CollatedDeployment.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "existingWorkspaceName": {
      "type": "string",
      "metadata": {
        "description": "The name of the Sentinel workspace where the automation rule will be deployed"
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "dd2d345e-f6c2-44d9-91ba-6aa502710690",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Dynamics 365 - User Bulk Retrieval Outside Normal Activity",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','59a1c412-43aa-4405-89bc-bd5358c4341d')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>UserId, IPs</strong> and <strong>UserAgents</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich UserIPAddress",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP in from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul><div><strong>\ufeff</strong></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review UserId account sign-ins for suspicious activity",
              "description": null
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is this activity expected and approved?</li><li>Confirm if user's are responsible for the bulk retrieval and/or suspicious logins (It is recommended not to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager).</li></ul>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins or rule creation, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred and remediate as required.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "a54af85c-f18c-4d76-9034-87efab0b4b1d",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - User agent search for log4j exploitation attempt",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','0cb768af-eb6b-4774-970e-a52dd3f337be')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div><div><br></div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Extract the entity details from the alert.</li><li>Check all the activities that are associated with the identified entities, such as UserAgent and IP address(s).</li><li>Use the following KQL as a template</li></ul><pre  spellcheck=\"false\">AzureDiagnostics\n|where TimeGenerated between (todatetime('yyyy-mm-ddT00:00:00.000Z')..todatetime('yyyy-mm-ddT00:00:00.000Z'))\n|where * has \"0.0.0.0\"\n</pre><div><br></div><ul><li>This will show any activity related to the incident including request Uri, message details, hostnames, etc.</li><li>Examine the UserAgent information which is under \u201cdetails_data_s\u201d field.</li><li>Perform a lookup on the IP address(s) noted via a tool to determine if it is malicious.</li></ul><div>              Following tools can be useful in this scenario.</div><div>              o&nbsp;&nbsp;VirusTotal</div><div>              o  AbuseIPDB</div><div>              o&nbsp;&nbsp;IPQualityScore</div><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the IP address is malicious or the UserAgent is not known, follow the standard operating procedures for handling suspicious activities, such as</li></ul><div>            o&nbsp;&nbsp;Confirming with the relevant teams if the activity is approved/expected.</div><div>            o&nbsp;&nbsp;Blocking any IP addresses that are found malicious.</div><div>            o&nbsp;&nbsp;If found malicious, revoking any active sessions.</div><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "e71fd4cf-9e08-4404-a2e7-9f6b314f9db2",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Rare RDP Connections",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','8fffceed-6f16-42ac-aff2-3d2c02a9c732')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Gather Entity details",
              "description": "<div><span style=\"background-color: rgb(255, 255, 255);\">Check the entities to gather details of the devices/hostnames, IP address(s) and account names involved in the RDP activity.&nbsp;</span></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check the IP address of the source ",
              "description": "<ul><li>Use IP database to verify the IP address or to determine if it is malicious.&nbsp;</li></ul><div><br></div><div><br></div><div><br></div><pre  spellcheck=\"false\">SecurityEvent&nbsp;\n|where TimeGenerated between ((todatetime('2022-11-14T23:25:10.3951708Z')-5m)..(todatetime('2022-11-28T23:25:10.3951708Z')+5m))&nbsp;\n|where * has \"&lt;accountName&gt;\" and * has \"&lt;hostName&gt;\" and * has \"&lt;IP address&gt;\"&nbsp;\n|summarize count(), make_set(IpAddress) by Computer, TargetUserName, TargetServerName, Process, Activity&nbsp;\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check the source and activity ",
              "description": "<ul><li>If the IP address is local and account name is known or identifiable, verify with the account user of the activity.&nbsp;</li><li>If the activity is a successful logon event and source is unknown, escalate the incident for further investigation.&nbsp;</li></ul><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><ul><li>Following KQL can be used to identify the user's details.</li></ul><pre  spellcheck=\"false\">IdentityInfo\n|where * has \"&lt;accountName&gt;\"\n</pre>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "e7141384-de23-411b-bc95-4cc8378cfa25",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Attempts to sign in to disabled accounts",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','37f068ad-9155-4afe-a1fd-09a377aadf81')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Query and review each account's recent sign-in activity",
              "description": "<div><strong>Using the previously recorded accounts, use a KQL query to investigate the account's recent sign-in activity.</strong></div><div>An example query template (read each line to understand what it does):</div><pre  spellcheck=\"false\">SigninLogs&nbsp;//Replace with AADNonInteractiveUserSignInLogs to see automatic sign ins (Applications)\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n//| where IPAddress in (\"[IP]\")//Pivot on IP\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre><div>Note: Sign-ins that failed on CAP or MFA suggests first stage authentication (such as password) was successful and <em>may</em> be an indication of compromised credentials.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if attempts are malicious",
              "description": "<div>Based on the results from the previous query, determine if the attempts are from a malicious actor or from an application (like Teams or Outlook) on the device that the user of the disabled account was signed in on. If the attempts are malicious, pivot on the IP to determine if there are any successful sign ins from said IP.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><div><strong><span class=\"ql-cursor\">\ufeff</span></strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "65b75d97-0be9-4047-a2c4-482a0939024c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - User login from different countries within 3 hours (Uses Authentication Normalization)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b279d270-77fb-4915-838d-b8f1ecbd9f88')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident entities and extract account(s)",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div><div>To list all users in the alert:</div><pre  spellcheck=\"false\">SecurityAlert\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\n| where SystemAlertId in(\"[SystemAlertId]\")\n| mv-expand todynamic(Entities)\n| project UserPrincipalName = tostring(Entities.DisplayName)\n</pre><div>Temporarily store the accounts listed (such as in a text file)</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Query and review each account's recent sign-in activity",
              "description": "<div><strong>Using the previously recorded accounts, use a KQL query to investigate the account's recent sign-in activity.</strong></div><div>An example query template (read each line to understand what it does):</div><pre  spellcheck=\"false\">SigninLogs&nbsp;\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre><div>Note: Sign-ins that failed on CAP or MFA suggests first stage authentication (such as password) was successful and <em>may</em> be an indication of compromised credentials.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify suspicious sign-in activity",
              "description": "<div><strong>Identify suspicious activity by looking for anomalies such as:</strong></div><ul><li>Activity from an unexpected country or region (Refer to TimeGenerated and Location values).</li><li>Unfamiliar IP address.</li><li>Impossible travel.</li><li>Single factor/legacy auth sign-ins should be considered suspicious.</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<div><strong>Confirm if the user is using a VPN or travelling.</strong></div><div>It is recommended not to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "bb1e441a-01d9-4bb8-99f5-d7c4184fdc4e",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Azure AD Role Management Permission Grant",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','5f7b1037-32b5-4efc-b1ee-840a9d976fa8')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm that the service principal should be allowed \"Role Management\" rights",
              "description": null
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><div><br></div><div><br></div><div><br></div><ul><li>Revoking \"Role Management\" privileges for the affected service principal.</li><li>Further investigate how the service principle got compromised</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "fa308ec2-3cd1-4839-8cd0-e351820c0ae9",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - M2131_RecommendedDatatableUnhealthy",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','1b522e9d-ab3e-4cbe-9e2b-975d826b4bd2')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Assess Data Table",
              "description": "<div>Check whether the listed unhealthy data tables are meant to be seen in current Sentinel environment.</div><ul><li>If the data table(s) are not currently being ingested by design, this rule may become noisy.</li></ul><div> </div><div><br></div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Assess Connectors",
              "description": "<div>Check on Data Connector status for the relevant Data Table.</div><ul><li>A list can be found here: <a href=\"https://learn.microsoft.com/en-gb/azure/sentinel/data-connectors-reference#microsoft\" rel=\"noopener noreferrer\" target=\"_blank\">Find your Microsoft Sentinel data connector | Microsoft Learn</a></li></ul><div><br></div><div>If not already configured, Data Connector Health can be monitored, see the following links:</div><ul><li><a href=\"https://learn.microsoft.com/en-us/azure/sentinel/enable-monitoring\" rel=\"noopener noreferrer\" target=\"_blank\">Turn on auditing and health monitoring in Microsoft Sentinel | Microsoft Learn</a></li><li><a href=\"https://learn.microsoft.com/en-us/azure/sentinel/monitor-data-connector-health\" rel=\"noopener noreferrer\" target=\"_blank\">Monitor the health of your Microsoft Sentinel data connectors | Microsoft Learn</a></li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Assess Context",
              "description": "<div>If Data Connectors are meant to be connected but weren't, check the timeframe they were down and any Azure Activity logs at that time. These can be found by going to:</div><ul><li>Sentinel &gt; Settings &gt; Workspace Settings &gt; Activity Log</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Escalate Issue",
              "description": "<div>If the activity looks to be unknown/unplanned/suspicious, escalate issue as per standard operating procedures.</div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "9c1d6580-cc84-43d5-a48e-dff56becea6e",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Account Created and Deleted in Short Timeframe",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','672d0101-ce9f-4fa1-8650-4b46d057273b')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate Alert",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check entity details and activity",
              "description": "<ul><li>Grab the entity details involved in the account creation/deletion.</li><li>Use the following KQL to look at the activity more specifically.</li></ul><pre  spellcheck=\"false\">AuditLogs\n|where TimeGenerated between ((todatetime('&lt;startTime&gt;')-5m)..(todatetime('endTime')+5m))\n|where OperationName has_any(\"Delete user\",\"Add user\", \"Update user\")\n|where * has \"&lt;displayName or accountName&gt;\"\n|extend CreatedByUser = tostring(InitiatedBy.user.userPrincipalName), CreatedByIPAddress = tostring(InitiatedBy.user.ipAddress)\n|extend CreatedByApp = tostring(InitiatedBy.app.displayName)\n|extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check IP address",
              "description": "<ul><li>If the accounts were updated by a user, perform a check on the IP address to determine if they are clean.</li><li>If the IP address is malicious or is from outside of Australia, verify with the account user. (Note: IP addresses of Microsoft or similar services will likely have IP addresses outside of Australia)</li><li>If the IP address is found to be malicious or the changes were not approved by an admin, escalate the incident for further investigation.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "8fdb0d11-b9e2-403f-b9e6-d3ce71f058e0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Multiple users email forwarded to same destination",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','e3dc0ad0-9331-4187-96f2-05419110d635')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>UserId</strong>, <strong>DestinationMailAddress, ClientIP</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich ClientIP",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP in from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul><div><strong>\ufeff</strong></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review UserId account sign-ins for suspicious activity",
              "description": null
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the <strong>DestinationMailAddress</strong> an inbox you would expect to see with this behaviour?</li><li>Confirm if user's are responsible for the creation of the forwarding rules and/or suspicious logins (It is recommended not to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager).</li></ul><div><br></div><div><br></div><div><br></div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins or rule creation, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review inbox rules, removing rules where necessary.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "9eeda985-ec49-435d-b699-c0bccedf224f",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Potential Fodhelper UAC Bypass (ASIM Version)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','d4eaff60-318e-4b64-a96c-bf276011df91')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>Account</strong>, <strong>Dvc</strong>, <strong>Computer</strong>, <strong>CommandLine</strong>, <strong>ProcessName</strong>, <strong>ObjectName</strong>, <strong>ObjectValueName</strong> will likely be relevant in developing an accurate conclusion.</div><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Registry Schema and the ASMIN Process Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was there suspicious activity leading up to the incident?</li><li>Is this expected and approved behaviour in your organisation?</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for remediation, some actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Review responsible account/device's recent sign-ins and activities</li><li>Isolate device</li><li>Disable responsible account</li><li>Stop and quarantine the responsible file(s)</li><li>Search for similar behaviour in other devices across your organisation</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "3d13152b-88e7-430a-8843-63eda3d33b05",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Non Domain Controller Active Directory Replication",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','bdf26b6f-5671-4120-a769-fdf4276d453d')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review Alert Details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><br></div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACYAAAAmCAYAAACoPemuAAAFjElEQVRYhc2YW2xURRjHf3POnt09bXfbbYF2F1tFsdoUUrSmEHkoaqIhUWlM1Grw8qTxwWjU+GC8EmOCxvjgJTwYr4kxRE1QUaOIEFAgqUoEsSgVqKHaC9vL3s5tzviwBam72y5YC/9ks5nJZL7f+c83c745QjkTiuR+EJxTCpD8ETZ2QvBso0xVAKHnoc45sGLy55gCQJvaLAQTGoSq5ohmUkqCl5nSNRVMApEE3LAHtH+trZj8qROTzSLY8G744gbQObkJizimQ0ViFqOWofCCgq4iOabAd05xTLH3T4vXdo3x6zEbw9Toaq3ipqUR4lXG7ID5TjlggIDjOZ/Nv0xwaMTjo30ZGkJhYsEorqt4e3eOz3tzXNtcQUNU45al1WXFT6VSRCKRssZqRXuFYPthm+e+nGDnQUX7vBoao2FaGgxaG4K01lZhSpN3dlk89tlx/hgvfOITklLS09NDV1cXGzZsKAuqNBiQc30ujIVpjBpIpUg7ktuuCLOq2WDC9jENjUvqTOorDcYsWTLAunXrWLVqFZs2baK/v/+/g2kCsq5kwvbIuh4ZVxI0QAjIuB5px2PccXGkj1bifeb7Pi0tLaxfv57Kyko0rWS4AhXPMfKnQc6ThDQNBNiuwlfgKUXGlaAJHAkICAVKZYSgu7sbyDvn++Wf3CXBbE8xarkYmoYQ+fa45TOak2SlRHiClO0jgj4XxIrvTiHyTuZyudOCmhZsRVMYT/ikHElAA1/Bq9+OkbIVUvnkPEHSdmmOaQS02S9Niq+BUrTMC9C1pJK+UYuczAMuiQdJRDVSjmTU8sh6Hvctj8061DRg+b8HV9ZRXyP4Y8LG9iXb+jJ8P5Aj5UqSlsvDnTHWtJZ3LlmWheu6/xFsUk01Bu91L6Q+KhhIOew4kuHnQZu06/JQZw2Pdtahi5mXUQjB4sWLqa+vLxusZI6d0PJGkw/WNvLC9hHe+34MFDx53QIev3p+2UHC4TB79uyZnePiVC2Lh3nr5oV0NJokogY3lbl8pyoYPL1KtCwwAEMXPLCy7rSBzlTlezvHOi0wBWQcH9efzSqxuKYFO56VvLhjhIGUB4DlKZ7dOsyu/uyME2ddn7Rz5peHacF2HsnwyMZjfLhvAgClFL8nHcZz/wR0ZKF7jlS82TPGuz+M40266/qq6NhSKlkoKmBzb5pbVtSy/UiG+1bECAiBoQvChmA0J3lqyzCHR23uvjxGV2uUl3aM8Ffaw9A0Nh9MYXk+F8QCzK8K8Mp3STxf8fzqBhLRmfdcyUKxd0RydMzl5TVxHE/xTV+GYECgCYEr4Zmvh1AK1rbV8EbPKPsHLV7vGWMo7dHVGqE9EWbl+ZUsS5g8vWWYppjBPR0xKozy3qslllLw8YE0B4ZsXt2dZO+fFp/0pgDQNcg6PjuP5Dg6YvPlb2mGM5KjSZeL64Lcf2UdyxtNFtUGaa0PEY8EWN1cxba+DL8MOUTCellghZ5qkHUkWw6luX1ZNZfOD3FvR4xPe/OghibQdWhZEKI9EeKu9hgjWYmhCYSA0KQjtlRIO5+Ld1xew1UXVXLnxmNUhzW622a+IxSCBTV29GWwpOLpa+ZjGnlTf/rLZmtfBkMXVId0bmur5omvBtk3YNFcH6a7rZqgLk4WAB3nmTzx1RCLag0Gxj36By1qTI2mmvJuVoVgjqKjyeT9W6MnoQBeWxNH+goFREMapqERjwRIZjyaF4RIRAK8fGOcWjO/VNe3RDivOkBVSCeoCw4Ohlg0L8gl80JnCOZDrNLk31VWXUVhblyWCE9pxyP/TKcLaF9onmwvKlHlAoW3/qJgSkJ2oOjg/03WUEHXVDAdyA3ARy1zRDQpJQssKuKYD/bEHBGdohk/QxUZdDYUQEkofcM/axLn6sfhvwGl5SRe9N2vGQAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>Confirm if the IP address(s), domains, and account names are known to the organisation.</li><li>If the actions or the entities are acting outside of the normal operating hours or if the entity details are unknown, then it should be escalated and further investigated.</li><li>Use the following KQL as a guide.</li></ul><div><br></div><pre  spellcheck=\"false\">SecurityAlert\n|summarize arg_max(TimeGenerated, *) by SystemAlertId\n|where SystemAlertId in(\"&lt;alertID&gt;\")&nbsp;\n|project Entities\n|extend Entities = todynamic(Entities)\n|mv-expand Entities\n|evaluate bag_unpack(Entities)\n</pre>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "6c9fdffa-1834-4121-81fe-3c510abfd5f3",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Network Port Sweep from External Network (ASIM Network Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','65305b9c-7fd2-400c-ad14-e4cf993efac5')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": " Extract and investigate entities",
