Visualize MITRE ATT&CK Techniques on triggered Sentinel incidents
Visualization Incidents Triggered By Mitre Techniques
Query
SecurityIncident
// Collect last argumtent of incident
| summarize arg_max(TimeGenerated, *) by IncidentNumber
| extend
MitreTactic = todynamic(parse_json(AdditionalData).tactics),
MitreTechnique = todynamic(parse_json(AdditionalData).techniques)
// Filter only on incidents that contain Mitre Tactic and Technique
| where MitreTactic != "[]" and MitreTechnique != "[]"
// Add a row for each MitreTactic and MitreTechnique
| mv-expand MitreTactic, MitreTechnique
| extend MitreTactic = tostring(MitreTactic), MitreTechnique = tostring(MitreTechnique)
| project MitreTactic, MitreTechnique
// Count the total incidents by tactic and technique
| summarize count() by MitreTactic, MitreTechnique
| render columnchart with (title="MITRE ATT&CK Techniques triggered by Tactic", ytitle="Total Incidents")About this query
Visualize MITRE ATT&CK Techniques on triggered Sentinel incidents
Query Information
Description
This query visualizes the incidents that have been triggered for each MITRE ATT&CK Tactic and technique. This will give an overview of the amount of techniques that have been triggered for each MITRE ATT&CK tactic. This can give an indication if specific techniques trigger a lot of incidents.
References
Sentinel
Explanation
This query is designed to provide a visual representation of security incidents in Microsoft Sentinel that are associated with specific MITRE ATT&CK tactics and techniques. Here's a simple breakdown of what the query does:
-
Data Collection: It starts by gathering the most recent information for each security incident, ensuring that only the latest details are considered.
-
Extract MITRE Information: The query extracts the MITRE ATT&CK tactics and techniques from the incident data. These are standardized frameworks used to describe the behavior of cyber threats.
-
Filter Relevant Incidents: It filters the incidents to include only those that have associated MITRE tactics and techniques, ensuring that the analysis focuses on incidents with this specific information.
-
Expand Data: For each incident, it creates separate entries for each tactic and technique, allowing for detailed analysis.
-
Count Incidents: The query counts how many incidents are associated with each combination of tactic and technique.
-
Visualization: Finally, it generates a column chart that shows the number of incidents for each tactic and technique combination. This helps in identifying which techniques are most frequently triggering incidents.
Overall, this query helps security analysts understand which MITRE ATT&CK techniques are most commonly associated with security incidents, providing insights into potential areas of concern or focus for cybersecurity efforts.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators