HUNT 14 Sentinel Config Changes

Query

// Hunt     : Hunt - Sentinel Configuration Changes (Rules, Connectors, Workbooks) (30 Days)
// Tactics  : DefenseEvasion
// MITRE    : T1562
// Purpose  : Full timeline of Sentinel configuration changes: alert rule deletions/modifications, data connector changes, automation rule changes, and workbook modifications. Use to investigate Rule-16 alerts and to audit who modified Sentinel configuration during an incident response window.
//==========================================================================================

let SentinelOps = dynamic([
    "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/DELETE",
    "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE",
    "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS/WRITE",
    "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS/DELETE",
    "MICROSOFT.SECURITYINSIGHTS/AUTOMATIONRULES/WRITE",
    "MICROSOFT.SECURITYINSIGHTS/AUTOMATIONRULES/DELETE",
    "MICROSOFT.SECURITYINSIGHTS/SETTINGS/WRITE",
    "MICROSOFT.SECURITYINSIGHTS/WORKSPACEMANAGERCONFIGURATIONS/WRITE",
    "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/SAVEDSEARCHES/DELETE"
]);
AzureActivity
| where TimeGenerated > ago(30d)
| where OperationNameValue has_any (SentinelOps)
| where ActivityStatusValue =~ "Success"
| extend ChangeCategory = case(
    OperationNameValue has "ALERTRULES"        , "Analytics Rule",
    OperationNameValue has "DATACONNECTORS"    , "Data Connector",
    OperationNameValue has "AUTOMATIONRULES"   , "Automation Rule",
    OperationNameValue has "SETTINGS"          , "Sentinel Settings",
    OperationNameValue has "SAVEDSEARCHES"     , "Saved Search / Hunting Query",
    "Other")
| extend ActionType = iff(OperationNameValue has "DELETE", "Delete", "Create/Modify")
| project
    TimeGenerated,
    Caller,
    CallerIpAddress,
    ChangeCategory,
    ActionType,
    OperationNameValue,
    ResourceId,
    ResourceGroup,
    SubscriptionId
| order by TimeGenerated desc

Explanation

This query is designed to track and analyze changes made to Microsoft Sentinel configurations over the past 30 days. It focuses on identifying successful operations related to alert rules, data connectors, automation rules, and other Sentinel settings. Here's a simple breakdown of what the query does:

Define Operations: It starts by listing specific Sentinel operations that are of interest, such as deleting or modifying alert rules, data connectors, automation rules, and settings.
Filter Activities: It filters the Azure Activity logs to include only those entries from the last 30 days where the operation matches any of the defined Sentinel operations and was successful.
Categorize Changes: Each operation is categorized into a specific type of change, such as "Analytics Rule" for alert rule changes or "Data Connector" for data connector changes.
Determine Action Type: It identifies whether the operation was a "Delete" or a "Create/Modify" action.
Select and Order Data: The query selects relevant details such as the time of the change, who made the change, their IP address, the type of change, and other resource details. It then orders these results by the time the change was made, showing the most recent changes first.

This query is useful for auditing who modified Sentinel configurations during an incident response and for investigating specific alerts related to configuration changes.