              "description": "<div><strong>Double check the external entities via enrichment</strong></div><div><br></div><div>Confirm whether the IP (and port) appears malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Network Session Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review related network activity and assess need for remediation",
              "description": "<div><strong>Review activity relating to the suspicious IP and port activity, this could include:</strong></div><ul><li>Sign-in activity</li><li>Device connections</li><li>Firewall logs</li></ul><div><br></div><div>To scope the recorded interactions involved with the external IP address you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT IP&gt;\"\n| summarize count() by $table\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediation (if required)",
              "description": "<div><strong>Follow remediation Standard Operative Procedures, actions may include:</strong></div><ul><li>Blocking/sink holing the IP/domain at the gateway/firewall level</li><li>Isolating and scanning device</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "ee6194f3-34cd-490a-8c17-cf57c8e9689c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Successful logon from IP and failure from a different IP",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','3d411de5-bba0-4c82-8d5d-992fb947539d')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the alert and extract IPs",
              "description": "<div>Assign the incident to yourself and then open the alert in the \"Logs\" section by clicking the following Icon:</div><div><br></div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADUAAAAxCAYAAAB6d+FmAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANaADAAQAAAABAAAAMQAAAAAS+akwAAAHV0lEQVRoBe1aaWxUVRT+Zqazz3ShLV0opWURCmFpIS4tS9QCCYvxh4rBxBQT4i8M8QdxScBG4w+jCTESidWYaFwgMSSKsSFFIUURqlCUpZWlQGuhnWE608501jf1nDtMOy2dea9TalvgJNO33HvPPd89557lvqr6iBByA0EPJjVpdIAuQ0BIEX/PfgCcfmtSY8K0tcCaWoFBPbmRDC/9A1DDr8vEe3tPairiKOIt9uI3AI0pXuv4vT+3G/Db486fGNSCVwF9ZtzB49Zw6YuEoO5D84ujimabHzUNTvx1wyd6FE3RYtPCVCwvMkOfoooz6v97ndj8hsjR6griw18dONbig5UiuE4V2W/XOyTsandg9lQXtj6cgYoZ47sPZUFJ4T4cbHLj9dpOFJiNkCQVphss0GnU0KgiWgn3pSAtrEPHrSB2/tSF7oANZmMfjmwtGrIs8R85W3M6nTh//jxKS0thMiW/MLJ7KiD14eR1LwqNFkzVG5FvMsKYohGAclLVmJubglSDGgYCmW3QI89gQrHZii5PHxpvm2d8KACDCQQC2L9/P8rLy7F9+3Z0dnYmGiLbJguKORAuqNWsFRX66MLPYXqqnKdH1aNGZBM48U4oTnW7L/UjLctRQ0MDysrKUFVVhaamJvh8PgFUblyidkWgaDHhl8LwSRL8IUlcfXQNkdDcFggNbuM+/F4J2e12aLVaoSGNRqNkiGwf2T3FHEh0BEkVPhI+sosifEMkuQBF4GLbGKwCJQkmFRUVqK+vRygUQk1NTYTxKP8qBAV4gxL0bIL9qFTCvMIEOEBaZO1E2wg7GyrSDPIrn5aWJiC4XK5RQhkYrghUmNThCgZh0MZaqwrdfgl2jwR3gMwvzLssQj4CCeo6O5MKt3GgWCmHnT6FtLMo10BuOiRMjM0s8pNQ3+LFvkY3Wl2BQW3cN93Yr9Jh+Y7lS1lNaTUqVM6xYFaWEzZXiDIGXgf2AioC0kdmyU6CgbL5MRDaX+RQNi2KlNZjKXw83rKa4oFZJg1efiQdnV4/PLS3WFPsDbPMauSmaggGA4m86/IHUV6kx7OUNo0XyWqKBeN87olZFmyc78HBC25YtZFhx656wOZpo33F3pGBrphpxM4ns5FjUcR6THArnjnXqsGOlZEy5MC5HpFBXHcNOIcA+fDVcxhQFkqm6kclrOp2+pUsE8WgWCMlOXrsWJWJKWSO31/ogd1NcYu2EceldXPNBGgqFlCfZMhisaCurk4E4vz8/GRY9I9RDIpHMLD5pIXq1dlYUWTCu0dtaGz34akSK3ZVZmM+AaIuSRFnE0uWLElq7NBBIwLFgzUkdToF1acXWPFQtg5Gil3TUlNgIK+YLKChQo32ecSgohNG41f0eSJdFbn0iSSwElnub1CcdXOO56FfLNk8ITTbApRZKKw1YgeP0b1iTTl6JXx5yknBt4ey8gEAx6kq/uj4LdzoCY5IxPbuEJin0hJlJMwVgeKJm+1+VB+24dM/unDRHuifo8cXBgsYC7S/McHNV41O8IJwJnK3SZH366Wk9bdrvaI+0pHrPtriEfFquMDPgOspfWJaOs0oMvwOdwiXHQGECIDDG8kRvznjokDtg8sn4RnKE3lhjlzxiCSZAzjHwWRJESinV8Khix68UJqGMKmtoc2H5xZKlNAOLgIv0HngzkOdMHHdRUH458sevL06B9ecAbx31E6xTIXCDB1MOhWBCaPVyfvRL4C8VtsBM7236NRUp1EOOQpQsubHhyeNN/yw94aweXEaFuUZcJP2z6l27x0Lufd3B2zUb1v5FFSVpQvBfyGtsoO54ghiJhWNLy1Nx5alGZiRocWKYhM2EU8/lTA/NvVgOZ0XbivPxMYSyx28R/JCVlM84bdnqJYiL/dZQxfayExYIw1tXjw+yzxorvqWXtwkU3uTtMV77AqZHGcbGyiNKkjXYtVMs1gUHsQa4Uy+iMDx+eFaqtn2nujCJTo7rFqWPojvSB9kQd2isoLNaFVxBECeNQUzyYROU87HQsdSrlUrkt5XaLWZeM9lGjViEVL1amTQfSzxMQETlzbvr8/FSVqor8mBVNd1YvfGPFHHxfZXei8L6sD5blhJoN0bcqGjyZkOE8iPTzhw6t/IWXp0snXzLNhz3EF7ByhM1+FEqxcZtw9fOC+MzQ3NpKk2qqQ57gXIGppI+5Wkeb7fQyGii9w9F6fJkCyoz/90Yv08K3JIQ1EqLzShttmNsx1+FJB5Rb0gfyT47u9urPzkqij7H5tuwDtrcsQhE50KiGuUx3pagOo6G5l2N36oKsCL+9pAeIRZbiHzK6aPDsmSSvzLQWP18F/nN9OHrSS+T3WRt6RTaKTqE680n28w8SkVW2KHO4g0GmMiLSak7+YC3f8M7hLzdX5g+Qd3GdXT0L0TjxmXLVFibefRnrwbNMD1bnCbIDwSa6q9DtBaJ4ioMWKEEv93TmJQR56P4TR5bu9J83sAarIY4D2pqUjw7b5EwYx+k5kMWXTov0wg+A9Ps+wukvFomgAAAABJRU5ErkJggg==\"></div><div><br></div><div>Then extract the username and IP in the Entities section.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Query and review the account's sign in ativity",
              "description": "<div>Using the information from before use KQL to view the users sign in activity.</div><div><br></div><div>You can use the following template.</div><pre  spellcheck=\"false\">SigninLogs&nbsp;\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate using the results from the query.",
              "description": "<div>Using the results look at the following:</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><ul><li><strong>Why did it fail. </strong>If the attempt failed due to to Conditional Access or MFA it would imply that the password was correct meaning that if the sign in was malicious then the user's password was compromised.</li><li>If it did fail on CA, was there any successful attempts from new IPs. A potential attacker could be using a VPN to bypass CA.</li><li>Did the UserAgent change from a mobile phone to a desktop and vice versa. This would indicate that the user is transitioning between devices that are on different networks.</li><li>The time between the sign ins. If the failure occurred soon after the success it would be more suspicious than if it occurred later when the user had time to go home or leave the network that they were on.</li><li>Does the IP that failed have reports of abuse.</li><li>Is the sign in from out of country.</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate if necessary and close the ticket.",
              "description": "<div>Should you determine that the user's account was compromised then:</div><ul><li>Reset the user's password</li><li>Revoke all sessions.</li><li>Review account activity across all relevant services after the breach. (Check what applications they signed in to)</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "6518525a-4f4b-44c4-a560-81cc93d7f0f8",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - (Preview) TI map IP entity to DNS Events (ASIM DNS schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','8eee3d7e-24d5-46f7-aace-5931f3193220')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether TI mapping is a true positive",
              "description": "<div><strong>Double check the mapped TI IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP is malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul><div><br></div><div>If IP appears potentially malicious continue on, otherwise note as False Positive.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on records involving IP Address",
              "description": "<div>To scope the recorded interactions involved with the IP address you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT IP&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div>e.g.</div><pre class=\"ql-syntax\" spellcheck=\"false\">search \"1.1.1.1\"\n| summarize count() by $table\n</pre><div><br></div><div>The results will display which tables have recorded instances of the string entered.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on actions involving IP Address",
              "description": "<div><strong>Using the above tables drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DnsEvents table, you can check what the DNS A requests were resolving to, or the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved. CommonSecurityLog can also be a good point to check traffic flows and whether security tools have allowed or denied traffic to the IP address.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre  spellcheck=\"false\">DeviceNetworkEvents\n|search \"1.1.1.1\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM DNS Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine need for containment and remediation",
              "description": "<div>If malicious activity has occurred and was not stopped by any form of security solution(s) such as firewall, XDR, or security tooling, follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve:</div><ul><li>Isolate and scan affected devices</li><li>Reimage/restore affected devices</li><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "82dd22b6-40d0-4d06-8d50-27604a3bdb3f",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - MFA Rejected by User",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','462cdb73-b7b6-40e5-8b5d-bdc0096e019e')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident entities and extract account(s)",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div><div>To list all users in the alert:</div><pre  spellcheck=\"false\">SecurityAlert\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\n| where SystemAlertId in(\"[SystemAlertId]\")\n| mv-expand todynamic(Entities)\n| project UserPrincipalName = tostring(Entities.DisplayName)\n</pre><div>Temporarily store the accounts listed (such as in a text file)</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Query and review each account's recent sign-in activity",
              "description": "<div><strong>Using the previously recorded accounts, use a KQL query to investigate the account's recent sign-in activity.</strong></div><div>An example query template (read each line to understand what it does):</div><pre  spellcheck=\"false\">SigninLogs&nbsp;\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre><div>Note: Sign-ins that failed on CAP or MFA suggests first stage authentication (such as password) was successful and <em>may</em> be an indication of compromised credentials.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify suspicious sign-in activity",
              "description": "<div><strong>Identify suspicious activity by looking for anomalies such as:</strong></div><ul><li>Activity from an unexpected country or region (Refer to TimeGenerated and Location values).</li><li>Unfamiliar IP address.</li><li>Impossible travel.</li><li>Single factor/legacy auth sign-ins should be considered suspicious.</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<div><strong>Confirm why user rejected MFA prompt</strong></div><div>If the user rejected the MFA prompt due to it being unexpected, it may be an indication that there was an unauthorised login attempt for the user's account the passed first stage authentication (such as password) and should be remediated.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was an unauthorised login attempt, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "f9f19e34-c20d-4597-aaf1-962290324be0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Admin promotion after Role Management Application Permission Grant",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b0292e04-95de-42d6-a024-68b43aba754b')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm that the account/object should be part of any \"Admin\" group",
              "description": null
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm that the service principal should be allowed \"Role Management\" rights",
              "description": null
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Removing the account/object that was added to the \"Admin\" group.</li><li>Revoking \"Role Management\" privileges for the affected service principal.</li><li>Further investigate how the service principle got compromised</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "f81a5b5c-54c9-4031-81dd-28fc432f2765",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - User Accounts - Sign in Failure due to CA Spikes",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','50c7012f-80c5-4f73-87ea-e06298d767e4')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident entities and extract account(s)",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><br></div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div><br></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Query and review each account's recent sign-in activity",
              "description": "<div><strong>Using the previously recorded accounts, use a KQL query to investigate the account's recent sign-in activity.</strong></div><div><br></div><div>An example query template (read each line to understand what it does):</div><pre  spellcheck=\"false\">SigninLogs&nbsp;\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre><div><strong>Note: Sign-ins that failed on CAP or MFA suggests first stage authentication (such as password) was successful and <em>may</em> be an indication of compromised credentials.</strong></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify suspicious sign-in activity",
              "description": "<div>Using the results from the previous step, check to see if there are successful log ins from a new IP as the attacker could have used a VPN to bypass conditional access.</div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "e592243b-8322-4861-987c-51a202a17c04",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Discord CDN Risky File Download  (ASIM Web Session Schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','1e57b789-5eca-48e9-aa90-264e96985bea')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>SourceUser</strong>, <strong>SourceIP</strong> and <strong>RequestUrl</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review and enrich the extracted entities",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ol><li>Determine if the entities extracted are approved and expected for your environment</li><li><strong>Extract file name from RequestURL and enrich</strong> - If possible, search your environment for the file and get the hash.</li></ol><ul><li>Enrich the hash (possible source: VirusTotal)</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the downloaded file something you would expect to see in your environment?</li><li>Which application/user initiated the download and is this normal behaviour?</li><li>Was the suspicious file executed, what did it do if so?</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c12255f2-8925-43d1-a82a-1e984ab30e52",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Threat Essentials - User Assigned Privileged Role",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','a52e87da-b09d-4df8-8471-7894be247865')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the User is required to have privileged access",
              "description": "<div>This could involve:</div><div><br></div><div><br></div><ul><li>Reaching out to the necessary managers</li><li>Analysing the account and looking for anything that could be suspicious (Account was recently created, account name doesn't follow naming policy, account is performing strange actions , etc.)</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><div><br></div><div><br></div><ul><li>Disabling the account</li><li>Isolating any devices that the account logged in to</li><li>Remediating any malicious activities performed by the account</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "840d3ee0-2863-4db9-b8ef-076b46bad0dc",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Excessive number of HTTP authentication failures from a source (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','d24a52f4-f870-48cb-93a0-c1da215d8994')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract SrcIpAddr value",
              "description": "<div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP in from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review network activity for IP",
              "description": "<div>Review activity relating to the suspicious IP, this could include:</div><ul><li>Sign-in activity</li><li>Device connections</li><li>Firewall logs</li><li>If IP is internal, identify device that owns the IP address and investigate device</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if connections are potentially malicious",
              "description": "<div>Using knowledge obtained from enrichment and reviewing logs, determine if activity is potentially malicious or an alternative such as a misconfigured system.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Possible actions may include:</strong></div><ul><li>Blocking the IP in from accessing services or at the gateway/firewall level</li><li>Applying relevant fixes to device responsible (if internal)</li><li>Updating rule to be less sensitive or excluding IP from rule if activity from the IP is expected and approved</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "14886d78-4468-4377-b404-4fb54b4e63ae",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Base64 encoded Windows process command-lines (Normalized Process Events)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','60fed49c-34cb-4272-9606-e21615ad5e86')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident entities",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Decode base64 portion of the CommandLine",
              "description": "<div><strong>Use a KQL query to decode the base64</strong></div><div>The portion of the CommandLine that is base 64 will contain these or similar characters \"TVqQAAMAAAAEAAA\"</div><div><br></div><div>Decode with the following query</div><pre  spellcheck=\"false\">print DecodedCommandLine = base64_decode_tostring(\"[Base64]\")\n</pre><div>If the command returns a blank value, the base64 being decoded may be invalid UTF-8 text. Review the copied value from the CommandLine and ensure only the base64 encoded text was copied, and nothing else.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the decoded base64 a command you would expect to see in your environment?</li><li>Which application/user initiated the suspicious command and is this normal behaviour?</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "cc737f25-2edb-439e-b8d6-b2dafd67a863",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Brute force attack against user credentials (Uses Authentication Normalization)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','0ff5d36e-84d1-4244-b4dc-e52e61e47772')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident entities and extract account(s)",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review account sign-in activity",
              "description": "<div><strong>Using the previously recorded accounts, use a KQL query to investigate the account's recent sign-in activity.</strong></div><div>An example query template (read each line to understand what it does):</div><div><br></div><pre  spellcheck=\"false\">SigninLogs&nbsp;\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify suspicious sign-in activity",
