Storage Alert Correlation with CommonSecurityLogs and StorageLogs

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


This query combines different Storage alerts with CommonSecurityLogs and StorageLogs helping analysts triage and investigate any possible Storage related attacks faster thus reducing Mean Time To Respond

Attribute Value
Type Hunting Query
Solution GitHub Only
ID 7098cae1-c632-4b40-b715-86d6b07720d7
Tactics InitialAccess, LateralMovement
Techniques T1586, T1570
Required Connectors AzureSecurityCenter, Fortinet
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/MultipleDataSources/StorageAlertCorrelationwithCommonSecurityLogsandStorageLogs.yaml)

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
CommonSecurityLog ApplicationProtocol has_any "SSL"
DestinationPort != "161"
DeviceAction !in "close,client-rst,server-rst,deny"
DeviceVendor == "Fortinet"
LogSeverity has_any "2"
SourceIP != "0.0.0.0"
✓ ✓ ✓
SecurityAlert DisplayName has_any "Potential malware uploaded to a storage blob container" ✓ ✗ ✓
StorageBlobLogs ✓ ✗ ✓
StorageFileLogs ✓ ✗ ✓

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
AzureStorageAccount Azure Storage
CefAma Common Event Format
VirtualMetricDirectorProxy VirtualMetric DataStream
VirtualMetricMSSentinelConnector VirtualMetric DataStream
VirtualMetricMSSentinelDataLakeConnector VirtualMetric DataStream

Solutions: Azure Storage, Common Event Format, VirtualMetric DataStream


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries