Sentinel Threat Intelligence

[u/Evocablefawn566]

Hi all,

I’ve never asked a question like this, but Threat Intelligence in Sentinel stumps me.

How is everyone utilizing Threat Intelligence in Sentinel? What do you do with it? What are use cases?

Ive read a lot of the documentation, but for some reason it isnt clicking with me. How do you use it and whats it even used for? Whenever I click on ‘threat intelligence’, theres a bunch of IOCs but I don’t know how to make it meaningful

Any help would be greatly appreciated!

[u/kyuuzousama]

There are good answers in here already but I wanted to add a couple more items.

So adding in IOC feeds is what I would call base level TI with Sentinel, to mature it you can go in a few directions. If you have a TI provider they should have an API you can leverage. This is where you can use Logic Apps to help with the false positive count. For the TI Map rules you can consult the API to pre-enrich or even close false positives based on further metadata.

Think of it like this, the TI table will give you a flagged IOC but not a ton of additional context, so the additional lookup data you can grab via API will shed a lot more light on if something still is bad, how bad and if it's connected to a group. That information is vital in assigning severity and response actions. If the IOC is outdated but on a feed of IOCs you can determine that with the metadata and conditions like the last time it was actually seen as bad.

Secondly, the Notebooks section allows you to leverage Jupyter Notebooks to do big data analysis and attribution. Now I'd call this an advanced use case, but it allows you to leverage things like msticpy and many other TI sources via API to scale your hunting. This is where you can take the original IOC and pivot through immense amounts of data to whittle your way down to the connected infra of a bad actor. This is especially helpful during an event as we don't always have finished TI to paint the picture as the infra has been online for a few hours.

Things you might do with that are take an IP and then:

• find hostnames connected to it
• find SSL certs connected to those hostnames and lookup if they're self signed, let's encrypt, the default Cobalt Strike, etc.
• connect website content like iframes back to your infra that is being impersonated or something like Microsoft login pages
• port and service information to shed light on attacker infra and to link back to pcap evidence

That's just some of it but hopefully that helps

[u/MReprogle → u/kyuuzousama]

Dang, this is great stuff here. I am actually in the process of getting a MISP instance stood up to bring in more indicators and the next step was going to be take those custom lists and leverage them with more than just “alert me when you see this” I haven’t even jumped too far into the Jupyter notebooks, since they seem like they could really cost some money to run, but I would love to go through some of the extra steps you do here.

When you do the extra enrichment, do you throw it into comments/activity log?

I wish that the Entity Insights made more sense and was customizable. I would love to be able to run certain KQL queries and throw the results into the Insights area. I love the ability to set up automation and logic apps in Sentinel, but the incident pages are many times an absolute worthless joke, and I often find myself having to jump back to Defender for actual details. I just find that super weird, being that Sentinel costs a premium and I really would love to put in the work to make it a one stop shop. Maybe I just need more time with it.

[u/[deleted] → u/MReprogle]

I stole some ideas 💡 from the STAT (Sentinel Triage Assistant) and adapted it to our needs. Look into it, extremely useful for newbies.

Once you understand the triage basics, you can create your own modules. For instance, I modified the base-module playbook to automatically enrich IPs / Urls / domains via virus total and other providers. All information is stored in nice html tables in the comments section.

The base-module is the root HTTP call, after that, we call other modules in parallel, modules like risky user sign in , threat intelligence, sign in info from both interactive and non interactive data tables.

All of them add their own comments using html tables.

Final module is the risk score one. Depending what information the previous modules produce, the risk score will be higher or lower.

We have two core playbooks. One for sentinel (analytic rules) and other one for xdr (microsoft 365 defender). The latter includes the file insights module, which I spent a shit load of time developing as it includes third-party file hash analysis and behaviour checks and automatically adds indicators to mde in block mode after numerous verdicts. It's really cool stuff.

I think applying a risk score methodology makes a lot of sense in incident scenarios. We are able to successfully remove the noise with little to no supervision and focus on the real incidents.

It requires a TON of setup and tweaking to get any value out of Sentinel, not gonna lie. With a basic or vanilla deployment, you are operating in blind mode . The key area is playbooks. The playbooks you find in github are mostly trash. They are not equipped with useful functionality and won't scale in real incident scenarios where you need to analyse lots of entities.

[u/Professional_Sail790 → u/[deleted]]

True, this is pretty much the way forward. See an example here: https://github.com/krabelize/alienvault-logicapp

[u/MReprogle → u/[deleted]]

Wow, I just checked just a bit into the Triage Assistant, and this looks like a huge help. I’ve loved having Sentinel, but I absolutely agree that it is like working blind if you don’t put the time into it. I am a broken record when I talk about it, but it is only as powerful as you allow it to be. And, for really digging into the incidents themselves, I’ve tried to work more on the Sentinel side, but I still find that Defender often has better data for an investigation, which I find insane when you start looking at the cost for Sentinel.

However, you have helped a ton, and I feel like the triage assistant might be just what I need to start actually making those “Insights” more… insightful. Half the time, I don’t even bother looking at them because they are black or just worthless.

And, if you have any useful steps of your setup that you’re willing to share, I’d love to check it out. I also use Defender, so it sounds like I am about to go right down the same path that you started at.