              "description": "<div>Once the brute force attempt has been identified, look for any sign-in anomalies that would imply that the attack was a success. These anomalies could include: </div><div><br></div><ul><li>Activity from an unexpected country or region (Refer to TimeGenerated and Location values).</li><li>Unfamiliar IP address.</li><li>Impossible travel.</li><li>Single factor/legacy auth sign-ins should be considered suspicious.</li></ul><div><br></div><div>Note: Sign-ins that failed on CAP or MFA suggests first stage authentication (such as password) was successful and <em>may</em> be an indication of compromised credentials.</div><div> </div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><div><br></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "46a0c7a8-91a9-400e-a5c1-b6bc93d485a1",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - URL Added to Application from Unknown Domain",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','e2a2ddc0-babc-453e-b4b7-4217dfbaaa3c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review Alert Details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACYAAAAmCAYAAACoPemuAAAFjElEQVRYhc2YW2xURRjHf3POnt09bXfbbYF2F1tFsdoUUrSmEHkoaqIhUWlM1Grw8qTxwWjU+GC8EmOCxvjgJTwYr4kxRE1QUaOIEFAgqUoEsSgVqKHaC9vL3s5tzviwBam72y5YC/9ks5nJZL7f+c83c745QjkTiuR+EJxTCpD8ETZ2QvBso0xVAKHnoc45sGLy55gCQJvaLAQTGoSq5ohmUkqCl5nSNRVMApEE3LAHtH+trZj8qROTzSLY8G744gbQObkJizimQ0ViFqOWofCCgq4iOabAd05xTLH3T4vXdo3x6zEbw9Toaq3ipqUR4lXG7ID5TjlggIDjOZ/Nv0xwaMTjo30ZGkJhYsEorqt4e3eOz3tzXNtcQUNU45al1WXFT6VSRCKRssZqRXuFYPthm+e+nGDnQUX7vBoao2FaGgxaG4K01lZhSpN3dlk89tlx/hgvfOITklLS09NDV1cXGzZsKAuqNBiQc30ujIVpjBpIpUg7ktuuCLOq2WDC9jENjUvqTOorDcYsWTLAunXrWLVqFZs2baK/v/+/g2kCsq5kwvbIuh4ZVxI0QAjIuB5px2PccXGkj1bifeb7Pi0tLaxfv57Kyko0rWS4AhXPMfKnQc6ThDQNBNiuwlfgKUXGlaAJHAkICAVKZYSgu7sbyDvn++Wf3CXBbE8xarkYmoYQ+fa45TOak2SlRHiClO0jgj4XxIrvTiHyTuZyudOCmhZsRVMYT/ikHElAA1/Bq9+OkbIVUvnkPEHSdmmOaQS02S9Niq+BUrTMC9C1pJK+UYuczAMuiQdJRDVSjmTU8sh6Hvctj8061DRg+b8HV9ZRXyP4Y8LG9iXb+jJ8P5Aj5UqSlsvDnTHWtJZ3LlmWheu6/xFsUk01Bu91L6Q+KhhIOew4kuHnQZu06/JQZw2Pdtahi5mXUQjB4sWLqa+vLxusZI6d0PJGkw/WNvLC9hHe+34MFDx53QIev3p+2UHC4TB79uyZnePiVC2Lh3nr5oV0NJokogY3lbl8pyoYPL1KtCwwAEMXPLCy7rSBzlTlezvHOi0wBWQcH9efzSqxuKYFO56VvLhjhIGUB4DlKZ7dOsyu/uyME2ddn7Rz5peHacF2HsnwyMZjfLhvAgClFL8nHcZz/wR0ZKF7jlS82TPGuz+M40266/qq6NhSKlkoKmBzb5pbVtSy/UiG+1bECAiBoQvChmA0J3lqyzCHR23uvjxGV2uUl3aM8Ffaw9A0Nh9MYXk+F8QCzK8K8Mp3STxf8fzqBhLRmfdcyUKxd0RydMzl5TVxHE/xTV+GYECgCYEr4Zmvh1AK1rbV8EbPKPsHLV7vGWMo7dHVGqE9EWbl+ZUsS5g8vWWYppjBPR0xKozy3qslllLw8YE0B4ZsXt2dZO+fFp/0pgDQNcg6PjuP5Dg6YvPlb2mGM5KjSZeL64Lcf2UdyxtNFtUGaa0PEY8EWN1cxba+DL8MOUTCellghZ5qkHUkWw6luX1ZNZfOD3FvR4xPe/OghibQdWhZEKI9EeKu9hgjWYmhCYSA0KQjtlRIO5+Ld1xew1UXVXLnxmNUhzW622a+IxSCBTV29GWwpOLpa+ZjGnlTf/rLZmtfBkMXVId0bmur5omvBtk3YNFcH6a7rZqgLk4WAB3nmTzx1RCLag0Gxj36By1qTI2mmvJuVoVgjqKjyeT9W6MnoQBeWxNH+goFREMapqERjwRIZjyaF4RIRAK8fGOcWjO/VNe3RDivOkBVSCeoCw4Ohlg0L8gl80JnCOZDrNLk31VWXUVhblyWCE9pxyP/TKcLaF9onmwvKlHlAoW3/qJgSkJ2oOjg/03WUEHXVDAdyA3ARy1zRDQpJQssKuKYD/bEHBGdohk/QxUZdDYUQEkofcM/axLn6sfhvwGl5SRe9N2vGQAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Identify the accounts observed in the incident.</li><li>Check the sign-in logs for the accounts to confirm that there are no suspicious sign-ins.</li><li>Check if the url's and corresponding domains belong to the organisation. <em>(Note: Application services utilised by the organisation may use different domains)</em></li></ul><div><br></div><ul><li>Use the following KQL to investigate the incident.</li></ul><pre  spellcheck=\"false\">SecurityAlert\n| summarize arg_max(TimeGenerated, *) by SystemAlertId&nbsp;\n| where SystemAlertId in(\"&lt;alertID&gt;\")&nbsp;\n|project Entities\n|extend Entities = iff(isempty(Entities), todynamic('[{\"dummy\":\"\"}]'),todynamic(Entities))\n|mv-expand Entities\n|evaluate bag_unpack(Entities)\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Closing or Escalating the Incident",
              "description": "<ul><li>If the accounts are known (e.g. admin accounts or routine activity) and domains belong to the organisation, then the incident can be closed.</li><li>If the domain(s) identified are not associated with the organisation or the accounts associated have suspicious sign-ins, then the incident should be escalated.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "f9e2a907-2127-41e1-ae35-294295a4984b",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Suspicious application consent for offline access",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','ad34c0ae-6fff-4cae-b168-c55691f2a65c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Check the AuditLogs table to identify the changes made by the user(s).</li><li>Use the following KQL as a template to investigate.</li></ul><pre  spellcheck=\"false\">AuditLogs\n|where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-5m)..(todatetime('yyyy-mm-ddT00:00:00.000Z')+5m))\n|where * has \"&lt;accountName&gt;\" and * has \"&lt;IPAddress&gt;\"\n|extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName), CreatedByIPAddress = tostring(InitiatedBy.user.ipAddress)\n|extend UserPrincipalName = tostring(TargetResources[1].userPrincipalName)\n|extend TargetResourceName = tostring(TargetResources[0].displayName)\n|extend Changes = todynamic(TargetResources[0].modifiedProperties)\n|parse Changes with * \"DisplayName: \" displayName \", newValue: \" newValue \", oldValue: \" oldValue \"]\" *\n|mv-expand Changes\n|summarize count(), make_set(CreatedByIPAddress) by InitiatedByUser, OperationName, TargetResourceName, Category, Result, AADOperationType, tostring(Changes)\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the activity is commonly observed or the user is known to perform routine activity (such as an admin), then this alert can be closed as appropriate.</li><li>If the activity is unusual or suspicious, then it should be escalated and further investigated.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "6bdf9bb6-b4e7-4cb7-8614-ce696b6b1a62",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Dev-0270 WMIC Discovery",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','3cddafa9-35a3-4837-b3bd-afe22a3d6fb3')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if malicious",
              "description": "<div>Ensure that the processes are not a part of pen-testing activities or any other legitimate reason for it to be occurring.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Isolating the device</li><li>Disabling the account that is running these commands</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "045150fd-3789-4866-954f-dec9c2c450df",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - PIM Elevation Request Rejected",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','10d15d81-16db-4e89-b36d-b2f783229812')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the action was malicious",
              "description": "<div>Determine if:</div><ul><li>The account requesting a privileged role is an actual user with a valid account</li><li>Has the account had any suspicious activity (suspicious sign ins)</li><li>The attempt was made legitimately and the request was rejected accidentally</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include</div><ul><li>Disabling the account</li><li>Ensuring that the account had no successful elevation attempts and has not performed any administrative actions</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "04d7b0b2-018f-49b2-bb45-87a11061d59a",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - TEARDROP memory-only dropper",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','41773aaa-29a6-479f-892c-da8e48455b99')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>AccountCustomEntity (InitiatingProcessAccountUpn), HostCustomEntity (DeviceName) </strong>and <strong>FileHashCustomEntity (InitiatingProcessSHA1) </strong>will likely be relevant in developing an accurate conclusion.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Does the process seem suspicious (tools such as Virus Total can help for checking hashes)?</li><li>Is the process and file interaction otherwise something you would expect to see in your environment?</li><li>Which application/user was used in the incident and is this normal behaviour?</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for handling malware, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "81a40df4-80ca-4504-8f9e-de9f27c75ac4",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Azure Portal Signin from another Azure Tenant",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','a9cf5faa-96c4-4116-9956-b82b22ba8f49')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident and extract relevant entities",
              "description": "<div>Values such as the <strong>UserPrincipalName</strong>, <strong>IPAddress</strong>,<strong> HomeTenantId</strong>, <strong>ResourceTenantId</strong> will likely be required to accurately resolve the incident.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<div><strong>Determine if sign-ins from the HomeTenantId are expected and approved.</strong></div><ul><li>If sign-ins from that HomeTenantId are expected and approved, is this normal behaviour for the user that generated the alert?</li><li>Did the user do anything suspicious while logged in that requires further investigation?</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there were unauthorised logins, possible actions may include:</strong></div><ul><li>Review account activity across relevant services after the breach occurred.</li><li>Review access policies to allow/block access from other tenants.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "af5505e1-5413-4fd6-8055-436e2f484972",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Powershell Empire Cmdlets Executed in Command Line",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','88ce926a-d7c0-4eba-862d-01b6ee494e09')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review Alert Details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Identify the entities involved in the incident/alert.</li><li>Use the following KQL as a template to investigate activities around the incident.</li></ul><pre  spellcheck=\"false\">SecurityEvent\n| where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-10m)..( todatetime('yyyy-mm-ddT00:00:00.000Z')+10m))\n|where * has \"&lt;HostName&gt;\" and * has \"&lt;AccountName&gt;\" and * has \"&lt;Domain&gt;\"\n|where CommandLine != \"\" and (SubjectUserName !=\"\" or Account != \"\")\n|summarize count(), make_set(CommandLine) by SubjectUserName, Account, AccountType, Computer,&nbsp; EventSourceName, Activity, ParentProcessName\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Closing or escalation",
              "description": "<ul><li>If the activities are common, such as routine administrative activity, it can be closed as Benign Positive.</li><li>If the activities from the user(s) are suspicious (suspicious command line executions), escalate incident for further investigation.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "3135e9fe-3aa7-43df-8b20-8f62e2b7ab8c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Potential Password Spray Attack (Uses Authentication Normalization)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','dcba42b1-aace-42f8-8d3e-acfb4d89f4de')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP Address(es)",
              "description": "<div><strong>Double check the IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP is malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check successful sign-ins from IP(s)",
              "description": "<div><strong>Check over the successful sign-in attempts from the noted IP address(es)</strong></div><div><br></div><div>A KQL command (substituting the IP(s) in place of XXX) to investigate this activity could be:</div><pre  spellcheck=\"false\">imAuthentication\n| where SrcDvcIpAddr in (XXX)&nbsp; &nbsp; &nbsp; //('x.x.x.x','x.x.x.x',\u2026)&nbsp;\n| where EventResult == \"Success\"&nbsp; &nbsp;// Use \"Success\" / \"Failure\" to see desired results\n| project TimeGenerated, TargetUsername, SrcDvcIpAddr, EventResult, EventOriginalResultDetails, TargetAppName, SrcGeoCountry, SrcGeoCity, HttpUserAgent\n| sort by TimeGenerated desc\n</pre><div><br></div><div>If wanting to pivot and check sign-in activity based on users, a KQL like the following can be used:</div><pre class=\"ql-syntax\" spellcheck=\"false\">imAuthentication\n| where TargetUsername in (XXX)&nbsp; &nbsp; //(\"user@domain.wa.gov.au\", \u2026)&nbsp;\n| where EventResult == \"Success\"&nbsp; &nbsp;// Use \"Success\" / \"Failure\" to see desired results\n| project TimeGenerated, TargetUsername, SrcDvcIpAddr, EventResult, EventOriginalResultDetails, TargetAppName, SrcGeoCountry, SrcGeoCity, HttpUserAgent\n| sort by TimeGenerated desc\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div>If malicious activity has occurred follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve steps such as:</div><ul><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "00b09a8c-a8ae-4a1d-8025-735a9b31510a",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Bulk Changes to Privileged Account Permissions",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','cdb3d1dc-55a4-4411-8f38-0873ee880ab3')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Extract accounts that have had account permissions modified.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is this activity expected and approved? If not, it should be escalated with high importance.</li><li>Review sign-in activity and recent actions for user(s) responsible for bulk changes.</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised permissions changes, possible actions may include:</strong></div><ul><li>Disabling accounts.</li><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred and remediate as required.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "e0eab7aa-7b4a-4cb0-a91c-beeac5288e27",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Credential Dumping Tools - Service Installation",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','13f58f8b-6f64-4c35-a99c-5bec8553b8c9')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if malicious",
              "description": "<div>Identify the account,device or application involved. Then ensure that they are not involved in any pen-testing activities.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><div><br></div><ul><li>Isolating the device</li><li>Disabling the account performing the actions</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "7ade4215-f8c7-435e-a3fd-028fbcc5ee40",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Password spray attack against Azure AD application",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','3abb1e23-3dae-4c58-b9d6-d3f6edc7a7bf')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP Address(es)",
              "description": "<div><strong>Double check the IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP is malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check successful sign-ins from IP(s)",
              "description": "<div><strong>Check over the successful sign-in attempts from the noted IP address(es)</strong> </div><div><br></div><div>A KQL command (substituting the IP(s) in place of XXX) to investigate this activity could be:</div><pre  spellcheck=\"false\">union SigninLogs, AADNonInteractiveUserSignInLogs\n| where IPAddress in (XXX)&nbsp; //('x.x.x.x','x.x.x.x',\u2026)&nbsp;\n| where ResultType in (\"0\",\"50125\", \"50140\", \"53003\", \"70043\", \"70044\")&nbsp; &nbsp;// Only shows successes (or stopped corect creds; Comment line out to show all attempts)&nbsp;\n| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription, AppDisplayName, ClientAppUsed, Location, UserAgent, AuthenticationDetails, AuthenticationProcessingDetails&nbsp;\n| sort by TimeGenerated desc\n</pre><div><br></div><div>If wanting to pivot and check sign-in activity based on users, a KQL like the following can be used:</div><pre class=\"ql-syntax\" spellcheck=\"false\">union SigninLogs, AADNonInteractiveUserSignInLogs\n| where UserPrincipalName in (XXX)&nbsp; &nbsp; //(\"user@domain.wa.gov.au\", \u2026)&nbsp;\n| where ResultType in (\"0\",\"50125\", \"50140\", \"53003\", \"70043\", \"70044\")&nbsp; &nbsp;// Only shows successes (or stopped corect creds; Comment line out to show all attempts&nbsp;\n| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription, AppDisplayName, ClientAppUsed, Location, UserAgent, AuthenticationDetails, AuthenticationProcessingDetails&nbsp;\n| sort by TimeGenerated desc\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div>If malicious activity has occurred follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve steps such as:</div><ul><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "68517adc-5b54-4cb3-a104-22aee236f3df",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Detect CoreBackUp Deletion Activity from related Security Alerts",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','1088ac2e-3910-4b44-be05-f808f9aa1a4c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate the surrounding alerts",
              "description": "<div>Determine if the related alerts point to malicious activities such as ransomware.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm internally if the backups are to be deleted",
