收集 Microsoft Defender for Identity 記錄

本文說明如何使用 Azure 儲存空間，將 Microsoft Defender for Identity 記錄檔擷取至 Google Security Operations。剖析器會處理 JSON 記錄檔，如果 JSON 剖析失敗，則會處理 CEF 格式的記錄檔。這項服務會擷取欄位、執行字串轉換、重新命名及合併等資料轉換作業，並將資料對應至統合式資料模型 (UDM)，處理各種記錄格式，以及使用標籤和驗證詳細資料等額外內容來擴充資料。

事前準備

請確認您已完成下列事前準備事項：

• Google SecOps 執行個體
• 有效的 Azure 租用戶
• Azure 的特殊權限和管理員安全角色

設定 Azure 儲存體帳戶

1. 在 Azure 控制台中，搜尋「Storage accounts」(儲存體帳戶)。
2. 點選「建立」。
3. 指定下列輸入參數的值：
   • 「訂閱」：選取訂閱方案。
   • 資源群組：選取資源群組。
   • 區域：選取區域。
   • 效能：選取效能類型 (建議選取「標準」)。
   • 備援：選取備援類型 (建議使用 GRS 或 LRS)。
   • 「儲存空間帳戶名稱」：輸入新儲存空間帳戶的名稱。
4. 按一下「Review + create」。
5. 查看帳戶總覽，然後按一下「建立」。
6. 在儲存空間帳戶的「總覽」頁面中，選取「安全性 + 網路」中的「存取金鑰」子選單。
7. 按一下「key1」或「key2」旁邊的「顯示」。
8. 按一下「複製到剪貼簿」即可複製金鑰。

9. 將金鑰儲存於安全的位置，以供日後參考。

10. 在儲存體帳戶的「總覽」頁面中，選取「設定」中的「端點」子選單。

11. 按一下「複製到剪貼簿」，複製 Blob 服務端點網址。例如 https://<storageaccountname>.blob.core.windows.net。

12. 將端點網址儲存在安全的位置，以供日後參考。

13. 依序前往「總覽」>「JSON 檢視畫面」。

14. 複製並儲存 Storage Resource ID。

設定 Microsoft Defender for Identity 的記錄匯出功能

1. 使用具備權限的帳戶登入 Defender 入口網站。
2. 前往 [設定]。
3. 選取「Microsoft Defender XDR」分頁標籤。
4. 從一般部分選取「Streaming API」，然後按一下「新增」。
5. 選取「將事件轉送至 Azure 儲存空間」。
6. 請提供下列設定詳細資料：
   • 名稱：輸入不重複且有意義的名稱。
   • 選取「將事件轉送至 Azure 儲存空間」。
   • 儲存體帳戶資源 ID：輸入先前複製的 Azure 儲存體資源 ID。
   • 活動類型：選取「快訊和行為」和「裝置」。
7. 按一下「提交」。

設定動態饋給

在 Google SecOps 平台中設定動態饋給時，有兩種不同的進入點：

• 依序點選「SIEM 設定」>「動態饋給」>「新增」
• 依序點選「內容中心」「內容包」「開始使用」

如何設定 Microsoft Defender for Identity 動態饋給

1. 按一下「Microsoft Defender」套件。

2. 指定下列值：

   • 來源類型：Microsoft Azure Blob 儲存體 V2。

   • Azure URI：Blob 端點網址。

     ENDPOINT_URL/BLOB_NAME

     更改下列內容：

     • ENDPOINT_URL：Blob 端點網址。(https://<storageaccountname>.blob.core.windows.net)
     • BLOB_NAME：Blob 的名稱。(例如 insights-logs-<logname>)

   • 來源刪除選項：根據偏好設定選取刪除選項。

   • 檔案存在時間上限：納入在過去天數內修改的檔案。預設值為 180 天。

   • 共用金鑰：Azure Blob 儲存體的存取金鑰。

   進階選項

   • 動態饋給名稱：系統預先填入的值，用於識別動態饋給。
   • 資產命名空間：與動態饋給相關聯的命名空間。
   • 擷取標籤：套用至這個動態饋給所有事件的標籤。

