收集 Microsoft Defender for Identity 日志

本文档介绍了如何使用 Azure 存储将 Microsoft Defender for Identity 日志注入到 Google Security Operations。解析器会处理 JSON 日志，如果 JSON 解析失败，则会处理 CEF 格式的日志。它会提取字段，执行字符串转换、重命名和合并等数据转换，并将这些字段映射到统一数据模型 (UDM)，从而处理各种日志格式，并使用标签和身份验证详细信息等其他上下文来丰富数据。

准备工作

请确保满足以下前提条件：

• Google SecOps 实例
• 有效的 Azure 租户
• 对 Azure 的特权访问权限和管理安全角色

配置 Azure 存储账号

1. 在 Azure 控制台中，搜索存储账号。
2. 点击创建。
3. 为以下输入参数指定值：
   • 订阅：选择相应订阅。
   • 资源组：选择资源组。
   • 区域：选择相应区域。
   • 效果：选择效果类型（建议选择标准）。
   • 冗余：选择冗余类型（建议选择 GRS 或 LRS）。
   • 存储账号名称：为新存储账号输入一个名称。
4. 点击 Review + create（检查 + 创建）。
5. 查看账号概览，然后点击创建。
6. 在存储账号的概览页面上，选择安全性 + 网络中的子菜单访问密钥。
7. 点击 key1 或 key2 旁边的显示。
8. 点击复制到剪贴板以复制密钥。

9. 将密钥保存在安全的位置，以备日后参考。

10. 在存储账号的概览页面中，选择设置中的子菜单终结点。

11. 点击复制到剪贴板，复制 Blob 服务端点网址。（例如：https://<storageaccountname>.blob.core.windows.net）。

12. 将端点网址保存在安全的位置，以供日后参考。

13. 依次前往概览 > JSON 视图。

14. 复制并保存存储空间资源 ID。

为 Microsoft Defender for Identity 配置日志导出

1. 使用特权账号登录 Defender 门户。
2. 转到设置。
3. 选择 Microsoft Defender XDR 标签页。
4. 从“常规”部分中选择 Streaming API，然后点击添加。
5. 选择将事件转发到 Azure Storage。
6. 提供以下配置详细信息：
   • 名称：输入一个唯一且有意义的名称。
   • 选择将事件转发到 Azure Storage。
   • 存储账号资源 ID：输入之前复制的 Azure 存储资源 ID。
   • 事件类型：同时选择提醒和行为以及设备。
7. 点击提交。

设置 Feed

您可以通过两种不同的入口点在 Google SecOps 平台中设置 Feed：

• SIEM 设置 > Feed > 添加新 Feed
• 内容中心 > 内容包 > 开始

如何设置 Microsoft Defender for Identity Feed

1. 点击 Microsoft Defender 包。

2. 指定以下值：

   • 来源类型：Microsoft Azure Blob Storage V2。

   • Azure URI：Blob 端点网址。

     ENDPOINT_URL/BLOB_NAME

     替换以下内容：

     • ENDPOINT_URL：Blob 端点网址。(https://<storageaccountname>.blob.core.windows.net)
     • BLOB_NAME：blob 的名称。（例如 insights-logs-<logname>）

   • 源删除选项：根据您的偏好选择删除选项。

   • 文件存在时间上限：包含在过去指定天数内修改的文件。默认值为 180 天。

   • 共享密钥：Azure Blob Storage 的访问密钥。

   高级选项

   • Feed 名称：用于标识 Feed 的预填充值。
   • 资源命名空间：与 Feed 关联的命名空间。
   • 提取标签：应用于相应 Feed 中所有事件的标签。

3. 点击创建 Feed。

   如需详细了解如何为相应产品系列中的不同日志类型配置多个 Feed，请参阅按产品配置 Feed。

支持的 Microsoft Defender For Identity 示例日志

• JSON - 高级搜索

  {
   "time": "2025-02-05T02:01:49.9837340Z",
   "tenantId": "00000000-0000-0000-0000-000000000000",
   "operationName": "Publish",
   "category": "AdvancedHunting-IdentityDirectoryEvents",
   "_TimeReceivedBySvc": "2025-02-05T02:00:23.0990817Z",
   "properties": {
    "ActionType": "SMB file copy",
    "Protocol": "Smb",
    "AccountName": null,
    "AccountDomain": null,
    "AccountUpn": null,
    "AccountSid": null,
    "AccountObjectId": null,
    "AccountDisplayName": null,
    "DeviceName": "HOST-SOURCE",
    "IPAddress": "10.10.10.5",
    "DestinationDeviceName": "HOST-DEST",
    "TargetDeviceName": null,
    "Location": null,
    "ISP": "INTERNAL_NETWORK",
    "Port": 445,
    "DestinationPort": 64589,
    "DestinationIPAddress": "10.10.10.5",
    "TargetAccountUpn": null,
    "TargetAccountDisplayName": null,
    "AdditionalFields": {
     "ActionTypeInner": "smbfilecopy",
     "Count": "4",
     "Category": "Lateral Movement",
     "AttackTechniques": "Remote Services (T1021), Lateral Tool Transfer (T1570), SMB/Windows Admin Shares (T1021.002)",
     "FilePath": "dns\\dns.log",
     "FileName": "dns\\dns.log",
     "FileSize": "138373233",
     "Method": "Read",
     "SourceComputerObjectGuid": "11111111-1111-1111-1111-111111111111",
     "SourceComputerOperatingSystem": "windows server 2016 standard",
     "SourceComputerOperatingSystemVersion": "10.0 (14393)",
     "SourceComputerOperatingSystemType": "windows",
     "DestinationComputerObjectGuid": "22222222-2222-2222-2222-222222222222",
     "DestinationComputerOperatingSystem": "windows server 2016 standard",
     "DestinationComputerOperatingSystemVersion": "10.0 (14393)",
     "DestinationComputerOperatingSystemType": "windows",
     "SourceComputerId": "33333333-3333-3333-3333-333333333333",
     "SourceComputerSid": "S-1-5-21-REDACTED-SID",
     "FROM.DEVICE": "HOST-SOURCE",
     "TO.DEVICE": "HOST-DEST",
     "ACTOR.DEVICE": "HOST-SOURCE"
    },
    "ReportId": "44444444-4444-4444-4444-444444444444",
    "Timestamp": "2025-02-05T02:00:01.335347Z",
    "Application": "Active Directory"
   },
   "Tenant": "DefaultTenant"
  }
  

• SYSLOG + CEF

  <36>1 2022-06-29T01:55:03.819108+00:00 SYSLOG_HOST CEF 5556 RemoteExecutionSecurityAlert 0|
  Microsoft|
  Azure ATP|
  2.183.15420.19379|
  RemoteExecutionSecurityAlert|
  Remote code execution attempt|
  5|
  start=2022-06-29T01:50:43.1995560Z|
  app=Wmi, WinRm|
  shost=SRC_HOST|
  shostfqdn=src_host.domain.lan|
  msg=Service Account, SVC_ACCOUNT made 5 attempts to run commands remotely on 38 domain controllers from SRC_HOST using 1 WMI method,4 PowerShell commands.|
  externalId=2019|
  cs1Label=url|
  cs1=https://security.microsoft.com/alerts/sanitized_alert_id|
  cs2Label=trigger|
  cs2=update|
  cs3Label=mSecUrl|
  cs3=https://security.microsoft.com/alerts/sanitized_alert_id
  

• JSON - 记录批次

  {
    "records": [
      {
        "time": "2024-08-21T11:46:25.1024982Z",
        "tenantId": "00000000-0000-0000-0000-000000000000",
        "operationName": "Publish",
        "category": "AdvancedHunting-IdentityDirectoryEvents",
        "_TimeReceivedBySvc": "2024-08-21T11:44:07.0952670Z",
        "properties": {
          "ActionType": "Directory Services replication",
          "Protocol": "Drsr",
          "AccountName": null,
          "AccountDomain": null,
          "AccountUpn": null,
          "AccountSid": "S-1-5-21-REDACTED-SID",
          "AccountObjectId": null,
          "AccountDisplayName": null,
          "DeviceName": "HOST-DEVICE",
          "IPAddress": "10.10.10.20",
          "DestinationDeviceName": "HOST-DEST",
          "TargetDeviceName": null,
          "Location": null,
          "ISP": "INTERNAL_NETWORK",
          "Port": 64464,
          "DestinationPort": 1066,
          "DestinationIPAddress": "10.10.10.30",
          "TargetAccountUpn": null,
          "TargetAccountDisplayName": null,
          "AdditionalFields": {
            "Count": "2",
            "Category": "Credential Access",
            "AttackTechniques": [
              "OS Credential Dumping (T1003)",
              "DC Sync (T1003.006)",
              "NTDS (T1003.003)"
            ],
            "IsSuccess": "True",
            "ARG.TASK": "Directory Services replication",
            "SourceAccountId": "11111111-1111-1111-1111-111111111111",
            "SourceAccountSid": "S-1-5-21-REDACTED-SID",
            "SourceComputerObjectGuid": "22222222-2222-2222-2222-222222222222",
            "SourceComputerOperatingSystem": "windows server 2022 standard",
            "SourceComputerOperatingSystemVersion": "10.0 (20348)",
            "SourceComputerOperatingSystemType": "windows",
            "DestinationComputerObjectGuid": "33333333-3333-3333-3333-333333333333",
            "DestinationComputerOperatingSystem": "windows server 2016 standard",
            "DestinationComputerOperatingSystemVersion": "10.0 (14393)",
            "DestinationComputerOperatingSystemType": "windows",
            "SourceComputerId": "44444444-4444-4444-4444-444444444444",
            "SourceComputerSid": "S-1-5-21-REDACTED-SID",
            "ACTOR.ACCOUNT": "MSOL_REDACTED",
            "ACTOR.ENTITY_USER": "",
            "FROM.DEVICE": "HOST-SRC",
            "TO.DEVICE": "HOST-DEST",
            "ACTOR.DEVICE": "HOST-SRC"
          },
          "ReportId": "55555555-5555-5555-5555-555555555555",
          "Timestamp": "2024-08-21T11:41:12.700159Z",
          "Application": "Active Directory"
        },
        "Tenant": "DefaultTenant"
      }
    ]
  }
  