              "description": "<div>Check with the team responsible for backups if this is part of normal business processes.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><div><br></div><ul><li>Securing the backups</li><li>Disabling the account that is attempting to delete the backups</li><li>Further information regarding securing backups can be found here: https://www.cyber.gov.au/backups#accordion-2780</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "7e1532c6-d1f6-42e2-90a7-b52164821d12",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Suspicious application consent similar to PwnAuth",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','2aa2bee6-9544-4d39-9328-c9d83234018d')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Check the changes made application consent in Audit Logs table.</li><li>Identify the user/account, application and IP address the changes were made from.</li><li>Use the following KQL as a template to help the investigation.</li></ul><pre  spellcheck=\"false\">AuditLogs\n|where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-5m)..(todatetime('yyyy-mm-ddT00:00:00.000Z')+5m))\n|where * has \"&lt;accountName&gt;\" and * has \"&lt;IPAddress&gt;\"\n|extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName), CreatedByIPAddress = tostring(InitiatedBy.user.ipAddress)\n|extend UserPrincipalName = tostring(TargetResources[1].userPrincipalName)\n|extend TargetResourceName = tostring(TargetResources[0].displayName)\n|extend Changes = todynamic(TargetResources[0].modifiedProperties)\n|parse Changes with * \"DisplayName: \" displayName \", newValue: \" newValue \", oldValue: \" oldValue \"]\" *\n|mv-expand Changes\n|summarize count(), make_set(CreatedByIPAddress) by InitiatedByUser, OperationName, TargetResourceName, Category, Result, AADOperationType, tostring(Changes)\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the application is unknown or changes made by the user(s) are suspicious, confirm the activity by escalating.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "54346155-7eca-4cc9-8c14-7e5839351fbc",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Anomalous sign-in location by user account and authenticating application",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','083ab654-ebf0-4d2c-ab1a-e0c6bb68d9f8')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident entities and extract account(s)",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAANqADAAQAAAABAAAANQAAAAC041R0AAAGMUlEQVRoBe1Ze2xTVRj/FYbrClvZ6B48JSgTxTEhKshLcAhi9gdzEnkoPtAoMQGDATL9AzSKwcT4B0YeahANguh0aAjTQICAOFQQNahM3YvB1q2sLVu73q7tPN+5u93t2tudWwjrln3b7bn3O995/M7v+84591xDOxP0QUngmHYZ+hy0AX0OUQegfmC9jdl+xnobY/KsqNXrp3vBSqAxo/e7ohap8aqP7opRer3pcANeO9IYtJgzbjA25qWD0ngQ3cAUQLmWZKyYMDKIod4tYcmeOtyelRAXAA18r6gRgOiYPI5VuDD3gyrkWlI4EAKlJVYGsN7thZxKaH9ropappt7tdqO0tBR5eXkwm82adjxDo+9CkwcBmz/GwoAl80vd0gTGEF2KZJoSuQ3ZZ7F7Kisqfr8fJSUlyMnJQWFhIaqrq0WLhtkJAaNSNPEH2E+gI1WeixYMwaJcY8R8PYvFyZMnkZ2djYKCAlRUVFCT1yTCwLz+ADxsRCWfn6eejpRaD7A3H+VZnU96USkvL+eAVq1aJVokql2nD0U1A9oYXRIDZ2B/Mn8GxpLcceq/5Ken9pB8YlhU8vPz4XQ6kZKSguLiYjQ0NIgWjWgnDoyBknzMESO8ugUYIGKT41Tl63mHzcjIiNjBWJXCwBo9XpgGDVS1ozAnxx4xJiNTTAw8HntqXRMG5mN+RXEkU0YgZGBnayWcrfV25HXqr7b54ZDaFJQ3PBUCtmleBt9lWIw3MTxK4LCU/a/cr4oFjkvOp5jsKbZoFIVnRdou1bo8PM6IOYo3iqsdj6bj2anJwWeuZ/mXWzx8B3LDqepoUBgYsWZr9cLhbYOXxZMUCPC0rMaDH6pag8+kt7Kdx7r703oHYzQQR58bizqXFLKObTlmw/FKV3Ada2SgVs8cChqInhRhxqiTFDME7jID18ImB1rXaDZULrvkw9rZqdcNlMGgWjt0jpIuYGpwU0YlwsXAUZzR1ez1YT1zv+vBlNVqBa2BtGeMVXQDU4PbMGcY3GyiIIBFc4ddF1CxAulaTmi671pIeSZ2yD17clpX+tI1jYkxdSXxCIr6d83A1CDj6b4fWDyxIdIXXYxV2r04Ve0Oq3frqSasPVgfpu9JhS5gi/fUYsb2Slx0hu7aK5q8OG+VYsLx0S92/HvFG1PZaIWEgRFbZy61wmwciO2n7dHq1JX3wtd1qLKHDpSuCjSMhdexbWV25GQZ8fhkM94+bsMbD2ZAa8dz4M9mvHPChhZvAEtyzVg3y8JtNxyyYvIII0rLW1h3DLC5faD3vPWH6jGJ1f3x4pEoq2nFRnYYW+NoQ+5wI/YtHaXR9ehqIcbo7GLnT3Y8f28qnpoyFFfcfhz5L/Kx2lfnr2LRpzWYNsaExyaZ8ep3DTjwVzPvxTcsfWL/JbgY4Ok3J+Hh24Zw/dTRJjxwy2C2kW7HrB2VmJiZyHYx6UhMiH2vKMTY9/+0wOnxYzljayhzxVljTdh66grm3Rp+nF1UasUKBv7N+fLu/kKjhM9/d2LRHfIhKzH2xfLRweFe8209Cu9M4XVdviozeM+oJD4oNDCxihCw935sQsIAA5bureXtVLKYOFHlhoOBJaBqqWhqQ7nNgU/OOoLq4cmdzcwfL7MUzFTdjEhJwPrZFizbV4vX2XeBd/Oz8FC2tr2qaNhtZ4thWbKiibndwb+bsfLuVIxLG8SVxNjGw43YfcaBNTOGhZSkuCAmNy/IDNErD2mm0IEgvfr8ccvCTLw0k22oWZwt3FWNCy+PR7aFHUnolG5jbDcbeSPz9e0Fw/HK3PTgtewuM4jJrkL6D3+24/RFN3/DJjeMtPYp5QjouToPt7W5/Nj7GztbTByAojnp3KShxaeY6kq7Zez9sibu7+SKanlxWhp3tz/qPSGz45Msvj4758T0bZXcnEZ75yMj+P1ANoyhtQCrp6eBZsvNR234dfU4PPPlJT6JUAGKvfvGJPGyen+EvrborZTsyYVpOUhNCne9rvU1SwEQaNMg2YFoA0DrJTHXrWh8bemWsW4r1jCIFEsapkjuAmC0WY5lLXsRvcCQiFQTfzZ9Flh0V9Tw3/jjJ7xHfZaxfmDhZMe3pp+x+OYnvHfyziNc3+s1/wOFTJjvAbfM2gAAAABJRU5ErkJggg==\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div><div>To list all users in the alert:</div><div><br></div><div><br></div><pre  spellcheck=\"false\">SecurityAlert\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\n| where SystemAlertId in(\"[SystemAlertId]\")\n| mv-expand todynamic(Entities)\n| project UserPrincipalName = tostring(Entities.DisplayName)\n</pre><div>Temporarily store the accounts listed (such as in a text file)</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Query and review each account's recent sign-in activity",
              "description": "<div><strong>Using the previously recorded accounts, use a KQL query to investigate the account's recent sign-in activity.</strong></div><div>An example query template (read each line to understand what it does):</div><div><br></div><div><br></div><pre  spellcheck=\"false\">SigninLogs&nbsp;\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where UserPrincipalName in (\"[UPN]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre><div>Note: Sign-ins that failed on CAP or MFA suggests first stage authentication (such as password) was successful and <em>may</em> be an indication of compromised credentials.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify suspicious sign-in activity",
              "description": "<div><strong>Identify suspicious activity by looking for anomalies such as:</strong></div><div><br></div><div><br></div><ul><li>Activity from an unexpected country or region (Refer to TimeGenerated and Location values).</li><li>Unfamiliar IP address.</li><li>Impossible travel.</li><li>Single factor/legacy auth sign-ins should be considered suspicious.</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<div><strong>Confirm if the user is using a VPN or travelling.</strong></div><div>It is recommended not to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><div><br></div><div><br></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "12112bbe-1481-4edd-a022-036b48f21ac8",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - DNS events related to ToR proxies  (ASIM DNS Schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','000f55ab-c2b9-4899-a58c-01d13684579c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the source host of the DNS request, the domain requested and the returned IP address.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify host, application and account responsible for query",
              "description": "<div>Doing a query such as</div><pre  spellcheck=\"false\">search \"[suspicious domain]\"\n| where TimeGenerated &gt; ago(1d) // adjust time as needed\n| summarize count() by $table\n</pre><div>Will return a list of tables that contain the suspicious domain to further search into to help identify the host, application and account responsible.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Was the request made by a service such as a firewall doing a DNS lookup to update block tables?</li><li>Does the host/application/account have a legitimate reason for making the query?</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file/applications</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "bdc2396a-9be5-4f84-8c0a-1c7fe5ea2c93",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Port scan detected (ASIM Network Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b8fe75a9-aa06-46b6-965f-a02926cf7860')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether IP appears malicious",
              "description": "<div><strong>Double check the IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP appears malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on ports",
              "description": "<div>Using the Incident events, check whether the scan seems to be targeting specific ports or is a sequential scan. This could indicate precursor activity to further attacks and is good to note for further remediation activity.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on network activity",
              "description": "<div><strong>Scope interactions</strong></div><div><br></div><div>To scope the recorded interactions involved with the IP address you can use the \"search\" command in KQL:</div><div><br></div><pre  spellcheck=\"false\">search \"&lt;INSERT IP&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div><strong>Using the IP(s) or domain(s) drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved. CommonSecurityLog can also be a good point to check traffic flows and whether security tools have allowed or denied traffic to the IP address.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre class=\"ql-syntax\" spellcheck=\"false\">DeviceNetworkEvents\n|search \"1.1.1.1\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Network Session Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediation (if required)",
              "description": "<div>If activity appears malicious follow standard operation procedures for remediation, which may include steps such as:</div><ul><li>Blocking IP(s)/Domain(s) in NGFW/WAF or security suits such as Defender (or implementing WAF in front of internet facing systems).</li><li>Assessing whether ports can be closed on perimeter security devices.</li><li>Escalate further as required.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "3958c249-6f7c-4e71-871c-d5d0319d52dc",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Password spray attack against Azure AD Seamless SSO",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','928fa73f-b295-4357-91f9-78d6379264fa')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP Address(es)",
              "description": "<div><strong>Double check the IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP is malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check successful sign-ins from IP(s)",
              "description": "<div><strong>Check over the successful sign-in attempts from the noted IP address(es)</strong></div><div><br></div><div>A KQL command (substituting the IP(s) in place of XXX) to investigate this activity could be:</div><pre  spellcheck=\"false\">AADNonInteractiveUserSignInLogs\n| where IPAddress in (XXX)&nbsp; //('x.x.x.x','x.x.x.x',\u2026)&nbsp;\n| where ResultType in (\"0\",\"50125\", \"50140\", \"53003\", \"70043\", \"70044\")&nbsp; &nbsp;// Only shows successes (or stopped corect creds; Comment line out to show all attempts)&nbsp;\n| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription, AppDisplayName, ClientAppUsed, Location, UserAgent, AuthenticationDetails, AuthenticationProcessingDetails&nbsp;\n| sort by TimeGenerated desc\n</pre><div><br></div><div>If wanting to pivot and check sign-in activity based on users, a KQL like the following can be used:</div><pre class=\"ql-syntax\" spellcheck=\"false\">AADNonInteractiveUserSignInLogs\n| where UserPrincipalName in (XXX)&nbsp; &nbsp; //(\"user@domain.wa.gov.au\", \u2026)&nbsp;\n| where ResultType in (\"0\",\"50125\", \"50140\", \"53003\", \"70043\", \"70044\")&nbsp; &nbsp;// Only shows successes (or stopped corect creds; Comment line out to show all attempts&nbsp;\n| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription, AppDisplayName, ClientAppUsed, Location, UserAgent, AuthenticationDetails, AuthenticationProcessingDetails&nbsp;\n| sort by TimeGenerated desc\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div>If malicious activity has occurred follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve steps such as:</div><ul><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "8241928c-6e5b-4109-88ab-1305f648747d",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Credential Dumping Tools - File Artifacts",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','7692e8af-163a-4ab4-8730-17746761b77d')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if malicious",
              "description": "<div>Identify the account,device or application involved. Then ensure that they are not involved in any pen-testing activities.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><div><br></div><div><br></div><ul><li>Isolating the device</li><li>Disabling the account performing the actions</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c774f44b-e486-425a-b6e6-90c6cc72a23e",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b2044a93-4bce-42d2-8f4e-72710a0fb628')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>AccountCustomEntity (User) </strong>and <strong>HostCustomEntity (DvcHostname) </strong>will likely be relevant in developing an accurate conclusion.</div><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM File Activity Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Does the file appear to be a version of a SUNBURST/SUPERNOVA backdoor (tools such as Virus Total can help for checking hashes)?</li><li>Is the file otherwise something you would expect to see in your environment?</li><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was the suspicious file executed, what did it do if so?</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for handling malware, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "014a00e9-8156-48e3-9385-18e79aee01d6",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2023-03-01-preview",
      "properties": {
        "displayName": "AddTasks - Multiple RDP connections from Single System",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b572e11e-7cc4-41b2-bee1-74d89a8d4157')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Analyse",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAADagAwAEAAAAAQAAADUAAAAAR9k5dwAAAAlwSFlzAAALEwAACxMBAJqcGAAABjFJREFUaAXtWXtsU1UY/xWG6wpb2egePCUoE8UxISrIS3AIYvYHcxJ5KD7QKDEBgwEy/QM0isHE+AdGHmoQDYLodGgI00CAgDhUEDWoTN2LwdatrC1bu96u7Tzfubvd7drbnVsI65Z92+259zvfefzO7/vOOfdcQzsT9EFJ4Jh2GfoctAF9DlEHoH5gvY3ZfsZ6G2PyrKjV66d7wUqgMaP3u6IWqfGqj+6KUXq96XADXjvSGLSYM24wNualg9J4EN3AFEC5lmSsmDAyiKHeLWHJnjrcnpUQFwANfK+oEYDomDyOVbgw94Mq5FpSOBACpSVWBrDe7YWcSmh/a6KWqabe7XajtLQUeXl5MJvNmnY8Q6PvQpMHAZs/xsKAJfNL3dIExhBdimSaErkN2WexeyorKn6/HyUlJcjJyUFhYSGqq6tFi4bZCQGjUjTxB9hPoCNVnosWDMGiXGPEfD2LxcmTJ5GdnY2CggJUVFRQk9ckwsC8/gA8bEQln5+nno6UWg+wNx/lWZ1PelEpLy/ngFatWiVaJKpdpw9FNQPaGF0SA2dgfzJ/BsaS3HHqv+Snp/aQfGJYVPLz8+F0OpGSkoLi4mI0NDSIFo1oJw6MgZJ8zBEjvLoFGCBik+NU5et5h83IyIjYwViVwsAaPV6YBg1UtaMwJ8ceMSYjU0wMPB57al0TBuZjfkVxJFNGIGRgZ2slnK31duR16q+2+eGQ2hSUNzwVArZpXgbfZViMNzE8SuCwlP2v3K+KBY5LzqeY7Cm2aBSFZ0XaLtW6PDzOiDmKN4qrHY+m49mpycFnrmf5l1s8fAdyw6nqaFAYGLFma/XC4W2Dl8WTFAjwtKzGgx+qWoPPpLeynce6+9N6B2M0EEefG4s6lxSyjm05ZsPxSldwHWtkoFbPHAoaiJ4UYcaokxQzBO4yA9fCJgda12g2VC675MPa2anXDZTBoFo7dI6SLmBqcFNGJcLFwFGc0dXs9WE9c7/rwZTVagWtgbRnjFV0A1OD2zBnGNxsoiCARXOHXRdQsQLpWk5ouu9aSHkmdsg9e3JaV/rSNY2JMXUl8QiK+nfNwNQg4+m+H1g8sSHSF12MVdq9OFXtDqt366kmrD1YH6bvSYUuYIv31GLG9kpcdIbu2iuavDhvlWLC8dEvdvx7xRtT2WiFhIERW2cutcJsHIjtp+3R6tSV98LXdaiyhw6Urgo0jIXXsW1lduRkGfH4ZDPePm7DGw9mQGvHc+DPZrxzwoYWbwBLcs1YN8vCbTccsmLyCCNKy1tYdwywuX2g97z1h+oxidX98eKRKKtpxUZ2GFvjaEPucCP2LR2l0fXoaiHG6Oxi5092PH9vKp6aMhRX3H4c+S/ysdpX569i0ac1mDbGhMcmmfHqdw048Fcz78U3LH1i/yW4GODpNyfh4duGcP3U0SY8cMtgtpFux6wdlZiYmch2MelITIh9ryjE2Pf/tMDp8WM5Y2soc8VZY03YeuoK5t0afpxdVGrFCgb+zfny7v5Co4TPf3di0R3yISsx9sXy0cHhXvNtPQrvTOF1Xb4qM3jPqCQ+KDQwsYoQsPd+bELCAAOW7q3l7VSymDhR5YaDgSWgaqloakO5zYFPzjqC6uHJnc3MHy+zFMxU3YxIScD62RYs21eL19l3gXfzs/BQtra9qmjYbWeLYVmyoom53cG/m7Hy7lSMSxvElcTYxsON2H3GgTUzhoWUpLggJjcvyAzRKw9pptCBIL36/HHLwky8NJNtqFmcLdxVjQsvj0e2hR1J6JRuY2w3G3kj8/XtBcPxytz04LXsLjOIya5C+g9/tuP0RTd/wyY3jLT2KeUI6Lk6D7e1ufzY+xs7W0wcgKI56dykocWnmOpKu2Xs/bIm7u/kimp5cVoad7c/6j0hs+OTLL4+O+fE9G2V3JxGe+cjI/j9QDaMobUAq6engWbLzUdt+HX1ODzz5SU+iVABir37xiTxsnp/hL626K2U7MmFaTlITQp3va71NUsBEGjTINmBaANA6yUx161ofG3plrFuK9YwiBRLGqZI7gJgtFmOZS17Eb3AkIhUE382fRZYdFfU8N/44ye8R32WsX5g4WTHt6afsfjmJ7x38s4jXN/rNf8DhUyY7wG3zNoAAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Gather Entity details",
              "description": "<div>Check the entities to gather details of the devices/hostnames, IP address(s) and account names involved in the RDP activity.</div><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<div>Use the following KQL template to investigate the RDP activity.</div><div><br></div><pre  spellcheck=\"false\">SecurityEvent\n|where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-5m)..(todatetime('yyyy-mm-ddT00:00:00.000Z')+5m))\n|where TargetUserName has_any (\"&lt;targetUserName&gt;\",\"&lt;targetUserName&gt;\") and WorkstationName has_any(\"&lt;DeviceName&gt;\",\"&lt;DeviceName&gt;\",\"&lt;DeviceName&gt;\") and IpAddress has_any (\"0.0.0.0\",\"0.0.0.0\",\"0.0.0.0\")\n|summarize count(), make_set(IpAddress) by WorkstationName, TargetUserName, TargetServerName, Process, LogonTypeName, EventID, Activity\n</pre><div><br></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check IP address(s)",
              "description": "<ul><li>If the accounts were updated by a user, perform a check on the IP address to determine if they are clean IP's.</li><li>If the IP address is malicious or is from outside of Australia, verify with the account user. (Note: IP addresses of Microsoft or similar services will likely have IP addresses outside of Australia, as these use different Data Center IP's)</li></ul><div><br></div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Escalation",
              "description": "<ul><li>If the IP address is found to be malicious or the changes were not approved by an admin, escalate the incident for further investigation.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "549e0a49-44c8-4276-baa9-7e73b7c2640b",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','5b10ffb5-cf3e-47d9-9a6b-f5680802b83a')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the source host of the DNS request, account responsible for the DNS request and the domain requested.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify host, application and account responsible for query",
              "description": "<div>If you are unable to identify the host, application or account with the given incident, doing a query such as</div><div><br></div><div><br></div><pre  spellcheck=\"false\">search \"[suspicious domain]\"\n| where TimeGenerated &gt; ago(1d) // adjust time as needed\n| summarize count() by $table\n</pre><div>Will return a list of tables that contain the suspicious domain to further search.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich domain data",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this domain known to your organisation?</li><li>Do threat intelligence sources list the domain(s) as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal). If so identify if it is associated to known malware/threat actors, search for related indicators of compromise (IOC).</li></ul><div><br></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Was the request made by a service such as a firewall doing a DNS lookup to update block tables?</li><li>Does the host/application/account have a legitimate reason for making the query?</li></ul>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file/applications</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "dd207de9-289b-46d5-939a-2395eac7381d",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Dev-0228 File Path Hashes November 2021 (ASIM Version)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','52449fda-5e70-460b-94c0-c3a812b22cd6')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>A match on hashes most likely indicates a TP. Remediation could include:</div><div><br></div><div><br></div><ul><li>Isolating the device</li><li>Determining if the files are present on other machines and isolating them if they are</li><li>Determining how the file was introduced to the system</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "9f2e2639-2eb3-4c08-9f4e-3193534267a1",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - DNS events related to mining pools (ASIM DNS Schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','c9e64171-af63-4e20-b9c2-62914776a89c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the source host of the DNS request, the domain requested and the returned IP address.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Identify host, application and account responsible for query",
