Correlation: Firewall Traffic from High-Risk Identity (IdentityInfo)

20 CSL Risky Identity Firewall Traffic

Query

let RiskyIdentities =
    IdentityInfo
    | where TimeGenerated > ago(14d)
    | where isnotempty(AccountUPN)
    | summarize
        RiskScore        = max(InvestigationPriority),
        JobTitle         = any(JobTitle),
        Department       = any(Department),
        ManagerUPN       = any(ManagerUPN),
        AccountEnabled   = any(AccountEnabled)
      by AccountUPN;
CommonSecurityLog
| where TimeGenerated > ago(1d)
| where DeviceVendor in ("Fortinet", "Palo Alto Networks", "Zscaler")
| where DeviceAction !in ("deny", "block", "drop", "BLOCK", "DROP")
| where isnotempty(SourceUserName)
| summarize
    FW_RequestCount  = count(),
    FW_BytesSent     = sum(SentBytes),
    FW_BytesRecv     = sum(ReceivedBytes),
    FW_DestIPs       = dcount(DestinationIP),
    FW_Vendors       = make_set(DeviceVendor),
    FW_SrcIPs        = make_set(SourceIP, 5),
    FW_FirstSeen     = min(TimeGenerated)
  by UserName = tolower(SourceUserName)
| join kind=inner RiskyIdentities on $left.UserName == $right.AccountUPN
| extend TotalMBSent = round(toreal(FW_BytesSent) / 1048576, 2)
| project
    UserName,
    JobTitle,
    Department,
    RiskScore,
    FW_RequestCount,
    TotalMBSent,
    FW_DestIPs,
    FW_Vendors,
    FW_SrcIPs
| order by RiskScore desc, TotalMBSent desc

Explanation

This query is part of a scheduled task designed to identify high-risk user accounts that are generating significant traffic through firewalls. Here's a simplified breakdown of what it does:

Purpose: The query aims to correlate firewall/proxy traffic data with user identity information to detect accounts with a high investigation priority that are generating large volumes of traffic. This is important because such activity could indicate potential data exfiltration or lateral movement within a network.
Data Sources: It uses data from Fortinet, Palo Alto, and Zscaler firewalls, as well as user behavior analytics data from Microsoft Sentinel's UEBA (User and Entity Behavior Analytics).
Process:
- It first identifies risky identities from the IdentityInfo table, focusing on accounts with a high investigation priority over the past 14 days.
- It then examines firewall logs from the past day, filtering for traffic that was allowed (not denied, blocked, or dropped).
- The query aggregates data on the number of requests, bytes sent and received, distinct destination IPs, and source IPs for each user.
- It joins this firewall data with the risky identities to find matches.
Output:
- The results include details such as the username, job title, department, risk score, number of requests, total megabytes sent, distinct destination IPs, and firewall vendors involved.
- The output is sorted by risk score and total megabytes sent to prioritize the most critical cases.
Alerts and Incidents:
- If a high-risk user is found to have generated significant traffic, an alert is created with details about the user's activity.
- The alert includes a custom message highlighting the risk and traffic volume, and incidents are created for further investigation.
Configuration:
- The query is set to run every hour and looks back over the past day for relevant data.
- It uses specific tactics and techniques from the MITRE ATT&CK framework to categorize the activity.

Overall, this query helps security teams quickly identify and prioritize investigations into potentially compromised accounts that are generating suspiciously high levels of network traffic.