3. 點選「建立動態饋給」。

   如要進一步瞭解如何為這個產品系列中的不同記錄類型設定多個動態饋給，請參閱「依產品設定動態饋給」。

支援的 Microsoft Defender For Identity 記錄檔範例

• JSON - 進階搜尋

  {
   "time": "2025-02-05T02:01:49.9837340Z",
   "tenantId": "00000000-0000-0000-0000-000000000000",
   "operationName": "Publish",
   "category": "AdvancedHunting-IdentityDirectoryEvents",
   "_TimeReceivedBySvc": "2025-02-05T02:00:23.0990817Z",
   "properties": {
    "ActionType": "SMB file copy",
    "Protocol": "Smb",
    "AccountName": null,
    "AccountDomain": null,
    "AccountUpn": null,
    "AccountSid": null,
    "AccountObjectId": null,
    "AccountDisplayName": null,
    "DeviceName": "HOST-SOURCE",
    "IPAddress": "10.10.10.5",
    "DestinationDeviceName": "HOST-DEST",
    "TargetDeviceName": null,
    "Location": null,
    "ISP": "INTERNAL_NETWORK",
    "Port": 445,
    "DestinationPort": 64589,
    "DestinationIPAddress": "10.10.10.5",
    "TargetAccountUpn": null,
    "TargetAccountDisplayName": null,
    "AdditionalFields": {
     "ActionTypeInner": "smbfilecopy",
     "Count": "4",
     "Category": "Lateral Movement",
     "AttackTechniques": "Remote Services (T1021), Lateral Tool Transfer (T1570), SMB/Windows Admin Shares (T1021.002)",
     "FilePath": "dns\\dns.log",
     "FileName": "dns\\dns.log",
     "FileSize": "138373233",
     "Method": "Read",
     "SourceComputerObjectGuid": "11111111-1111-1111-1111-111111111111",
     "SourceComputerOperatingSystem": "windows server 2016 standard",
     "SourceComputerOperatingSystemVersion": "10.0 (14393)",
     "SourceComputerOperatingSystemType": "windows",
     "DestinationComputerObjectGuid": "22222222-2222-2222-2222-222222222222",
     "DestinationComputerOperatingSystem": "windows server 2016 standard",
     "DestinationComputerOperatingSystemVersion": "10.0 (14393)",
     "DestinationComputerOperatingSystemType": "windows",
     "SourceComputerId": "33333333-3333-3333-3333-333333333333",
     "SourceComputerSid": "S-1-5-21-REDACTED-SID",
     "FROM.DEVICE": "HOST-SOURCE",
     "TO.DEVICE": "HOST-DEST",
     "ACTOR.DEVICE": "HOST-SOURCE"
    },
    "ReportId": "44444444-4444-4444-4444-444444444444",
    "Timestamp": "2025-02-05T02:00:01.335347Z",
    "Application": "Active Directory"
   },
   "Tenant": "DefaultTenant"
  }
  

• SYSLOG + CEF

  <36>1 2022-06-29T01:55:03.819108+00:00 SYSLOG_HOST CEF 5556 RemoteExecutionSecurityAlert 0|
  Microsoft|
  Azure ATP|
  2.183.15420.19379|
  RemoteExecutionSecurityAlert|
  Remote code execution attempt|
  5|
  start=2022-06-29T01:50:43.1995560Z|
  app=Wmi, WinRm|
  shost=SRC_HOST|
  shostfqdn=src_host.domain.lan|
  msg=Service Account, SVC_ACCOUNT made 5 attempts to run commands remotely on 38 domain controllers from SRC_HOST using 1 WMI method,4 PowerShell commands.|
  externalId=2019|
  cs1Label=url|
  cs1=https://security.microsoft.com/alerts/sanitized_alert_id|
  cs2Label=trigger|
  cs2=update|
  cs3Label=mSecUrl|
  cs3=https://security.microsoft.com/alerts/sanitized_alert_id
  

• JSON - Records Batch

  {
    "records": [
      {
        "time": "2024-08-21T11:46:25.1024982Z",
        "tenantId": "00000000-0000-0000-0000-000000000000",
        "operationName": "Publish",
        "category": "AdvancedHunting-IdentityDirectoryEvents",
        "_TimeReceivedBySvc": "2024-08-21T11:44:07.0952670Z",
        "properties": {
          "ActionType": "Directory Services replication",
          "Protocol": "Drsr",
          "AccountName": null,
          "AccountDomain": null,
          "AccountUpn": null,
          "AccountSid": "S-1-5-21-REDACTED-SID",
          "AccountObjectId": null,
          "AccountDisplayName": null,
          "DeviceName": "HOST-DEVICE",
          "IPAddress": "10.10.10.20",
          "DestinationDeviceName": "HOST-DEST",
          "TargetDeviceName": null,
          "Location": null,
          "ISP": "INTERNAL_NETWORK",
          "Port": 64464,
          "DestinationPort": 1066,
          "DestinationIPAddress": "10.10.10.30",
          "TargetAccountUpn": null,
          "TargetAccountDisplayName": null,
          "AdditionalFields": {
            "Count": "2",
            "Category": "Credential Access",
            "AttackTechniques": [
              "OS Credential Dumping (T1003)",
              "DC Sync (T1003.006)",
              "NTDS (T1003.003)"
            ],
            "IsSuccess": "True",
            "ARG.TASK": "Directory Services replication",
            "SourceAccountId": "11111111-1111-1111-1111-111111111111",
            "SourceAccountSid": "S-1-5-21-REDACTED-SID",
            "SourceComputerObjectGuid": "22222222-2222-2222-2222-222222222222",
            "SourceComputerOperatingSystem": "windows server 2022 standard",
            "SourceComputerOperatingSystemVersion": "10.0 (20348)",
            "SourceComputerOperatingSystemType": "windows",
            "DestinationComputerObjectGuid": "33333333-3333-3333-3333-333333333333",
            "DestinationComputerOperatingSystem": "windows server 2016 standard",
            "DestinationComputerOperatingSystemVersion": "10.0 (14393)",
            "DestinationComputerOperatingSystemType": "windows",
            "SourceComputerId": "44444444-4444-4444-4444-444444444444",
            "SourceComputerSid": "S-1-5-21-REDACTED-SID",
            "ACTOR.ACCOUNT": "MSOL_REDACTED",
            "ACTOR.ENTITY_USER": "",
            "FROM.DEVICE": "HOST-SRC",
            "TO.DEVICE": "HOST-DEST",
            "ACTOR.DEVICE": "HOST-SRC"
          },
          "ReportId": "55555555-5555-5555-5555-555555555555",
          "Timestamp": "2024-08-21T11:41:12.700159Z",
          "Application": "Active Directory"
        },
        "Tenant": "DefaultTenant"
      }
    ]
  }
  