              "description": "<div>Doing a query such as</div><pre  spellcheck=\"false\">search \"[suspicious domain]\"\n| where TimeGenerated &gt; ago(1d) // adjust time as needed\n| summarize count() by $table\n</pre><div>Will return a list of tables that contain the suspicious domain to further search into to help identify the host, application and account responsible.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Was the request made by a service such as a firewall doing a DNS lookup to update block tables?</li><li>Does the host/application/account have a legitimate reason for making the query?</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file/applications</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "4ce86cab-0e03-47ac-86ca-32ff5848a3d2",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - NRT Modified domain federation trust settings",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','2583689a-2810-4622-b98b-52492994a4eb')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div><strong>Additional resources for triaging:</strong></div><div><br></div><div><span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see:&nbsp;</span><a href=\"https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365\" rel=\"noopener noreferrer\" target=\"_blank\" style=\"background-color: rgb(255, 255, 255); color: var(--colorLink);\">https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365</a><span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">.</span></div><div><br></div><div><span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification:&nbsp;</span><a href=\"https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b\" rel=\"noopener noreferrer\" target=\"_blank\" style=\"background-color: rgb(255, 255, 255); color: var(--colorLink);\">https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b</a><span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">.</span></div><div><br></div><div><span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">For further information on AuditLogs please see&nbsp;</span><a href=\"https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities\" rel=\"noopener noreferrer\" target=\"_blank\" style=\"background-color: rgb(255, 255, 255); color: var(--colorLink);\">https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities</a><span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">.</span></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is this activity normal or expected? <span style=\"background-color: rgb(255, 255, 255); color: rgb(50, 49, 48);\">Confirm the added or modified target domain/URL is legitimate administrator behaviour.</span></li><li>Was there suspicious activity leading up to/surrounding the incident?</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for remediation, some actions may include:</strong></div><ul><li>Review responsible account/device's recent sign-ins and activities</li><li>Isolate device</li><li>Disable responsible account</li><li>Search for similar behaviour in other devices across your organisation</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "0b7f37ae-3e2c-412d-b951-f3f9bbf61ac0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Mass Cloud resource deletions Time Series Anomaly",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','ba72a613-6aab-4fb9-9fee-b3f37ea61662')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Identify the user(s) involved and the resources affected.</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Escalate",
              "description": "<ul><li>Escalate the incident for further investigation and confirmation with the team responsible for managing the resources.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c4ce37da-44c5-4203-8704-3944e0a70926",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','a2e8076e-5b43-425a-945e-4966da27799c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract IP from incident entities",
              "description": "<div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review sign-in activity for IP",
              "description": "<div>Make note of the accounts with successful logins from the suspicious IP</div><div><br></div><div><strong>Possible KQL query</strong></div><pre  spellcheck=\"false\">imAuthentication\n| where TimeGenerated &gt; ago(3d) // Adjust lookback time as necessary\n| where IPAddress in (\"[IPAddress]\") // Comma seperated list of IPs\n//| where EventResult in (\"Success\") // Only show logins that suceeded\n| project TimeGenerated, TargetUsername, IPAddress, EventType, EventResult, EventResultDetails, LogonMethod, LogonTarget\n| summarize make_set(TargetUsername), make_set(EventResultDetails), count() by IPAddress, EventResult, LogonMethod\n</pre>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if login activity is expected and approved",
              "description": "<div>It is not recommended to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "aa00dd71-2669-4007-9eb7-058aa890f2e0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Sign-ins from IPs that attempt sign-ins to disabled accounts",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','9e72da12-e155-44ba-acf4-69ba5966575c')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract IP from incident entities",
              "description": "<div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review sign-in activity for IP",
              "description": "<div>Make note of the accounts with successful logins from the suspicious IP</div><div><br></div><div><strong>Possible KQL query</strong></div><div><br></div><div><br></div><pre  spellcheck=\"false\">SigninLogs&nbsp;//Can also check AADNonInteractiveUserSignInLogs\n| where TimeGenerated &gt; ago(1d) // Change lookback time as required&nbsp;&nbsp;\n| where IPAddress&nbsp; in (\"[IP]\") // For use when filtering by users (comma seperated list)\n| where ResultType !in (\"50126\", \"50053\", \"530031\") // Remove login attempts with incorrect credentials or auto blocked IPs\n| extend AuthStep_1 = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod) // Used to discover password authentication attempts\n| extend AuthSuccess_1 = tostring(parse_json(AuthenticationDetails)[0].succeeded) // Used to determine if password authentication succeeded\n| where (AuthStep_1&nbsp; in (\"Password\") and AuthSuccess_1 in (\"true\")) or ResultType in (\"0\", \"53003\", \"50076\") // Only show logins that succeeded or had correct credentials&nbsp;\n| summarize count() by TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, ResultDescription\n| sort by TimeGenerated desc\n</pre>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if login activity is expected and approved",
              "description": "<div>It is not recommended to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "0ceeb6cc-0ae0-440b-a314-facf712cf58c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - AD FS Abnormal EKU object identifier attribute",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','68471e35-39b9-4489-8d80-dd9409397ce8')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the OID is suspicious",
              "description": "<div>Look for any unique or lengthy OID's as these could be an indicator of malicious activity</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the malicious keys were used to authenticate into any devices",
              "description": "<div>Also determine which application is utilising this key.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Possible remediation steps could include:</div><div><br></div><ul><li>Removing the Certificate</li><li>Isolating any devices that was signed into using the malicious certificate</li><li>Further guidance can be found here : <a href=\"https://www.microsoft.com/en-us/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/\" rel=\"noopener noreferrer\" target=\"_blank\" style=\"color: var(--color-accent-fg); background-color: rgb(255, 255, 255);\">https://www.microsoft.com/en-us/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/</a></li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "cfeba8a1-e395-45d0-8713-ce8e226d0f2d",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - SharePointFileOperation via devices with previously unseen user agents",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','ac8b2b3e-2e0e-415d-8f73-7a25dbe4790f')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident and extract entity(s) details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAADagAwAEAAAAAQAAADUAAAAAR9k5dwAAAAlwSFlzAAALEwAACxMBAJqcGAAABjFJREFUaAXtWXtsU1UY/xWG6wpb2egePCUoE8UxISrIS3AIYvYHcxJ5KD7QKDEBgwEy/QM0isHE+AdGHmoQDYLodGgI00CAgDhUEDWoTN2LwdatrC1bu96u7Tzfubvd7drbnVsI65Z92+259zvfefzO7/vOOfdcQzsT9EFJ4Jh2GfoctAF9DlEHoH5gvY3ZfsZ6G2PyrKjV66d7wUqgMaP3u6IWqfGqj+6KUXq96XADXjvSGLSYM24wNualg9J4EN3AFEC5lmSsmDAyiKHeLWHJnjrcnpUQFwANfK+oEYDomDyOVbgw94Mq5FpSOBACpSVWBrDe7YWcSmh/a6KWqabe7XajtLQUeXl5MJvNmnY8Q6PvQpMHAZs/xsKAJfNL3dIExhBdimSaErkN2WexeyorKn6/HyUlJcjJyUFhYSGqq6tFi4bZCQGjUjTxB9hPoCNVnosWDMGiXGPEfD2LxcmTJ5GdnY2CggJUVFRQk9ckwsC8/gA8bEQln5+nno6UWg+wNx/lWZ1PelEpLy/ngFatWiVaJKpdpw9FNQPaGF0SA2dgfzJ/BsaS3HHqv+Snp/aQfGJYVPLz8+F0OpGSkoLi4mI0NDSIFo1oJw6MgZJ8zBEjvLoFGCBik+NU5et5h83IyIjYwViVwsAaPV6YBg1UtaMwJ8ceMSYjU0wMPB57al0TBuZjfkVxJFNGIGRgZ2slnK31duR16q+2+eGQ2hSUNzwVArZpXgbfZViMNzE8SuCwlP2v3K+KBY5LzqeY7Cm2aBSFZ0XaLtW6PDzOiDmKN4qrHY+m49mpycFnrmf5l1s8fAdyw6nqaFAYGLFma/XC4W2Dl8WTFAjwtKzGgx+qWoPPpLeynce6+9N6B2M0EEefG4s6lxSyjm05ZsPxSldwHWtkoFbPHAoaiJ4UYcaokxQzBO4yA9fCJgda12g2VC675MPa2anXDZTBoFo7dI6SLmBqcFNGJcLFwFGc0dXs9WE9c7/rwZTVagWtgbRnjFV0A1OD2zBnGNxsoiCARXOHXRdQsQLpWk5ouu9aSHkmdsg9e3JaV/rSNY2JMXUl8QiK+nfNwNQg4+m+H1g8sSHSF12MVdq9OFXtDqt366kmrD1YH6bvSYUuYIv31GLG9kpcdIbu2iuavDhvlWLC8dEvdvx7xRtT2WiFhIERW2cutcJsHIjtp+3R6tSV98LXdaiyhw6Urgo0jIXXsW1lduRkGfH4ZDPePm7DGw9mQGvHc+DPZrxzwoYWbwBLcs1YN8vCbTccsmLyCCNKy1tYdwywuX2g97z1h+oxidX98eKRKKtpxUZ2GFvjaEPucCP2LR2l0fXoaiHG6Oxi5092PH9vKp6aMhRX3H4c+S/ysdpX569i0ac1mDbGhMcmmfHqdw048Fcz78U3LH1i/yW4GODpNyfh4duGcP3U0SY8cMtgtpFux6wdlZiYmch2MelITIh9ryjE2Pf/tMDp8WM5Y2soc8VZY03YeuoK5t0afpxdVGrFCgb+zfny7v5Co4TPf3di0R3yISsx9sXy0cHhXvNtPQrvTOF1Xb4qM3jPqCQ+KDQwsYoQsPd+bELCAAOW7q3l7VSymDhR5YaDgSWgaqloakO5zYFPzjqC6uHJnc3MHy+zFMxU3YxIScD62RYs21eL19l3gXfzs/BQtra9qmjYbWeLYVmyoom53cG/m7Hy7lSMSxvElcTYxsON2H3GgTUzhoWUpLggJjcvyAzRKw9pptCBIL36/HHLwky8NJNtqFmcLdxVjQsvj0e2hR1J6JRuY2w3G3kj8/XtBcPxytz04LXsLjOIya5C+g9/tuP0RTd/wyY3jLT2KeUI6Lk6D7e1ufzY+xs7W0wcgKI56dykocWnmOpKu2Xs/bIm7u/kimp5cVoad7c/6j0hs+OTLL4+O+fE9G2V3JxGe+cjI/j9QDaMobUAq6engWbLzUdt+HX1ODzz5SU+iVABir37xiTxsnp/hL626K2U7MmFaTlITQp3va71NUsBEGjTINmBaANA6yUx161ofG3plrFuK9YwiBRLGqZI7gJgtFmOZS17Eb3AkIhUE382fRZYdFfU8N/44ye8R32WsX5g4WTHt6afsfjmJ7x38s4jXN/rNf8DhUyY7wG3zNoAAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate SharePointFileOperation Activity",
              "description": "<ul><li>Identify any unusual activity involving unusual User Agents, URL\u2019s, IP address(s), File types, and Operations.</li><li>Use the below KQL to quickly identify SharePoint File Operation activity.</li></ul><div>&nbsp;</div><pre  spellcheck=\"false\">OfficeActivity\n| where TimeGenerated between (todatetime('yyyy-mm-ddT00:00:00.000Z')..todatetime('yyyy-mm-ddT00:00:00.000Z'))\n| where RecordType == \"SharePointFileOperation\"\n| where&nbsp;UserId has \"&lt;user'sName&gt;\"\n| summarize count(), make_set(ClientIP) by UserId, UserType, UserAgent, ClientProcessName, ItemType, Operation, RecordType, Site_Url, SourceRelativeUrl, SourceFileName, EventSource, SourceSystem\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Concluding the investigation",
              "description": "<ul><li>If suspicious file operations are observed, it should be confirmed with the user and should be checked for any malicious content.</li><li>If the URL or IP addresses are not known to the organization or are found to be malicious (via IP or URL scanning), the incident should be escalated and further investigated.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "0154ffdc-91da-4700-ba6e-f0c4acd5d7f3",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Threat Essentials - Mail redirect via ExO transport rule",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','a28d75af-1cee-4542-9957-53d547aa925e')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the rule is legitimate",
              "description": "<ul><li>Have there been any recent phishing alerts or incidents for the same AccountCustomEntity?</li><li>Is the rule named something suspicious such as a single letter (e.g. \"z\") or a single character (e.g. \".\")</li><li>User contact via manager can help to check on legitimacy (however, contacting user via email should be avoided)</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Removal of the rule</li><li>Removal of the mailbox (if created in your environment)</li><li>Further investigation into the existence of the rule (if created by an account in your environment then disable the account)</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "f00e2de5-0438-437b-a12c-901db27f44f7",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Potential Build Process Compromise - MDE",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','c6307cad-e97f-420b-93d0-eb0d965ee0af')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the BuildProcess and BuildParentProcess a regular/recognisable process in your environment? Is this normal or expected behaviour?</li><li>Was there suspicious activity leading up to/surrounding the incident?</li></ul><div><br></div><div><strong>NOTE</strong>: The Analytic Rule that generates this incident is intended to be modified in the Sentinel Analytics blade to tailor it to the environment. This may cause initial false positives.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Review related device's recent sign-ins and activities</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li><li>Search for similar behaviour in other devices across your organisation</li><li>If incident is resulting in numerous false positives, the Sentinel Analytics Rule can be modified as per the comments in its KQL (to include common/used build processes and allowed processes that will run around the build process)</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c259dc32-40e6-4121-b6cc-4e78a0e49531",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Potential Fodhelper UAC Bypass",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','74302aac-cd4c-417f-a2a4-c0764bc4b37a')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>Account</strong>, <strong>Computer</strong>, <strong>ProcessName</strong>, <strong>ObjectName</strong>, <strong>ObjectValueName</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was there suspicious activity leading up to the incident?</li><li>Is this expected and approved behaviour in your organisation?</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for remediation, some actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Review responsible account/device's recent sign-ins and activities</li><li>Isolate device</li><li>Disable responsible account</li><li>Stop and quarantine the responsible file(s)</li><li>Search for similar behaviour in other devices across your organisation</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "82e3b4b7-71d8-4a70-b75d-b63931e12d73",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Insider Risk_Risky User Access By Application",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b0b156e1-14a4-464c-9b0c-51529edff3de')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review Alert Details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Observe the percentage value by basket operator.</li><li>Check the percentage values by the User Name(s), Application Name(s), and IP address(s).</li><li>Use the following KQL as a template for investigation</li></ul><pre  spellcheck=\"false\">set query_now = datetime(yyyy-mm-ddT00:00:00.000Z);\nSigninLogs\n| where RiskState == \"atRisk\"\n| project UserPrincipalName, Location, AppDisplayName, RiskState, IPAddress\n| evaluate basket(0.01)\n| where UserPrincipalName &lt;&gt; \"\"\n| where AppDisplayName &lt;&gt; \"\"\n| project Percent, UserPrincipalName, Location, AppDisplayName, RiskState, IPAddress\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Closing or Escalation",
              "description": "<ul><li>If the IP address(s) are malicious or the use applications are unusual, then escalate the incident for further investigation.</li><li>If the percentage of the activity is high and the sign-in activity is non malicious or expected (regular activity), then an  adjustment to basket threshold will be required.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "9547216e-76bf-4747-a890-8e22cb38590a",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Mail.Read Permissions Granted to Application",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','c14a01f0-ef23-426e-90c0-b9df8c869f65')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>InitiatingUser, UserIPAddress</strong>, <strong>UserAgent</strong>, <strong>PermissionsAddedTo</strong>, <strong>Permissions</strong>, <strong>AppName </strong>and <strong>RuleDetail</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich UserIPAddress",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP in from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul><div><strong>\ufeff</strong></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review InitiatingUser account sign-ins for suspicious activity",
              "description": null
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the the added application expected and approved for your environment?</li><li>Confirm if user's are responsible for adding the application and/or suspicious logins (It is recommended not to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager).</li></ul>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins or rule creation, possible actions may include:</strong></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review applications that have access and inbox rules, removing where necessary.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c8f32450-176e-490b-ba4f-9a91536c7fc5",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','ff905e7e-ad2a-4567-a7ac-38228bb595e7')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate the Powershell Command to determine if suspicious",
              "description": "<div>Investigate the device logs to look at the command line for this particular incident. This could involve decoding the command from base64. Determine if this is expected/approved for your environment.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate IP that the command is connecting to",
