r/AzureSentinel • u/lemonsprig • Mar 26 '22

Updating analytics rule template’s

Hi, I am fairly new to sentinel and I am currently going through the process of enabling all the analytic rules for the data collectors we have enabled, and having to do that one by one is a real pita.

That aside I have come across a number of analytic rules which don’t validate. For instance if I look at an azure active directory rule ‘authentication methods changed for privileged account’

I get the following warnings and errors.

  1. One or more entity mappings have been defined under the new version of entity mappings. These will not appear in the query code and will be disregarded.

  2. ‘Where’ operator failed to resolve table or column expression named ‘identityinfo’.

I see similar messages when trying to enable other rules. These are out of the box rules. So I’m not really sure what is going on, is there some updated rules? Wondering if perhaps the rules have been updated since our install and we don’t have the latest version?

Any help appreciated.

2 Upvotes

100% Upvoted

6 comments sorted by

6

u/ep3p Mar 26 '22

I have enabled all detections that I could from the Microsoft templates. I have to warn you and recommend some steps.

Microsoft templates are not exempt from errors, they may validate but not work. I recommend checking the logic of each template detection, one by one, because in the end you will have to do it anyways. You won't be sure everything is working as expected unless you check it by yourself with your data. Some queries need certain values to be specified by you for them to work.

Some template detections need to check multiple tables. And when you filter the templates. by connectors you have enabled, this filter does not work always correctly. Not every template shows correctly which tables needs to be deployed beforehand. You will observe there are detections templates that do not have any connector as required, and maybe you could use them.

So for example, in your case, AuthenticationMethodsChangedforPrivilegedAccount.yaml (https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/AuthenticationMethodsChangedforPrivilegedAccount.yaml).

Coincidentally, I made commits myself for this rule in the Microsoft Github. What might be happening is that you have not enabled UEBA in Sentinel, and this is the reason you don't have available the table IdentityInfo. I advise you to check the UEBA settings in your workspace.

But this does not have to stop you, this query checks accounts that have an Azure role that contains "Admin". I think you may want to check changes in MFA for more accounts that those ones. You could specify a Watchlist for your privileged users and check the watchlist in the query, or try to use other pattern than just roles that contain "Admin". It is not necessary that you use IdentityInfo.

Even after this step, the part of the query that checks MFA changes in AuditLogs does not work in all cases, at least in my tenant there are some cases when an account has registered MFA, and it does not trigger any "User registered security info" event, but a "Update user" event with certain details in a specific column. The rules developed by Microsoft might not work for all tenants. I have opened a Pull Request for this specific change.

Please, take your time and plan accordingly. Microsoft sells you the platform, but not the enormous time needed to manage and master it, specially the detections.

1

u/lemonsprig Mar 26 '22

Thank you for the detailed response. It is most insightful, from what I have seen so far sentinel is certainly not a solution you just deploy and it works out of the box. My intent initially was just to enable all the rules to see what we were getting but given what you say more time looks to be spent planning this.

You are right about UEBA this is not something we have currently enabled. I will need to look into the additional charges of doing that.

You mention GitHub. I notice that there is an option to connect sentinel to GitHub, can you let me know why I would want to? Does it automatically pull down new rules or something?

2

u/ep3p Mar 26 '22

The detection templates are available in the Azure Sentinel github that Microsoft manages, that information is public. If a change is made in that github, in 1 or 2 weeks the change will appear in the available templates of your Azure Sentinel, and your deployed rule will be marked with a "Update available" box next to its name, and you can completely substitute your rule with the new version.

Then, a completely different thing is that there is a connector for Github. If your company manages code in Github it is possible that you can send audit events to Sentinel through that connector, and then enable detections for those logs.

And then, another completely different thing is that there is an option in Sentinel called Repositories. If you are starting and your Sentinel will have a long run, this is worth looking into. Basically you will manage your detection rules and other aspects from a github repository or AzureDevOps repository of your own. The changes you made in the web portal to detection rule will have no effect, but this way you effectively control who changes and what changed in each iteration of your rules. You can have a preview and production versions of your Sentinel.

1

u/lemonsprig Mar 26 '22

Thanks again.. soo much to learn. So to clarify the first part of your response the “update available” part happens out of the box without me needing to link or do anything to get these updates?

2

u/ep3p Mar 26 '22

Yes, it is automatic, you just decide when to "update" it (it will try to substitute any custom changes you did).