Introduction
In our previous post, we established the foundation for a Microsoft Sentinel environment. Now, we’ll expand its capabilities by incorporating Content Hub solutions. These pre-built solutions accelerate threat detection and investigation.
Deploying Content Hub Solutions
To start, we’ll deploy several essential Content Hub solutions:
Navigate to the Content Management section in your Microsoft Sentinel workspace and select Content Hub.
Search for Windows Security Events and select View details.
Choose the Windows Security Events plan and click Create.
Select the appropriate resource group and workspace, then click Review+Create.
Repeat steps 2-4 for Azure Activity and Microsoft Defender for Cloud solutions.
Configuring Data Connectors
To effectively leverage these solutions, we need to set up data connectors:
Azure Activity Data Connector
In the Content Hub, filter for Installed solutions and select Azure Activity.
Choose Manage and then Open connector page.
Under Instructions, click Launch Azure Policy Assignment Wizard.
Select your subscription and resource group.
In the Parameters tab, choose your Log Analytics workspace.
In the Remediation tab, enable Create a remediation task and ensure the System Assigned Identity location is correct.
Click Review+Create.
Defender for Cloud Data Connector
Return to the Content Hub and select the Microsoft Defender for Cloud solution.
Choose Manage and then Open connector page.
Locate your subscription and enable the Connected slider.
Ensure By-directional sync is enabled.
If you encounter issues, verify that you have a pricing plan enabled for your subscription in the Microsoft Defender portal.
Creating an Analytics Rule
To proactively identify potential threats, let’s create an analytics rule:
Go to the Analytics section in Microsoft Sentinel.
Under Rule templates, search for “Suspicious number of resource creation or deployment activities”.
Click the ellipsis and select Create rule.
In the General tab click “Next: Set rule logic >.”
In the Query Scheduling section, set the query to run every hour and look up data from the last hour.
Save the rule.
Adding Azure Activity Workbook
To gain valuable insights, we’ll add the Azure Activity workbook:
In the Content Hub, filter for Installed solutions and select Azure Activity.
Choose Manage and then Configuration.
Select Azure Activity, choose your region, and click Save.
Summary
By following these steps, you’ve significantly enhanced your Microsoft Sentinel environment.
In the next post, we’ll explore how to configure a data connector data collection rule.