• JSON - Azure Monitor / 活动

  {
    "RoleLocation": "West Europe",
    "Stamp": "FDWeb",
    "ReleaseVersion": "6.2025.3.31+fc19adc.release_2025w03",
    "time": "2025-02-20T23:47:55.8304991Z",
    "resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/SANITIZED_RG/PROVIDERS/MICROSOFT.NETWORK/LOADBALANCERS/SANITIZED-LB",
    "operationName": "MICROSOFT.AUTHORIZATION/POLICIES/MODIFY/ACTION",
    "category": "Administrative",
    "resultType": "Success",
    "resultSignature": "Succeeded.",
    "durationMs": "0",
    "callerIpAddress": "10.10.10.40",
    "correlationId": "11111111-1111-1111-1111-111111111111",
    "identity": {
      "authorization": {
        "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sanitized_rg/providers/Microsoft.Network/loadBalancers/sanitized-lb",
        "action": "Microsoft.Network/loadBalancers/write",
        "evidence": {
          "role": "Contributor",
          "roleAssignmentScope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/SANITIZED_RG",
          "roleAssignmentId": "22222222222222222222222222222222",
          "roleDefinitionId": "33333333333333333333333333333333",
          "principalId": "REDACTED_PRINCIPAL_ID",
          "principalType": "ServicePrincipal"
        }
      },
      "claims": {
        "aud": "https://management.core.windows.net/",
        "iss": "https://sts.windows.net/00000000-0000-0000-0000-000000000000/",
        "iat": "1740087743",
        "nbf": "1740087743",
        "exp": "1740174443",
        "aio": "REDACTED_AIO",
        "appid": "REDACTED_APPID",
        "appidacr": "2",
        "http://schemas.microsoft.com/identity/claims/identityprovider": "https://sts.windows.net/00000000-0000-0000-0000-000000000000/",
        "idtyp": "app",
        "http://schemas.microsoft.com/identity/claims/objectidentifier": "44444444-4444-4444-4444-444444444444",
        "rh": "REDACTED_RH",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "55555555-5555-5555-5555-555555555555",
        "http://schemas.microsoft.com/identity/claims/tenantid": "00000000-0000-0000-0000-000000000000",
        "uti": "REDACTED_UTI",
        "ver": "1.0",
        "xms_idrel": "7 12",
        "xms_mirid": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/sanitized_rg/providers/Microsoft.ContainerService/managedClusters/sanitized_cluster",
        "xms_tcdt": "1461941593"
      }
    },
    "level": "Information",
    "properties": {
      "isComplianceCheck": "False",
      "resourceLocation": "westeurope",
      "ancestors": "DataPlatform,LandingZone,REDACTED_ANCESTOR,00000000-0000-0000-0000-000000000000",
      "policies": [
        {
          "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/REDACTED/providers/Microsoft.Authorization/policyDefinitions/REDACTED_ID",
          "policySetDefinitionId": "/providers/Microsoft.Management/managementGroups/REDACTED/providers/Microsoft.Authorization/policySetDefinitions/REDACTED_ID",
          "policyDefinitionReferenceId": "Inherit A Tag From Resource Group And Overwrite Existing_1",
          "policySetDefinitionName": "REDACTED_ID",
          "policySetDefinitionDisplayName": "Inherit All Tags From Resource Group And Overwrite Existing",
          "policySetDefinitionVersion": "1.0.0",
          "policyDefinitionName": "REDACTED_ID",
          "policyDefinitionDisplayName": "Inherit A Tag From Resource Group And Overwrite Existing",
          "policyDefinitionVersion": "1.0.0",
          "policyDefinitionEffect": "modify",
          "policyAssignmentId": "/providers/Microsoft.Management/managementGroups/REDACTED/providers/Microsoft.Authorization/policyAssignments/REDACTED_ID",
          "policyAssignmentName": "REDACTED_ID",
          "policyAssignmentDisplayName": "Inherit All Tags From Resource Group And Overwrite Existing",
          "policyAssignmentScope": "/providers/Microsoft.Management/managementGroups/REDACTED",
          "policyExemptionIds": [],
          "policyEnrollmentIds": []
        }
      ],
      "tenantId": "00000000-0000-0000-0000-000000000000"
    }
  }
  

UDM 映射表

更新日志

查看相应解析器的更改日志

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。