• JSON - Azure Monitor / 活動

  {
    "RoleLocation": "West Europe",
    "Stamp": "FDWeb",
    "ReleaseVersion": "6.2025.3.31+fc19adc.release_2025w03",
    "time": "2025-02-20T23:47:55.8304991Z",
    "resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/SANITIZED_RG/PROVIDERS/MICROSOFT.NETWORK/LOADBALANCERS/SANITIZED-LB",
    "operationName": "MICROSOFT.AUTHORIZATION/POLICIES/MODIFY/ACTION",
    "category": "Administrative",
    "resultType": "Success",
    "resultSignature": "Succeeded.",
    "durationMs": "0",
    "callerIpAddress": "10.10.10.40",
    "correlationId": "11111111-1111-1111-1111-111111111111",
    "identity": {
      "authorization": {
        "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sanitized_rg/providers/Microsoft.Network/loadBalancers/sanitized-lb",
        "action": "Microsoft.Network/loadBalancers/write",
        "evidence": {
          "role": "Contributor",
          "roleAssignmentScope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/SANITIZED_RG",
          "roleAssignmentId": "22222222222222222222222222222222",
          "roleDefinitionId": "33333333333333333333333333333333",
          "principalId": "REDACTED_PRINCIPAL_ID",
          "principalType": "ServicePrincipal"
        }
      },
      "claims": {
        "aud": "https://management.core.windows.net/",
        "iss": "https://sts.windows.net/00000000-0000-0000-0000-000000000000/",
        "iat": "1740087743",
        "nbf": "1740087743",
        "exp": "1740174443",
        "aio": "REDACTED_AIO",
        "appid": "REDACTED_APPID",
        "appidacr": "2",
        "http://schemas.microsoft.com/identity/claims/identityprovider": "https://sts.windows.net/00000000-0000-0000-0000-000000000000/",
        "idtyp": "app",
        "http://schemas.microsoft.com/identity/claims/objectidentifier": "44444444-4444-4444-4444-444444444444",
        "rh": "REDACTED_RH",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "55555555-5555-5555-5555-555555555555",
        "http://schemas.microsoft.com/identity/claims/tenantid": "00000000-0000-0000-0000-000000000000",
        "uti": "REDACTED_UTI",
        "ver": "1.0",
        "xms_idrel": "7 12",
        "xms_mirid": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/sanitized_rg/providers/Microsoft.ContainerService/managedClusters/sanitized_cluster",
        "xms_tcdt": "1461941593"
      }
    },
    "level": "Information",
    "properties": {
      "isComplianceCheck": "False",
      "resourceLocation": "westeurope",
      "ancestors": "DataPlatform,LandingZone,REDACTED_ANCESTOR,00000000-0000-0000-0000-000000000000",
      "policies": [
        {
          "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/REDACTED/providers/Microsoft.Authorization/policyDefinitions/REDACTED_ID",
          "policySetDefinitionId": "/providers/Microsoft.Management/managementGroups/REDACTED/providers/Microsoft.Authorization/policySetDefinitions/REDACTED_ID",
          "policyDefinitionReferenceId": "Inherit A Tag From Resource Group And Overwrite Existing_1",
          "policySetDefinitionName": "REDACTED_ID",
          "policySetDefinitionDisplayName": "Inherit All Tags From Resource Group And Overwrite Existing",
          "policySetDefinitionVersion": "1.0.0",
          "policyDefinitionName": "REDACTED_ID",
          "policyDefinitionDisplayName": "Inherit A Tag From Resource Group And Overwrite Existing",
          "policyDefinitionVersion": "1.0.0",
          "policyDefinitionEffect": "modify",
          "policyAssignmentId": "/providers/Microsoft.Management/managementGroups/REDACTED/providers/Microsoft.Authorization/policyAssignments/REDACTED_ID",
          "policyAssignmentName": "REDACTED_ID",
          "policyAssignmentDisplayName": "Inherit All Tags From Resource Group And Overwrite Existing",
          "policyAssignmentScope": "/providers/Microsoft.Management/managementGroups/REDACTED",
          "policyExemptionIds": [],
          "policyEnrollmentIds": []
        }
      ],
      "tenantId": "00000000-0000-0000-0000-000000000000"
    }
  }
  

UDM 對應表

變更記錄

查看這個剖析器的變更記錄

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。