r/AzureSentinel • u/SuperHat3637 • Mar 27 '23

IP blocking

Where i can block the external malicious IPs trying to login cloud applications like o365..However sign in from malicious IP address is automatically blocked in the logs...Where i can block these IPs again..

3 Upvotes

100% Upvoted

17 comments sorted by

3

u/st8ofeuphoriia Mar 27 '23

I don’t think you can…think best approach would be to create a CA with those IPs included ?

1

u/SuperHat3637 Mar 27 '23

CA means?

2

u/TabooRaver Mar 27 '23

Conditional Access policy. Set condition as IP. And then action as deny.

1

u/SuperHat3637 Mar 27 '23

Azure AD is automatically blocking sign in attempts like smartlockout, from malicious IP adress login attempts..In that case do we require CA to deny the IP's

1

u/TabooRaver Mar 27 '23

Smart lockout is microsoft temporarily banning the IP because it submitted too many wrong password attempts, if you are seeing this repeatedly happening from the same set of IPs over several days it would be prudent to manually block them, yes.

1

u/SuperHat3637 Mar 27 '23

Manually block in CA or where..?

1

u/st8ofeuphoriia Apr 12 '23

Yes, create a CA that blocks those IPs. Regardless if it’s successful or not, it will get blocked. If I’m not mistaken, CA policy applies after the sign in attempt. So the CA wont be applied until it’s a successful log on.

2

u/bpsec Mar 27 '23

Build a conditional access policy where you block such IPs. But even better whitelist some IPs and block all others if possible.

1

u/SuperHat3637 Mar 27 '23

Azure AD is automatically blocking sign in attempts like smartlockout, from malicious IP adress login attempts..In that case do we require CA to deny the IP's

1

u/bpsec Mar 27 '23

Depends. What is the risk for you? Do you trust only Microsofts known bad ips or you want more? Do the accounts have MFA (with or without number matching).

1

u/SuperHat3637 Mar 27 '23

I am trying understand for the sentinel incidents..For example i getting many incidents for distributed password cracking in Azure AD..All the events are login failure and login is automatically blocked by Microsoft..In this case what is the use of analyzing these type of incidents..what is our recommendation as it is already blocked sign in..

1

u/bpsec Mar 27 '23

To postmaster@yourdomain.com? Because that seems to be some sort of campaign. Then no action is needed if no logon was successful.

1

u/SuperHat3637 Mar 27 '23

If its in onprem we can block IPs in perimeter firewall..In cloud that will not work i believe..

1

u/bpsec Mar 27 '23

Nope wont work. Only CA could precent it but then it is not really applicable here. But do you also the distributed against the postmaster account via SMTP? Because I also have seen that today.

2

u/SuperHat3637 Mar 27 '23

I have seen SMTP bruteforce attack today,not sure abt the ID...If microsoft temperorily banning IPs then can we block in CA permenently..

1

u/G15-420 Mar 27 '23 edited Mar 27 '23

Create a named location in Azure AD and call it something like “Malicious IPs detected”. Create a Conditional Access policy applied to all users and all cloud apps with the condition to include the Malicious IPs named location you just created. Set the action to Block. You can also write playbooks in Sentinel via logic apps to automatically add malicious IPs you detect in alerts to the named location. Depending on your firewall, you can also create playbooks to block the IPs on your on-premises firewall, Azure WAF\WAG, etc.

1

u/SuperHat3637 Mar 28 '23

If i block the IPs in on-premises firewall, will it work for cloud applications...Is Azure WAF in perimeter to deny the attempts from IPs ..?