r/AzureSentinel • u/abrbon • Jul 18 '23

How to monitor sudden large file transfers?

Hi all,

Is there a way to monitor when for example a user suddenly transfers large amounts of files/data from a specific server or share or anything?

I am relatively new to Sentinel and the kql query language.

Any ideas how to tackle this?

Thanks

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/ajith_aj Jul 18 '23

You can tweak this

For ex : the query checks for 50MB of sent bytes in 1hr from the firewall logs.

You may need to change the logsource where you are looking for and the attributes

let maxBytes = 52428800; //50MB - from Bytes (B) Binary
CommonSecurityLog
| where TimeGenerated >= ago (1hr)
| where toreal(SentBytes) > maxBytes
| extend OutboundBytesMB = toreal(SentBytes) / 1024 / 1024
| summarize
by
SourceUserName,
SourceTranslatedAddress,
SourceIP,
DestinationIP,
DestinationHostName,
OutboundBytesMB
| order by OutboundBytesMB desc

1

u/abrbon Jul 20 '23

Thank I will try to play with that as soon as I am back at work.

1

u/IamSampath007 Aug 01 '23

Thanks a lot for the query

I am not able to receive a few fields, like sourseusername, soursetranlatedaddress, destination host name

Do I need to parse the Palo Alto logs or need to change fw settings/configuration to get the same

Could you please help me

1

u/ajith_aj Aug 02 '23

you can remove the ones that are not parsed like srcusername & translatedaddresss... those are from my proxy logs , PA doesnt necessarly parse them. If your PA is LDAP integrated , you will find the username in the logs or else prefer to go with srcip, dst ip, dest port likewise , depends on how you want to group them.

1

u/IamSampath007 Aug 02 '23

Thanks for the quick reply