              "description": "<div>Determine if the connection is made to an IP that is cause for concern (reports of abuse, out of country, etc.)</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necassary)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><div><br></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c98635eb-83c4-48a4-8929-b6369e162264",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Insider Risk_High User Security Alert Correlations",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b42eebcd-eda3-425b-866f-19cba4aff350')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident or alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Check the related alerts and review the activities by the entities involved in the incident.</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Closing or Escalation",
              "description": "<ul><li>If the entities related have suspicious/unusual activity, then the incident should be escalated for further investigation.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "802527f7-eac5-4b13-9787-ce776cf0aff7",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - User Assigned Privileged Role",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','8ea63a42-60ae-4353-adfe-68fdec901f9b')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the User is required to have privileged access",
              "description": "<div>This could involve:</div><ul><li>Reaching out to the necessary managers</li><li>Analysing the account and looking for anything that could be suspicious (Account was recently created, account name doesn't follow naming policy, account is performing strange actions , etc.)</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Disabling the account</li><li>Isolating any devices that the account logged in to</li><li>Remediating any malicious activities performed by the account</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "e3a6ccc1-6ce6-4060-9801-e91ab0deac18",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Failed logon attempts in authpriv",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','a14920d2-5347-4d05-8bb7-0417c5846220')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the attempts are malicious",
              "description": "<div>This could include determining the following:</div><ul><li>The number of attempts</li><li>Whether the attempts are internal or external (outside your network)</li><li>Determine who is trying to access the machine and if they have a legitimate reason to do so</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if there were any successfull attempts after",
              "description": "<div>If there were, determine if they were approved/expected.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Blocking the external IP from accessing the device</li><li>Disabling any accounts that are trying to access the device</li><li>If internal, reporting the incident to the relevant managers</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "2b71dcad-196f-4d50-a7f3-9b43435fc4b3",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','e1ab8b56-fd2a-4af7-b0a7-dee14b7948c4')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Extract the entity details given in the alert.</li><li>Perform a search for the identified entities within Sentinel using the following KQL as a template.</li></ul><div><br></div><div><br></div><div><br></div><pre  spellcheck=\"false\">Search *\n|where * has \u201c&lt;entity&gt;\u201d\n|summarize count() by $table\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<div>Follow standard operating procedures for triaging suspicious process executions, which may include:</div><ul><li>Identifying if the execution of vbscripts is common or unexpected expected activity.</li><li>Confirming (with the relevant team(s)) if the activity is approved, or not.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "a5bb57c1-eade-406a-993b-af8a854883e7",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - A host is potentially running a crypto miner (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','39742977-3409-4759-af53-9e7fee968857')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check for any process that may be utilising unusually large amounts of device resources (CPU, GPU, etc.)",
              "description": null
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Search for any suspicious IoC",
              "description": "<div>Search device network logs for regular connections made to the IP address related to the alert. Look for any suspicious command lines and user agents involved</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediation (if required)",
              "description": "<div>If a crypto miner is present, possible actions include:</div><div><br></div><ul><li>Uninstalling malicious programs</li><li>A full AV scan</li><li>Reseting browsers to default settings</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "33aefea7-81fd-44ec-b172-a945912e6014",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - SUNBURST suspicious SolarWinds child processes (Normalized Process Events)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','1f53e419-aeff-49a8-be2d-af2db46de642')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>AccountCustomEntity (ActorUsername) </strong>and <strong>HostCustomEntity (User) </strong>will likely be relevant in developing an accurate conclusion.</div><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Process Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Does the child process seem suspicious (tools such as Virus Total can help for checking hashes)?</li><li>Is the child process otherwise something you would expect to see in your environment, especially with SolarWinds.Orion.Core.BusinessLayer.dll?</li><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Did the child process reach out to any external IPs, if so, are they suspicious (tools such as AbuseIPDB, IP2Location, etc. can help check).</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for handling malware, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "172bdb71-fe8a-4f3c-b3a6-5f62bcc9e896",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - (Preview) TI map Domain entity to Dns Events (ASIM DNS Schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','883f6ac0-5d4e-48d8-87f2-ffb3bd3bfcbb')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether TI mapping is a true positive",
              "description": "<div><strong>Double check the mapped TI domain via enrichment</strong></div><div><br></div><div>Confirm whether the domain is malicious with tools such as:</div><ul><li><a href=\"https://www.virustotal.com/\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li><li><a href=\"https://urlscan.io/\" rel=\"noopener noreferrer\" target=\"_blank\">URLScan</a></li><li><a href=\"https://www.browserling.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Browserling</a></li><li><a href=\"https://www.whois.com/whois/\" rel=\"noopener noreferrer\" target=\"_blank\">WhoIs</a></li></ul><div><br></div><div>If domain is malicious continue on, otherwise note as False Positive.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on records involving domain",
              "description": "<div>To scope the recorded interactions involved with the domain you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT DOMAIN&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div>e.g.</div><div><br></div><div><br></div><div><br></div><div><br></div><pre class=\"ql-syntax\" spellcheck=\"false\">search \"malicious.xyz\"\n| summarize count() by $table\n</pre><div><br></div><div>The results will display which tables have recorded instances of the string entered.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on actions involving domain",
              "description": "<div><strong>Using the above tables drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DnsEvents table, you can check what the DNS A requests were resolving to, or the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre  spellcheck=\"false\">DeviceNetworkEvents\n|search \"malicious.xyz\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM DNS Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine need for containment and remediation",
              "description": "<div>If malicious activity has occurred and was not stopped by any form of security solution(s) such as firewall, XDR, or security tooling, follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve:</div><ul><li>Isolate and scan affected devices</li><li>Reimage/restore affected devices</li><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "980adb59-7284-4c77-98ae-180478de34d0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Malware in the recycle bin (Normalized Process Events)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','fc4cba48-4946-4813-8493-9106d3dfc2a9')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>User</strong>, <strong>Process</strong>, <strong>FileName</strong>, <strong>CommandLine</strong> and <strong>ActingProcessName</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the file something you would expect to see in your environment?</li><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was the suspicious file executed, what did it do if so?</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "39722c91-f74e-4981-96a1-6472abb53d45",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Excessive number of failed connections from a single source (ASIM Network Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','69559a99-5851-4ffb-92cc-6ed7f11d02d3')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract SrcIpAddr value",
              "description": "<div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich IP",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP in from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review network activity for IP",
              "description": "<div>Review activity relating to the suspicious IP, this could include:</div><ul><li>Sign-in activity</li><li>Device connections</li><li>Firewall logs</li><li>If IP is internal, identify device that owns the IP address and investigate device</li></ul><div><br></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if connections are potentially malicious",
              "description": "<div>Using knowledge obtained from enrichment and reviewing logs, determine if activity is potentially malicious or an alternative such as a misconfigured system.</div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Possible actions may include:</strong></div><ul><li>Blocking the IP in from accessing services or at the gateway/firewall level</li><li>Applying relevant fixes to device responsible (if internal)</li><li>Updating rule to be less sensitive or excluding IP from rule if activity from the IP is expected and approved</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "467fe961-d1ab-4fa0-b5ab-035e0462d6d6",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - New Agent Added to Pool by New User or Added to a New OS Type.",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','78ce0ac9-c15d-44b6-9bfc-eda73af4319b')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": null
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the ActorUPN, IPAddress, UserAgent, and OSDescription regular/recognisable in your environment or the noted Agent Pool? Is this normal or expected behaviour?</li><li>Was there suspicious activity leading up to/surrounding the incident?</li></ul><div><br></div><div><strong>NOTE</strong>: The Analytic Rule that generates this incident is intended to be modified in the Sentinel Analytics blade to tailor it to the environment. This may cause initial false positives.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Review related user/device's recent sign-ins and activities</li><li>Isolate device</li><li>Search for similar behaviour in other devices across your organisation</li><li>If incident is resulting in numerous false positives, the Sentinel Analytics Rule can be modified as per the comments in its KQL (to include allowed users that will normally add agents to pools)</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "dfe9cd97-ff67-4d86-b7e7-6879516ae68a",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Rare application consent",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','22cd1d83-d573-45f4-9ced-edc0051a2a6f')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Identify the account name(s), host name(s), and the IP address(s) involved in the incident.</li><li>Perform a KQL search on AuditLogs table within Sentinel to identify the changes made by the user(s).</li><li>Use the following KQL as a template to investigate.</li></ul><div><br></div><div><br></div><div><br></div><pre  spellcheck=\"false\">AuditLogs\n|where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-5m)..(todatetime('yyyy-mm-ddT00:00:00.000Z')+5m))\n|where * has \"&lt;accountName&gt;\" and * has \"&lt;hostName&gt;\"\n|extend CreatedByUser = tostring(InitiatedBy.user.userPrincipalName), CreatedByIPAddress = tostring(InitiatedBy.user.ipAddress)\n|extend UserPrincipalName = tostring(TargetResources[1].userPrincipalName)\n|extend TargetName = tostring(TargetResources[0].displayName)\n|extend Changes = todynamic(TargetResources[0].modifiedProperties)\n|mv-expand Changes\n|evaluate bag_unpack(Changes)\n|summarize count(), make_set(CreatedByIPAddress) by CreatedByUser, OperationName, TargetName, Category, Result, AADOperationType, displayName, newValue\n</pre>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the activity by the user has not been observed before or are suspicious, confirm if the changes made by the user have been approved.</li><li>If the changes are commonly seen or are part of a routine activity, then the incident can be closed as False Positive.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "d30aac90-f283-4eec-b51e-64462ee3f76e",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Malicious Inbox Rule",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','1b216771-f729-4c6c-803a-76e1f6fdb6ec')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>UserId, ClientIPAddress</strong>, <strong>Keyword </strong>and <strong>RuleDetail</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Enrich ClientIPAddress",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><ul><li>Is this IP known to your organisation?</li><li>Is the IP in from a location you would expect to see from your users?</li><li>Do threat intelligence sources list the IP as known to be malicious? (suggested sources: AbuseIPDB, VirusTotal)</li></ul><div><strong>\ufeff</strong></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review UserId account sign-ins for suspicious activity",
              "description": null
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the created rule one you would expect to see in your environment?</li><li>Confirm if user's are responsible for the creation of the rule and/or suspicious logins (It is recommended not to contact the user directly to avoid a scenario of a threat actor with control of the account replying with incorrect information. A common method is to instead contact the user's manager).</li></ul><div><br></div>"
            }
          },
          {
            "order": 5,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised logins or rule creation, possible actions may include:</strong></div><div><br></div><div><br></div><ul><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review inbox rules, removing rules where necessary.</li><li>Review account activity across relevant services after the breach occurred.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "eb4fce6a-5940-4494-9ba4-e6be85c1a2ce",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Mail redirect via ExO transport rule",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','718ab67f-0c86-4b48-86d6-0445dd287ee1')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the rule is legitimate",
              "description": null
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Removal of the rule</li><li>Removal of the mailbox (if created in your environment)</li><li>Further investigation into the existence of the rule (if created by an account in your environment then disable the account)</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "a2ce6e91-7a0f-458e-af66-35d1fdb10b25",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - First access credential added to Application or Service Principal where no credential was present",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','4bde2ab2-cbe3-48e1-ae51-aa427ccec63f')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the<strong> InitiatingUserOrApp</strong>, <strong>InitiatingIpAddress</strong>, <strong>targetDisplayName </strong>will likely be needed to accurately conclude the investigation.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is this activity expected and approved? If not, it should be escalated with high importance.</li><li>Review sign-in activity and recent actions for user that created the credentials.</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>If there was unauthorised permissions changes, possible actions may include:</strong></div><ul><li>Disabling accounts.</li><li>Reset user credentials.</li><li>Revoke active sessions.</li><li>Review account activity across relevant services after the breach occurred and remediate as required.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "1a59f071-d12b-4fd5-9823-a810434e9722",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - (Preview) TI map IP entity to Network Session Events (ASIM Network Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','9826d7df-5b9b-42ad-85c4-defc25780306')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether TI mapping is a true positive",
              "description": "<div><strong>Double check the mapped TI IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP is malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul><div><br></div><div>If IP appears potentially malicious continue on, otherwise note as False Positive.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on records involving IP Address",
              "description": "<div>To scope the recorded interactions involved with the IP address you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT IP&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div>e.g.</div><pre class=\"ql-syntax\" spellcheck=\"false\">search \"1.1.1.1\"\n| summarize count() by $table\n</pre><div><br></div><div>The results will display which tables have recorded instances of the string entered.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on actions involving IP Address",
              "description": "<div><strong>Using the above tables drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DnsEvents table, you can check what the DNS A requests were resolving to, or the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved. CommonSecurityLog can also be a good point to check traffic flows and whether security tools have allowed or denied traffic to the IP address.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre  spellcheck=\"false\">DeviceNetworkEvents\n|search \"1.1.1.1\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Network Session Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine need for containment and remediation",
              "description": "<div>If malicious activity has occurred and was not stopped by any form of security solution(s) such as firewall, XDR, or security tooling, follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve:</div><ul><li>Isolate and scan affected devices</li><li>Reimage/restore affected devices</li><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "8ab50014-a30b-468a-8a7d-5f8ccfbfdfc0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - M2131_DataConnectorAddedChangedRemoved",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','ad0bd28b-7d25-45ab-bdbb-45d797af1869')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Assess Context",
              "description": "<div>To check on the events surrounding this incident's timeline the <strong>Azure Activity logs</strong> can be used. These can be found by going to:</div><ul><li>Sentinel &gt; Settings &gt; Workspace Settings &gt; Activity Log</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Escalate Issue",
              "description": "<div>If the activity looks to be unknown/unplanned/suspicious, escalate issue as per standard operating procedures.</div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "d48e1e86-d811-459f-99de-94bc6beacb2a",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Office policy tampering",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','d544292e-a784-476c-b010-929e4a4bfd78')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review Alert Details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigation and Closing",
              "description": "<ul><li>Check the activity performed by the user(s) identified in the alert to see if they are expected normal activity or unusual suspicious activity.</li><li>If the user is not an administrator or performs unusual policy changes, then escalate the incident for confirmation.</li></ul><div><br></div><div>Use the following KQL template for investigation.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><pre  spellcheck=\"false\">AuditLogs\n| where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-10m)..(todatetime('yyyy-mm-ddT00:00:00.000Z')+10m))\n| where * has \"&lt;userName&gt;\" and * has \"0.0.0.0\"\n</pre>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "24ac9d51-f702-454e-874c-3f635dfd58bb",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Suspicious application consent similar to O365 Attack Toolkit",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','a88cd032-3e7d-4797-9d73-534e61da8d1a')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Check the AuditLogs table to identify the changes made.</li><li>Analyse the application(s) and the activity to determine if they are malicious.</li><li>Use the following KQL as a template to investigate.</li></ul><pre  spellcheck=\"false\">AuditLogs\n|where TimeGenerated between ((todatetime('yyyy-mm-ddT00:00:00.000Z')-5m)..(todatetime('yyyy-mm-ddT00:00:00.000Z')+5m))\n|where * has \"&lt;accountName&gt;\" and * has \"&lt;IPAddress&gt;\"\n|extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName), CreatedByIPAddress = tostring(InitiatedBy.user.ipAddress)\n|extend UserPrincipalName = tostring(TargetResources[1].userPrincipalName)\n|extend TargetResourceName = tostring(TargetResources[0].displayName)\n|extend Changes = todynamic(TargetResources[0].modifiedProperties)\n|parse Changes with * \"DisplayName: \" displayName \", newValue: \" newValue \", oldValue: \" oldValue \"]\" *\n|mv-expand Changes\n|summarize count(), make_set(CreatedByIPAddress) by InitiatedByUser, OperationName, TargetResourceName, Category, Result, AADOperationType, tostring(Changes)\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the application(s) or the activity appears suspicious, or is found to be malicious, then escalate for further investigation.</li><li>If the application(s) identified have not been seen before, then escalate to confirm if they are legitimate.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "ec8968e8-5166-4cea-8d58-8b0d1e078a09",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Azure DevOps Personal Access Token (PAT) misuse",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','12897552-ca20-48d6-9892-2b615c2afc42')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the PAT was created maliciously",
              "description": "<div>Determine if:</div><ul><li>The PAT was generated by the user</li><li>The PAT was generated on behalf of the user by a tool</li></ul>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if it was used maliciously",
              "description": "<div>Was it used to access items that should not ordinarily be accessed by the user.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necassary)",
              "description": "<div>Remediation could include:</div><ul><li>Revoking the PAT</li><li>Resetting the user's credentials (if the user was compromised)</li><li>Investigating what the token was used to access and remediating/undoing any malicious changes.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "483bf205-c8d8-4374-a3a9-9ada3c1e7f1c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Modified domain federation trust settings",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','c931529c-384d-4758-b2dc-b60753dfa646')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review Alert Details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Check the activity performed by the user(s).</li><li>Use the following KQL as a template for investigation.</li></ul><pre  spellcheck=\"false\">AuditLogs\n| where ActivityDisplayName != \u201d\u201d\n| project TimeGenerated, SourceSystem, TargetResource[0].displayName, AADTenantId, OperationName, InitiatedBy, Identity, Result, ActivityDisplayName, ActivityDateTime, Type\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Closing and Escalation",
              "description": "<ul><li>If the activity performed by the user is unusual or not commonly seen, then escalate for confirmation.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "a94c1913-00c2-44b8-a2fc-8fba763c4741",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - (Preview) TI map IP entity to Web Session Events (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b0cc08ec-98aa-4cf1-b5b5-197afa3b7ff3')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether TI mapping is a true positive",
              "description": "<div><strong>Double check the mapped TI IP via enrichment</strong></div><div><br></div><div>Confirm whether the IP is malicious with tools such as:</div><ul><li><a href=\"https://www.abuseipdb.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Abuse IP DB</a></li><li><a href=\"https://www.ip2location.com/demo\" rel=\"noopener noreferrer\" target=\"_blank\">IP2Location</a></li><li><a href=\"https://ipinfo.io/\" rel=\"noopener noreferrer\" target=\"_blank\">IP Info</a></li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li></ul><div><br></div><div>If IP appears potentially malicious continue on, otherwise note as False Positive.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on records involving IP Address",
              "description": "<div>To scope the recorded interactions involved with the IP address you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT IP&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div>e.g.</div><pre class=\"ql-syntax\" spellcheck=\"false\">search \"1.1.1.1\"\n| summarize count() by $table\n</pre><div><br></div><div>The results will display which tables have recorded instances of the string entered.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on actions involving IP Address",
              "description": "<div><strong>Using the above tables drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DnsEvents table, you can check what the DNS A requests were resolving to, or the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved. CommonSecurityLog can also be a good point to check traffic flows and whether security tools have allowed or denied traffic to the IP address.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre  spellcheck=\"false\">DeviceNetworkEvents\n|search \"1.1.1.1\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Web Session Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine need for containment and remediation",
              "description": "<div>If malicious activity has occurred and was not stopped by any form of security solution(s) such as firewall, XDR, or security tooling, follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve:</div><ul><li>Isolate and scan affected devices</li><li>Reimage/restore affected devices</li><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "80417d17-4eb0-49e7-923c-6acba410ce3d",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2023-03-01-preview",
      "properties": {
        "displayName": "AddTasks - SharePointFileOperation via previously unseen IPs",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','abf2defc-50a7-4849-9bff-e591d1f54722')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review the incident and extract entity(s) details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA1CAYAAAAK0RhzAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAADagAwAEAAAAAQAAADUAAAAAR9k5dwAAAAlwSFlzAAALEwAACxMBAJqcGAAABjFJREFUaAXtWXtsU1UY/xWG6wpb2egePCUoE8UxISrIS3AIYvYHcxJ5KD7QKDEBgwEy/QM0isHE+AdGHmoQDYLodGgI00CAgDhUEDWoTN2LwdatrC1bu96u7Tzfubvd7drbnVsI65Z92+259zvfefzO7/vOOfdcQzsT9EFJ4Jh2GfoctAF9DlEHoH5gvY3ZfsZ6G2PyrKjV66d7wUqgMaP3u6IWqfGqj+6KUXq96XADXjvSGLSYM24wNualg9J4EN3AFEC5lmSsmDAyiKHeLWHJnjrcnpUQFwANfK+oEYDomDyOVbgw94Mq5FpSOBACpSVWBrDe7YWcSmh/a6KWqabe7XajtLQUeXl5MJvNmnY8Q6PvQpMHAZs/xsKAJfNL3dIExhBdimSaErkN2WexeyorKn6/HyUlJcjJyUFhYSGqq6tFi4bZCQGjUjTxB9hPoCNVnosWDMGiXGPEfD2LxcmTJ5GdnY2CggJUVFRQk9ckwsC8/gA8bEQln5+nno6UWg+wNx/lWZ1PelEpLy/ngFatWiVaJKpdpw9FNQPaGF0SA2dgfzJ/BsaS3HHqv+Snp/aQfGJYVPLz8+F0OpGSkoLi4mI0NDSIFo1oJw6MgZJ8zBEjvLoFGCBik+NU5et5h83IyIjYwViVwsAaPV6YBg1UtaMwJ8ceMSYjU0wMPB57al0TBuZjfkVxJFNGIGRgZ2slnK31duR16q+2+eGQ2hSUNzwVArZpXgbfZViMNzE8SuCwlP2v3K+KBY5LzqeY7Cm2aBSFZ0XaLtW6PDzOiDmKN4qrHY+m49mpycFnrmf5l1s8fAdyw6nqaFAYGLFma/XC4W2Dl8WTFAjwtKzGgx+qWoPPpLeynce6+9N6B2M0EEefG4s6lxSyjm05ZsPxSldwHWtkoFbPHAoaiJ4UYcaokxQzBO4yA9fCJgda12g2VC675MPa2anXDZTBoFo7dI6SLmBqcFNGJcLFwFGc0dXs9WE9c7/rwZTVagWtgbRnjFV0A1OD2zBnGNxsoiCARXOHXRdQsQLpWk5ouu9aSHkmdsg9e3JaV/rSNY2JMXUl8QiK+nfNwNQg4+m+H1g8sSHSF12MVdq9OFXtDqt366kmrD1YH6bvSYUuYIv31GLG9kpcdIbu2iuavDhvlWLC8dEvdvx7xRtT2WiFhIERW2cutcJsHIjtp+3R6tSV98LXdaiyhw6Urgo0jIXXsW1lduRkGfH4ZDPePm7DGw9mQGvHc+DPZrxzwoYWbwBLcs1YN8vCbTccsmLyCCNKy1tYdwywuX2g97z1h+oxidX98eKRKKtpxUZ2GFvjaEPucCP2LR2l0fXoaiHG6Oxi5092PH9vKp6aMhRX3H4c+S/ysdpX569i0ac1mDbGhMcmmfHqdw048Fcz78U3LH1i/yW4GODpNyfh4duGcP3U0SY8cMtgtpFux6wdlZiYmch2MelITIh9ryjE2Pf/tMDp8WM5Y2soc8VZY03YeuoK5t0afpxdVGrFCgb+zfny7v5Co4TPf3di0R3yISsx9sXy0cHhXvNtPQrvTOF1Xb4qM3jPqCQ+KDQwsYoQsPd+bELCAAOW7q3l7VSymDhR5YaDgSWgaqloakO5zYFPzjqC6uHJnc3MHy+zFMxU3YxIScD62RYs21eL19l3gXfzs/BQtra9qmjYbWeLYVmyoom53cG/m7Hy7lSMSxvElcTYxsON2H3GgTUzhoWUpLggJjcvyAzRKw9pptCBIL36/HHLwky8NJNtqFmcLdxVjQsvj0e2hR1J6JRuY2w3G3kj8/XtBcPxytz04LXsLjOIya5C+g9/tuP0RTd/wyY3jLT2KeUI6Lk6D7e1ufzY+xs7W0wcgKI56dykocWnmOpKu2Xs/bIm7u/kimp5cVoad7c/6j0hs+OTLL4+O+fE9G2V3JxGe+cjI/j9QDaMobUAq6engWbLzUdt+HX1ODzz5SU+iVABir37xiTxsnp/hL626K2U7MmFaTlITQp3va71NUsBEGjTINmBaANA6yUx161ofG3plrFuK9YwiBRLGqZI7gJgtFmOZS17Eb3AkIhUE382fRZYdFfU8N/44ye8R32WsX5g4WTHt6afsfjmJ7x38s4jXN/rNf8DhUyY7wG3zNoAAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate SharePointFileOperation Activity and IP addresses",
              "description": "<ul><li>Identify the IP addresses used in the activity and search for any Abuse reports to determine if they are malicious IPs.</li><li>Use the below KQL to quickly identify SharePoint File Operation activity.</li></ul><div><br></div><pre  spellcheck=\"false\">OfficeActivity\n| where TimeGenerated between (todatetime('yyyy-mm-ddT00:00:00.000Z')..todatetime('yyyy-mm-ddT00:00:00.000Z'))\n| where RecordType == \"SharePointFileOperation\"\n| where&nbsp;UserId has \"&lt;user'sName&gt;\"\n| summarize count(), make_set(ClientIP) by UserId, UserType, UserAgent, ClientProcessName, ItemType, Operation, RecordType, Site_Url, SourceRelativeUrl, SourceFileName, EventSource, SourceSystem\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Concluding the investigation",
              "description": "<ul><li>If the IP addresses are external or are not known to the organisation, confirm the activity with the user.</li><li>If the IP addresses are found to be malicious (via Abuse IP checks), the incident should be escalated and further investigated.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "42d33097-0ee8-48d8-8d13-967f4c74fa3b",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','c8f24e19-431a-415b-b06d-b23c98cc7fdb')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check over Incident Entities",
              "description": "<div>Incident entity values such as the <strong>User</strong>, <strong>Process</strong>, <strong>FileName</strong>, <strong>CommandLine </strong>and <strong>ActingProcessName </strong> will likely be relevant in developing an accurate conclusion.</div><div><br></div><div>Further, due to this being an ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Process Event Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<div><strong>Check whether the EXE is known or expected to have been added to AD Domain Service Default Policies.</strong></div><div><br></div><div>If EXE appears suspicious, you can use tools such as the following to check hashes/sandboxing (however, be careful about uploading files to sandboxes due to privacy/adversarial monitoring):</div><ul><li><a href=\"https://security.microsoft.com/evaluation/overview\" rel=\"noopener noreferrer\" target=\"_blank\">MS365 Defender</a> (if available)</li><li><a href=\"https://www.virustotal.com/gui/home/search\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a> </li><li><a href=\"https://www.hybrid-analysis.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Hybrid Analysis</a></li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediation (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device (if able to)</li><li>Quarantine the responsible file</li><li>Revert default policies to known-good versions</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "ec5dcf0a-841d-49dc-8183-689b6eaf5f31",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Prestige ransomware IOCs Oct 2022",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','23003341-8af9-492c-a36e-e34321de1e33')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediation (if necessary)",
              "description": "<div>A match on hashes most likely indicates a TP. Remediation could include:</div><div><br></div><ul><li>Isolating the device</li><li>Determining if the files are present on other machines and isolating them if they are</li><li>Determining how the file was introduced to the system</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "8ee56112-2b8f-4e32-a3c5-ce10a2a0724b",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - DEV-0586 Actor IOC - January 2022",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','2dd409f8-dd13-4f78-8203-d56de95b5ad3')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the hit is on the Hash or on the command line",
              "description": "<div>If the hit is on the hashes then proceed to remediation. If the hit is on the command line then ensure that it is not part of any pen-testing activities or other legitimate use cases</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Isolating the device</li><li>Disabling the account that the activities are occurring on</li><li>Ensuring that the actor is not present on other devices</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "5724a70b-0f91-470a-b55f-3c572bd1427c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Insider Risk_High User Security Incidents Correlation",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','ba72a490-8a49-4667-89e9-b75ddd87e838')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review incident details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Check the related activities performed by the user(s) involved in the incident.</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the user identified in the incident have suspicious or unusual activity, the incident should be escalated, and the activity should be confirmed with the user.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "894c7cbe-bdef-49f0-b958-5383bf334407",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Insider Risk_Microsoft Purview Insider Risk Management Alert Observed",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b375aa19-75b8-47c6-8ce0-6b9017515e31')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Extract the entity details from the alert.</li><li>Check all the activities that are associated with the identified username(s), application(s), location and IP address(s) noted in the alert.</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>If the location is outside of Australia and the IP address is malicious, then confirm if the user is currently on travel or if this activity has been approved.</li><li>If the activity is suspicious, investigate further to identify any other suspicious activities carried out by the user and escalate as necessary.</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "8a80a343-6c9f-4f7c-a282-44effcc84fb5",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - A client made a web request to a potentially harmful file (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','3fac13e7-ad82-4d9d-aded-8e98b1f88e65')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>SrcIpAddr</strong>, <strong>requestedFileName</strong> and <strong>Url</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review and enrich the extracted entities",
              "description": "<div><strong>The enrichment services listed are only suggestions, there are many other potential sources. The suggested sources are not required to be used.</strong></div><div><br></div><ol><li>Determine if the entities extracted are approved and expected for your environment</li><li>Enrich the entities:</li></ol><ul><li><strong>SrcIpAddr</strong> - Check the IP reputation (possible sources: AbuseIPDB, VirusTotal)</li><li><strong>requestedFileName</strong> - If possible, search your environment for the file and get the hash. Enrich the hash (possible source: VirusTotal)</li><li><strong>Url</strong> - Check the domain reputation (possible source: VirusTotal)</li></ul><div><br></div><div><br></div><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is the downloaded file something you would expect to see in your environment?</li><li>Which application/user initiated the download and is this normal behaviour?</li><li>Was the suspicious file executed, what did it do if so?</li></ul>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c8a47895-683b-47c2-a344-72ea9c6acda3",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Exchange OAB Virtual Directory Attribute Containing Potential Webshell",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','80ebdfb0-1528-4886-96b8-1295fc316671')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if directory changes are malicious",
              "description": "<div>Investigate logs to see if the Internal or External host names were changed unexpectedly</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if a webshell is present",
              "description": "<ul><li>Look for connections made to new (never before seen IPs)</li><li>Suspicious command lines</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Deploy updates to affected Exchange Servers.</li><li>Investigate for exploitation or indicators of persistence.</li><li>Remediate any identified exploitation or persistence and investigate your environment for indicators of lateral movement or further compromise.</li><li>Further information can be found here: <a href=\"https://msrc.microsoft.com/blog/2021/03/multiple-security-updates-released-for-exchange-server/\" rel=\"noopener noreferrer\" target=\"_blank\">On-Premises Exchange Server Vulnerabilities Resource Center - updated March 25, 2021 | MSRC Blog | Microsoft Security Response Center</a></li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "c8f79285-ddcd-4ae9-a219-a9f4a112f8d5",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Suspicious number of resource creation or deployment activities",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','67ca06ad-80b1-4bbe-b1bf-5865aa47b9a8')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Review alert details",
              "description": "<div>Access the alert in KQL by selecting the 'Alerts' under the 'Evidence' heading.</div><div><img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB0AAAAcCAYAAACdz7SqAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAB2gAwAEAAAAAQAAABwAAAAAECFS4gAAAAlwSFlzAAALEwAACxMBAJqcGAAAA0lJREFUSA3Fl09IFFEcx78z466OrqVpmakZiSmCeEiJoJCiLumtgkqMKCro4qHy4C0jiC7RRUhC3EOYHfpzCIJAJYTQQ4Ypin+pbNf/Ops6s7vzp/dm3cHdmV13Se3tzu7v/d7v/T7v93tv33vLaIv9Gtyd2MmSgJluoKduJ5lgd5S2DkswQZP2EZVmUv+bggGkWcNFKJQhgV+eMRq3VGghYPKmJWp6h2a94BoGkfFwGH0uMdBjCz5DI113ePrFJBSfDRk2HrVFuVA1DY0fViHIixhaWoG7oSgiemBgACUlJWDZyPFYtqQyyTjsSIXDzqEwi8PFozxS7Qk4mOwAq9ggSIoJOjo6itLSUv3xer2m9o0KS6gkK/D4ZKyQB4wKRyLwh8genx9eRQXDrE/OBk+CIMDpdG7QRBYt00uBKsfqa1hSOKjkRaF0IfgUDSl2M7S8vDwyJazFEiqQiDSOg0Lm8vu0hukVGQKBUtSa4gdnEWmY36hVy/Q2n9+PsWVRj463A9m7WT3dc6IP767mRXUYS6NlpCcOpeBscSI6RiR0TvjRMRFwdbcyHdXFqbH4jWpjGSnt0XYpD/dPpWPZSxaQX0Y9kesrM6M6o40amRKe56PaWUYa7HHvZCaulKUhy8GBY82LJ2gX73dUKHV2YNemJvEyo2+DcXuLsUPEOa1snjRc3H7rMmQroXdKjOtcsoT2/BKxJKp43rOkMyQ5cNS5PTKefJ4nO5WKsQUfOQQktPd7cOzZOF72CaB2j7vmMTLvsxqbobOE1rRPob+uAM6vy4YhFSqaJnDuiAO3SOSd46u4+caFggwbWBuDwkw79jQOo6rYAdGvhvQLr1hCPZKK6tYf+OaW9G2PdlJUDSp5al//hkuQ9XQ+OLMX5Tk8WLJDVeTyeF+bh6rWn1jbBGpamo+6FvDpRj7KspPQS9Jc82oKvI3VfzIiSV/LhRzQc3ZuVYaNC/yM8tJs6J+WMEj0H6/n42n3Ao4fTA4P0Kgz2lCThi93Agp6c7hmPrYMayLQ1NFBhBc66/re7NeQTNJtKrHeHEwdicIKSO2CGEtgmKPQ9GpkAbRlEZNtuJgFR0W8h0LpiDbc2mh1O4p5craDEuaT+R9/K/4C2+ImlxxiJc4AAAAASUVORK5CYII=\"></div><div>An instance of the Log Analytics workspace will appear with a query to show the alert.</div><div><br></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Investigate",
              "description": "<ul><li>Extract details of the entities identified in the alert.</li><li>Check the Azure Activity table or perform a search to identify any records related to the activity.</li></ul><div><br></div><div><strong><em>Note:</em></strong><em> To find relevant events or activities involving the entities identified in an alert, the 'search' feature within Sentinel could be used. A sample KQL is shown below.</em></div><pre  spellcheck=\"false\">search \u201c&lt;entity&gt;\u201d\n|summarize count() by $table\n</pre><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Close or Escalate",
              "description": "<ul><li>Confirm with the relevant team responsible for managing the identified resources to determine if the activity is approved or expected.</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "5a27309b-7097-4751-aa5d-b25d30eee2e1",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Probable AdFind Recon Tool Usage (Normalized Process Events)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','5de3ca9c-cd9d-4329-b63b-65542de31a39')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>AccountCustomEntity (User)</strong>, <strong>HostCustomEntity (Dvc)</strong>, <strong>ProcessCustomEntity (ActingProcessName) </strong>and <strong>CommandLineCustomEntity (CommandLine) </strong>will likely be relevant in developing an accurate conclusion.</div><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Process Event Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Does the file appear to be a version of Adfind?</li><li>Is the file something you would expect to see in your environment?</li><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was the suspicious file executed, what did it do if so?</li></ul><div><br></div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Follow Standard Operating Procedures for handling malware, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "997da8b2-04b7-47a5-bc72-b1a5471758e1",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Sdelete deployed via GPO and run recursively (ASIM Version)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','f9483e87-5ccf-4914-8f15-5dc6e1894066')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>ActorUsername</strong>, <strong>Dvc</strong>, <strong>Process</strong>, <strong>FileName</strong>, <strong>CommandLine</strong> and <strong>ActingProcessName</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Is sdelete a regular process in your environment? Is this how you would expect to see it being run?</li><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was there suspicious activity leading up to the incident?</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Review responsible account's recent sign-ins and activities</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li><li>Search for similar behaviour in other devices across your organisation</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "f04deea6-d114-4a17-8bf1-27766080c843",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Scheduled Task Hide",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','e637c99e-e503-4733-92ce-b9174ff1f77e')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Extract relevant values from incident entities",
              "description": "<div>Values such as the <strong>Account</strong>, <strong>Dvc</strong>, <strong>Computer</strong>, <strong>CommandLine</strong>, <strong>ProcessName</strong>, <strong>ObjectName</strong>, <strong>ObjectValueName</strong> will likely be relevant in developing an accurate conclusion.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm if suspicious activity is expected and approved",
              "description": "<ul><li>Which application/user was used in the incident and is this normal behaviour?</li><li>Was there suspicious activity leading up to the incident?</li><li>Is this expected and approved behaviour in your organisation?</li></ul>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div><strong>Depending on your environment, some remediation actions may include:</strong></div><ul><li>Run antivirus scan</li><li>Review responsible account's recent sign-ins and activities</li><li>Isolate device</li><li>Stop and quarantine the responsible file</li><li>Search for similar behaviour in other devices across your organisation</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "a41c4a8e-27e0-4784-9d4f-a3d3f5cea70c",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - A host is potentially running a hacking tool (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','9cd1632b-f8fc-4573-ab21-466317a19876')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check your EDR for any suspiciously named processes (random characters) with unusually large amounts of device resources (CPU, GPU, etc.)",
              "description": null
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Search for any suspicious IoC",
              "description": "<div>Search device network logs for regular connections made to the IP address related to the alert. Look for any suspicious command lines and user agents involved</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediation (if required)",
              "description": "<div>If a hacking tool is present, possible actions include:</div><div><br></div><ul><li>Isolating the device from the network</li><li>Removing malicious programs/files</li><li>A full AV scan</li><li>Reimaging the device</li></ul><div><br></div>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "1a0b61f2-e228-471a-8a59-5e7dc93e2ae0",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Linked Malicious Storage Artifacts",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','c52383b7-2938-48af-94db-f782d2f1c7e4')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine if the IP is malicious",
              "description": "<div>Ensure that the IP could not be from someone on the security team that may have uploaded the malicious file for analysing. If not then use an IP analyser to see if the IP has reports of abuse and its location.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if necessary)",
              "description": "<div>Remediation could include:</div><ul><li>Quarantine/Remove the files</li><li>Block the ip</li><li>If they are using a legitimate account then disable the account</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "1648e7ec-d1dc-4652-b349-e4ede9429a42",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Password spray attack against ADFSSignInLogs",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','d2483838-30a4-417c-8d23-10f903848591')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on accounts listed in the SuccessAccounts grouping",
              "description": "<div>For any accounts listed within the SuccessAccounts grouping, check whether there are suspicious successful sign-in activity (such as odd logon times for user).</div><div><br></div><div>Using the <strong>ADFSSignInLogs </strong>Data Table, an example of a KQL command to investigate the sign-in activity could be:</div><pre  spellcheck=\"false\">ADFSSignInLogs\n| where UserPrincipalName in (XXX) // Insert SuccessAccounts users e.g (\"user1@domain.com\",\"user2@domain.com\",...)\n| where ResultType in (\"0\",\"50144\")\n| project TimeGenerated, UserPrincipalName, UserDisplayName, IPAddress, ResultType, ResultDescription, NetworkLocationDetails, ResourceIdentity, UserAgent\n| sort by TimeGenerated desc\n</pre><div><br></div><div>You may want further external context to the account's authentication events, as such other authentication tables are the <strong>SigninLogs </strong>or <strong>AADNonInteractiveUserSignInLogs </strong>Data Tables.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Remediate (if required)",
              "description": "<div>If malicious activity has occurred follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve steps such as:</div><ul><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "560c391e-dcc3-424b-9ef9-3947f39c76b7",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - (Preview) TI map Domain entity to Web Session Events (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','4a50c986-ce8d-4d84-a7de-6a9b9904d5d0')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether TI mapping is a true positive",
              "description": "<div><strong>Double check the mapped TI domain via enrichment</strong></div><div><br></div><div>Confirm whether the domain is malicious with tools such as:</div><ul><li><a href=\"https://www.virustotal.com/\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li><li><a href=\"https://urlscan.io/\" rel=\"noopener noreferrer\" target=\"_blank\">URLScan</a></li><li><a href=\"https://www.browserling.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Browserling</a></li><li><a href=\"https://www.whois.com/whois/\" rel=\"noopener noreferrer\" target=\"_blank\">WhoIs</a></li></ul><div><br></div><div>If domain is malicious continue on, otherwise note as False Positive.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on records involving domain",
              "description": "<div>To scope the recorded interactions involved with the domain you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT DOMAIN&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div>e.g.</div><pre class=\"ql-syntax\" spellcheck=\"false\">search \"malicious.xyz\"\n| summarize count() by $table\n</pre><div><br></div><div>The results will display which tables have recorded instances of the string entered.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on actions involving domain",
              "description": "<div><strong>Using the above tables drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DnsEvents table, you can check what the DNS A requests were resolving to, or the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre  spellcheck=\"false\">DeviceNetworkEvents\n|search \"malicious.xyz\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Web Session Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine need for containment and remediation",
              "description": "<div>If malicious activity has occurred and was not stopped by any form of security solution(s) such as firewall, XDR, or security tooling, follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve:</div><ul><li>Isolate and scan affected devices</li><li>Reimage/restore affected devices</li><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.SecurityInsights/automationRules",
      "name": "fbecacc5-e930-4ec3-afd6-188ac3c38fcd",
      "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('existingWorkspaceName'))]",
      "apiVersion": "2022-12-01-preview",
      "properties": {
        "displayName": "AddTasks - Potential communication with a Domain Generation Algorithm (DGA) based hostname (ASIM Web Session schema)",
        "order": 100,
        "triggeringLogic": {
          "isEnabled": true,
          "expirationTimeUtc": null,
          "triggersOn": "Incidents",
          "triggersWhen": "Created",
          "conditions": [
            {
              "conditionType": "Property",
              "conditionProperties": {
                "propertyName": "IncidentRelatedAnalyticRuleIds",
                "operator": "Contains",
                "propertyValues": [
                  "[resourceId('Microsoft.OperationalInsights/workspaces/providers/alertRules',parameters('existingWorkspaceName'),'Microsoft.SecurityInsights','b8fb163e-32fe-4689-b850-d083d8cfca30')]"
                ]
              }
            }
          ]
        },
        "actions": [
          {
            "order": 1,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Confirm whether domain is DGA based hostname",
              "description": "<div><strong>Double check the domain via enrichment</strong></div><div><br></div><div>Confirm whether the domain is malicious with tools such as:</div><ul><li><a href=\"https://www.virustotal.com/\" rel=\"noopener noreferrer\" target=\"_blank\">VirusTotal</a></li><li><a href=\"https://urlscan.io/\" rel=\"noopener noreferrer\" target=\"_blank\">URLScan</a></li><li><a href=\"https://www.browserling.com/\" rel=\"noopener noreferrer\" target=\"_blank\">Browserling</a></li><li><a href=\"https://www.whois.com/whois/\" rel=\"noopener noreferrer\" target=\"_blank\">WhoIs</a></li></ul><div><br></div><div>If domain is DGA based/malicious continue on, otherwise note as False Positive.</div>"
            }
          },
          {
            "order": 2,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on records involving domain",
              "description": "<div>To scope the recorded interactions involved with the domain you can use the \"search\" command in KQL:</div><pre  spellcheck=\"false\">search \"&lt;INSERT DOMAIN&gt;\"\n| summarize count() by $table\n</pre><div><br></div><div>e.g.</div><pre class=\"ql-syntax\" spellcheck=\"false\">search \"malicious.xyz\"\n| summarize count() by $table\n</pre><div><br></div><div>The results will display which tables have recorded instances of the string entered.</div>"
            }
          },
          {
            "order": 3,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Check on actions involving domain",
              "description": "<div><strong>Using the above tables drill down into each of the log tables to view related events for malicious activity</strong></div><div><br></div><div>For example, if the above results listed a series of events in the DnsEvents table, you can check what the DNS A requests were resolving to, or the DeviceNetworkEvents can be checked to determine what processes, command line arguments, and devices are involved.</div><div><br></div><div>The search command can be used again to gain the full scope of relevance and then exclusions can be made where necessary.</div><div><br></div><div>e.g.</div><pre  spellcheck=\"false\">DeviceNetworkEvents\n|search \"malicious.xyz\"\n</pre><div><br></div><div>Further, due to the ASIM rule, Microsoft Parsers will allow you to search using specific schemas (this rule uses the ASIM Web Session Schema): <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-schemas\" rel=\"noopener noreferrer\" target=\"_blank\">Advanced Security Information Model (ASIM) schemas | Microsoft Learn</a></div><div><br></div><div>Information on using ASIM parsers: <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers\" rel=\"noopener noreferrer\" target=\"_blank\">Use Advanced Security Information Model (ASIM) parsers | Microsoft Learn</a></div>"
            }
          },
          {
            "order": 4,
            "actionType": "AddIncidentTask",
            "actionConfiguration": {
              "title": "Determine need for containment and remediation",
              "description": "<div>If malicious activity has occurred and was not stopped by any form of security solution(s) such as firewall, XDR, or security tooling, follow standard operating procedures for containment and remediation.</div><div><br></div><div>These would commonly involve:</div><ul><li>Isolate and scan affected devices</li><li>Reimage/restore affected devices</li><li>Reset affected credentials</li><li>Revoke active sessions</li><li>Other actions as required</li></ul>"
            }
          }
        ]
      }
    }
  ],
  "outputs": {}
}