Free SC-200 Exam Braindumps
Microsoft Security Operations Analyst Questions 153–160 (page: 21)

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom#set-automated-responses-and-create-the-rule https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Explanation:

Entity mapping is an integral part of the configuration of scheduled query analytics rules. It enriches the rules' output (alerts and incidents) with essential information that serves as the building blocks of any investigative processes and remedial actions that follow.
Scenario: Implement a Microsoft Sentinel scheduled rule that generates incidents based on rulequery1. Implement a query named rulequery1 that will include the following KQL query.

Note: Alert enrichment * Use the Entity mapping configuration section to map parameters from your query results to Microsoft Sentinel-recognized entities. Entities enrich the rules' output (alerts and incidents) with essential information that serves as the building blocks of any investigative processes and remedial actions that follow. They are also the criteria by which you can group alerts together into incidents in the Incident settings tab.
* Use the Custom details configuration section to extract event data items from your query and surface them in the alerts produced by this rule, giving you immediate event content visibility in your alerts and incidents.
* Use the Alert details configuration section to override default values of the alert's properties with details from the underlying query results. Alert details allow you to display, for example, an attacker's IP address or account name in the title of the alert itself, so it will appear in your incidents queue, giving you a much richer and clearer picture of your threat landscape.

Reference:

https://learn.microsoft.com/en-us/azure/sentinel/map-data-fields-to-entities https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom

Explanation:

Box 1: Smart lockout Scenario: Ensure that higher than normal volumes of password resets for corp.adatum.com user accounts are detected.
Protect user accounts from attacks with Microsoft Entra smart lockout Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute-force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources. Attackers get locked out, while your users continue to access their accounts and be productive.
How smart lockout works By default, smart lockout locks an account from sign-in after:
10 failed attempts in Azure Public and Microsoft Azure operated by 21Vianet tenants 3 failed attempts for Azure US Government tenants The account locks again after each subsequent failed sign-in attempt. The lockout period is one minute at first, and longer in subsequent attempts. To minimize the ways an attacker could work around this behavior, we don't disclose the rate at which the lockout period increases after unsuccessful sign-in attempts.
Box 2: User and Entity Behavior Analytics (UEBA) Discover the power of UEBA anomalies in Microsoft Sentinel Every event that goes through our UEBA engine, will be enriched with lots of contextual and behavioral information, based on info we get from entity providers (AD, AAD), TI repositories (Microsoft Interflow), and of course our own ever-updating dynamic ML modules. All this goodness will be exposed to the BehavioralAnalytics table you can find in Log Analytics.
UEBA set different baselines for each entity, that changes all the time – to make sure we create sensitive and accurate thresholds when it comes to anomaly detection. For example, for one user 10 wrong password login attempts will be considered “too many” in a certain timeframe, and for another user it will be only 2 attempts. So, it’s not only that UEBA considers different behavioral profiling per organization, it also considers it per entity.

Reference:

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/discover-the-power-of-ueba-anomalies-in-microsoft-sentinel/ba-p/3576185

Explanation:

Scenario: Implement an Advanced Security Information Model (ASIM) query that will return a count of DNS requests that results in an NXDOMAIN response from Infoblox1.
Box 1: Im_Dns The Advanced Security Information Model (ASIM) DNS normalization schema reference
The DNS information model is used to describe events reported by a DNS server or a DNS security system, and is used by Microsoft Sentinel to enable source-agnostic analytics.
Guidelines for collecting DNS events DNS is a unique protocol in that it may cross a large number of computers. Also, since DNS uses UDP, requests and responses are de-coupled and aren't directly related to each other.
If your data source supports full DNS logging and you've chosen to log multiple segments, adjust your queries to prevent data duplication in Microsoft Sentinel.
For example, you might modify your query with the following normalization:
_Im_Dns | where SrcIpAddr != "127.0.0.1" and EventSubType == "response"
Box 2: The WHERE clause

Reference:

https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-dns

Explanation:

Scenario: Implement the Windows Security Events via AMA connector for Microsoft Sentinel and configure it to monitor the Security event log of Server1.
Windows Security Events via AMA connector for Microsoft Sentinel The connector uses the Azure Monitor Agent (AMA), which uses Data Collection Rules (DCRs). With DCRs, you can filter the logs before they're ingested, for quicker upload, efficient analysis, and querying.

Reference:

https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-ama

Explanation:

Scenario: Implement a Microsoft Sentinel near-real-time (NRT) analytics rule that detects sign-ins to a designated break glass account.
Box 1: join An inner join.
Box 2: _GetWatchlist If you don’t want to automatically remediate all your roles, you could put the ones you want to target into a Watchlist and complete a lookup on that first. The role names and role ids are the same for all Azure AD tenants, so you can get them here. Create a Watchlist, in this example called PrivilegedAADRoles with the names and ids of the ones you wish to monitor and remediate. Then just query on assignments to groups in your Watchlist.


Now we can include being in that Watchlist as part of the logic we will use when we write our query.
Now we can include being in that Watchlist as part of the logic we will use when we write our query. Keep in mind you will still get logs for any assignments outside of PIM, we are just limiting the scope here for our remediation.
let AADRoles = (_GetWatchlist("PrivilegedAADRoles")|project AADRoleId); AuditLogs | where OperationName startswith "Add member to role outside of PIM" | extend AADRoleDisplayName = tostring(TargetResources[0].displayName) | extend AADRoleId = tostring(AdditionalDetails[0].value) | extend AADUserAdded = tostring(TargetResources[2].displayName) | extend AADObjectId = tostring(TargetResources[2].id) | extend UserWhoAdded = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName) | where AADRoleId in (AADRoles) | project OperationName, AADRoleDisplayName, AADRoleId, AADUserAdded, AADObjectId, UserWhoAdded
Incorrect: * external_table * materialized_view

Reference:

https://learnsentinel.blog/tag/kusto/page/2/