style": "decimal",
|
||||
"useGrouping": false,
|
||||
"maximumFractionDigits": 0
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"customWidth": "70",
|
||||
"name": "query - 5"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "CommonSecurityLog | where DeviceVendor == \"Darktrace\" | where isnotempty(DeviceName) | summarize count(Activity) by DeviceName\n\n",
|
||||
"size": 2,
|
||||
"title": "Device Breach Summary",
|
||||
"timeContext": {
|
||||
"durationMs": 5184000000
|
||||
},
|
||||
"timeContextFromParameter": "Timeframe",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"visualization": "piechart",
|
||||
"gridSettings": {
|
||||
"formatters": [
|
||||
{
|
||||
"columnMatch": "count",
|
||||
"formatter": 0,
|
||||
"formatOptions": {
|
||||
"aggregation": "Count"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"chartSettings": {
|
||||
"xAxis": "TimeGenerated"
|
||||
}
|
||||
},
|
||||
"customWidth": "30",
|
||||
"name": "query - 2"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "CommonSecurityLog | where DeviceVendor == \"Darktrace\" | where isnotempty(DeviceName) | top 10 by LogSeverity desc | project DeviceName, DeviceAddress, Activity, LogSeverity",
|
||||
"size": 0,
|
||||
"title": "Top Hitting Devices",
|
||||
"timeContext": {
|
||||
"durationMs": 5184000000
|
||||
},
|
||||
"timeContextFromParameter": "Timeframe",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"gridSettings": {
|
||||
"formatters": [
|
||||
{
|
||||
"columnMatch": "LogSeverity",
|
||||
"formatter": 8,
|
||||
"formatOptions": {
|
||||
"min": 0,
|
||||
"max": 8,
|
||||
"palette": "orange"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "query - 3"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "CommonSecurityLog | where DeviceVendor == \"Darktrace\" | summarize event_count=count() by Activity | where Activity!=\"System/System\" | top 10 by event_count",
|
||||
"size": 0,
|
||||
"title": "Most Breached Models",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"gridSettings": {
|
||||
"formatters": [
|
||||
{
|
||||
"columnMatch": "event_count",
|
||||
"formatter": 3,
|
||||
"formatOptions": {
|
||||
"palette": "orange"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "query - 4"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "\nCommonSecurityLog | where DeviceVendor == \"Darktrace\" | where isnotempty(DestinationHostName) | summarize count(Activity) by DestinationHostName",
|
||||
"size": 0,
|
||||
"title": "Top External Hostnames ",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"visualization": "piechart"
|
||||
},
|
||||
"name": "query - 7"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "\n\nCommonSecurityLog | where DeviceVendor == \"Darktrace\" | where isnotempty(DestinationIP) | where DestinationIP !startswith \"10\"| where DestinationIP !startswith \"192\"| where DestinationIP !startswith \"172\"| summarize event_count=count() by DestinationIP | top 5 by event_count",
|
||||
"size": 2,
|
||||
"title": "Top 5 External IP addresses over 30 days",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"visualization": "categoricalbar",
|
||||
"tileSettings": {
|
||||
"showBorder": false,
|
||||
"titleContent": {
|
||||
"columnMatch": "DestinationIP",
|
||||
"formatter": 1
|
||||
},
|
||||
"leftContent": {
|
||||
"columnMatch": "event_count",
|
||||
"formatter": 12,
|
||||
"formatOptions": {
|
||||
"palette": "auto"
|
||||
},
|
||||
"numberFormat": {
|
||||
"unit": 17,
|
||||
"options": {
|
||||
"maximumSignificantDigits": 3,
|
||||
"maximumFractionDigits": 2
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"graphSettings": {
|
||||
"type": 2,
|
||||
"topContent": {
|
||||
"columnMatch": "DestinationIP",
|
||||
"formatter": 1
|
||||
},
|
||||
"centerContent": {
|
||||
"columnMatch": "event_count",
|
||||
"formatter": 1,
|
||||
"numberFormat": {
|
||||
"unit": 17,
|
||||
"options": {
|
||||
"maximumSignificantDigits": 3,
|
||||
"maximumFractionDigits": 2
|
||||
}
|
||||
}
|
||||
},
|
||||
"hivesContent": {
|
||||
"columnMatch": "DestinationIP",
|
||||
"formatter": 1
|
||||
},
|
||||
"nodeIdField": "DestinationIP",
|
||||
"graphOrientation": 3,
|
||||
"showOrientationToggles": false,
|
||||
"nodeSize": null,
|
||||
"staticNodeSize": 100,
|
||||
"colorSettings": null,
|
||||
"groupByField": "DestinationIP",
|
||||
"hivesMargin": 4
|
||||
},
|
||||
"chartSettings": {
|
||||
"group": "DestinationIP",
|
||||
"createOtherGroup": null,
|
||||
"ySettings": {
|
||||
"numberFormatSettings": {
|
||||
"unit": 0,
|
||||
"options": {
|
||||
"style": "decimal",
|
||||
"useGrouping": true
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"mapSettings": {
|
||||
"locInfo": "LatLong",
|
||||
"sizeSettings": "event_count",
|
||||
"sizeAggregation": "Sum",
|
||||
"legendMetric": "event_count",
|
||||
"legendAggregation": "Sum",
|
||||
"itemColorSettings": {
|
||||
"type": "heatmap",
|
||||
"colorAggregation": "Sum",
|
||||
"nodeColorField": "event_count",
|
||||
"heatmapPalette": "greenRed"
|
||||
}
|
||||
}
|
||||
},
|
||||
"name": "Top Hitting External IP addresses",
|
||||
"styleSettings": {
|
||||
"showBorder": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "CommonSecurityLog | where DeviceVendor == \"Darktrace\" | where Activity contains \"compliance\" | summarize count() by TimeGenerated",
|
||||
"size": 0,
|
||||
"title": "Compliance Breaches Over Time",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"visualization": "linechart"
|
||||
},
|
||||
"name": "query - 8"
|
||||
}
|
||||
],
|
||||
"fallbackResourceIds": [
|
||||
"/subscriptions/20ac8776-c56d-4158-a314-56ed60f9d5d8/resourcegroups/sentinel-testing/providers/microsoft.operationalinsights/workspaces/dev-test-mail-lab"
|
||||
],
|
||||
"fromTemplateId": "sentinel-Darktrace Model Breach Summary",
|
||||
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90.79 99.09">
|
||||
<path d="M79.1,19.2a6.61,6.61,0,1,1,3.81-8.54A6.62,6.62,0,0,1,79.1,19.2Z" transform="translate(0 0)" fill="#2f3a56" opacity="0.65"/>
|
||||
<path d="M88.9,8.36A13.1,13.1,0,0,0,76.74,0a12.84,12.84,0,0,0-4.66.87,13,13,0,0,0-7.51,16.78h0a12.58,12.58,0,0,0,1.74,3.15l-16,15.4a21.76,21.76,0,0,0-30.08,1l-7.72-6.54a3.43,3.43,0,0,0,.23-.52,6.47,6.47,0,0,0-.12-5,6.59,6.59,0,1,0-6,9.26,6.43,6.43,0,0,0,2.66-.57,7.09,7.09,0,0,0,1.08-.6l7.78,6.59a21.75,21.75,0,0,0,17.72,34.4A21.29,21.29,0,0,0,40,73.81l2.9,10.36a7.92,7.92,0,1,0,11.26,4.59v-.05a7.9,7.9,0,0,0-7.54-5.5h-.48L43.25,72.92l.39-.15A21.8,21.8,0,0,0,56.19,44.64a21.22,21.22,0,0,0-3.53-6l16-15.4A13,13,0,0,0,88.9,8.36ZM48,95.53a4.39,4.39,0,0,1-1.39.22,4.58,4.58,0,0,1-1.4-8.94,4.71,4.71,0,0,1,1.4-.22A4.58,4.58,0,0,1,48,95.53Zm-39.74-64a4,4,0,0,1-1.67.36,4.13,4.13,0,1,1,3.77-5.8,4.05,4.05,0,0,1,.08,3.15,4.13,4.13,0,0,1-2.18,2.3ZM42.45,69.65a18.44,18.44,0,1,1,10.24-24c.08.2.16.4.23.6A18.34,18.34,0,0,1,42.45,69.65ZM76.74,22.71a9.68,9.68,0,1,1,3.46-.64A9.68,9.68,0,0,1,76.74,22.71Z" transform="translate(0 0)" fill="#2f3a56"/>
|
||||
<path d="M40.77,65.39a13.76,13.76,0,1,1,7.92-17.78h0a13.77,13.77,0,0,1-7.91,17.78Z" transform="translate(0 0)" fill="#f49c14"/>
|
||||
<path d="M7.39,29.83A2.21,2.21,0,1,1,8.64,27v0h0A2.21,2.21,0,0,1,7.39,29.83Z" transform="translate(0 0)" fill="#2f3a56" opacity="0.65"/>
|
||||
<path d="M47.68,94a3,3,0,1,1,.08,0Z" transform="translate(-1 0)" fill="#2f3a56" opacity="0.65"/>
|
||||
</svg>
|
||||
|
||||
|
После Ширина: | Высота: | Размер: 1.5 KiB |
Двоичный файл не отображается.
|
После Ширина: | Высота: | Размер: 172 KiB |
Двоичный файл не отображается.
|
После Ширина: | Высота: | Размер: 164 KiB |
|
|
@ -1088,8 +1088,21 @@
|
|||
"templateRelativePath": "IntsightsIOCWorkbook.json",
|
||||
"subtitle": "",
|
||||
"provider": "Intsights Cyber Intelligence"
|
||||
},
|
||||
{
|
||||
},
|
||||
{
|
||||
"workbookKey": "DarktraceSummaryWorkbook",
|
||||
"logoFileName": "Darktrace.svg",
|
||||
"description": "A workbook containing relevant KQL queries to help you visualise the data in model breaches from the Darktrace Connector",
|
||||
"dataTypesDependencies": [ "CommonSecurityLog" ],
|
||||
"dataConnectorsDependencies": [ "Darktrace" ],
|
||||
"previewImagesFileNames": [ "DarktraceSummaryWhite.png", "DarktraceSummaryBlack.png" ],
|
||||
"version": "1.0",
|
||||
"title": "Darktrace Model Breach Summary",
|
||||
"templateRelativePath": "DarktraceWorkbook.json",
|
||||
"subtitle": "",
|
||||
"provider": "Darktrace"
|
||||
},
|
||||
{
|
||||
"workbookKey": "TrendMicroXDR",
|
||||
"logoFileName": "trendmicro_logo.svg",
|
||||
"description": "Gain insights from Trend Micro XDR with this overview of the Alerts triggered.",
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче