Storage Alerts Correlation with CommonSecurityLogs & AuditLogs

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


This query combines different Storage alerts with CommonSecurityLogs and AuditLogs helping analysts investigate any possible storage related attacks faster thus reducing Mean Time To Respond

Attribute Value
Type Hunting Query
Solution GitHub Only
ID 860a8df2-8d19-4c60-bf61-de1c02422797
Tactics InitialAccess, Impact
Techniques T1190, T1078
Required Connectors AzureSecurityCenter, Fortinet, AzureActiveDirectory
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/MultipleDataSources/StorageAlertCorrelationwithCommonSecurityLogsandAuditLogs.yaml)

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AuditLogs LoggedByService == "Core Directory" ✓ ✗ ✓
CommonSecurityLog ApplicationProtocol has_any "SSL"
DestinationPort != "161"
DeviceAction !in "close,client-rst,server-rst,deny"
DeviceVendor == "Fortinet"
LogSeverity has_any "2"
SourceIP != "0.0.0.0"
✓ ✓ ✓
SecurityAlert AlertName has_any "Access from a suspicious IP to a storage file share" ✓ ✗ ✓

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
AzureActiveDirectory Microsoft Entra ID
CefAma Common Event Format
VirtualMetricDirectorProxy VirtualMetric DataStream
VirtualMetricMSSentinelConnector VirtualMetric DataStream
VirtualMetricMSSentinelDataLakeConnector VirtualMetric DataStream

Solutions: Common Event Format, Microsoft Entra ID, VirtualMetric DataStream


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries