- \n
- 150: Health<\/li>\n
- 470: Unknown (no extension\/Defender)<\/li>\n
- 350: Quarantined malware<\/li>\n
- 550: Active malware<\/li>\n<\/ul>\n<\/li>\n
- ThreatStatus<\/strong>: A description for the above code<\/li>\n
- ThreatStatusDetails<\/strong>: A longer description<\/li>\n
- And more …<\/li>\n<\/ul>\n
So you can see that you can search this table for malware infection records. First thing, though, is to filter out the machines\/records reporting that there is no Defender (Linux machines, for example):<\/p>\n
let all_windows_vms =\r\nHeartbeat\r\n| where TimeGenerated > now(-7d)\r\n| where OSType == 'Windows'\r\n| summarize makeset(Resource);\r\nProtectionStatus\r\n| where Resource in (all_windows_vms)\r\n| sort by TimeGenerated desc<\/pre>\n
The above will find all active Windows VMs that have been reporting to Log Analytics via the extension heartbeat. Then we’ll store that data in a set, and search that set. Now we can extend that search, for example finding all machines with a non-healthy state (150):<\/p>\n
let all_windows_vms = Heartbeat\r\n| where TimeGenerated > now(-7d)\r\n| where OSType == 'Windows'\r\n| summarize makeset(Resource);\r\nProtectionStatus\r\n| where Resource in (all_windows_vms)\r\n| where ThreatStatusRank <> 150\r\n| sort by TimeGenerated desc<\/pre>\n
Testing<\/h2>\n
All the tech content here will be useless without data. So you’ll need some data! Search for the Eicar test string\/file and start “infecting” machines – be sure to let people know if there are people monitoring the environment first.<\/p>\n
Security Center<\/h2>\n
Security Center will record incidents for you:<\/p>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2020\/10\/SecurityCenterIncidents.png\")
<\/a><\/p>\nYou will get email alerts if you have configured notifications in the subscription’s Security Center settings. Make sure the threshold is set to LOW.<\/p>\n
If you want an alternative form of alert then you can use a Log Analytics alert (Scheduled Query Alert resource type) based on the below basic query:<\/p>\n
SecurityAlert \r\n| where TimeGenerated > now(-5m)\r\n| where VendorName == 'Microsoft Antimalware'<\/pre>\n
The above query will search for Windows Defender alerts stored in Log Analytics (by Security Center) in the last 5 minutes. If the threshold is freater than 0 then you can trigger an Azure Monitor Action Group to tell whomever or start whatever task you want.<\/p>\n
Workbooks<\/h2>\n
Armed with the ability to query the ProtectionStatus table, you can create your own visualisations for easy reporting on Windows Defender across many machines.<\/p>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2020\/10\/WindowsDefenderWorkbook.png\")
<\/a><\/p>\n<\/p>\n
The pie chart is made using this query:<\/p>\n
let all_windows_vms =\r\nHeartbeat\r\n| where TimeGenerated > now(-7d)\r\n| where OSType == 'Windows'\r\n| summarize makeset(Resource);\r\nProtectionStatus\r\n| where TimeGenerated > now(-7d)\r\n| where Resource in (all_windows_vms)\r\n| where ThreatStatusRank <> '150'\r\n| summarize count(Threat) by Threat<\/pre>\n
With some reading and practice, you can make a really fancy workbook.<\/p>\n
Azure Sentinel<\/h2>\n
I have enabled the Entity Behavior preview.<\/em><\/p>\n
Azure Sentinel is supposed to be the central place to monitor all security events, hunt for issues, and where to start investigations – that latter thanks to the new Entity Behavior feature. Azure Sentinel is powered by Log Analytics – if you have data in there then you can query that data, correlate it, and do some clever things.<\/p>\n
We have a query that can search for malware incidents reported by Windows Defender. What we will do is create a new Analytic Rule that will run every 5 minutes using 5 minutes of data. If the results exceed 0 (threshold greater than 0) then we will create an incident.<\/p>\n
let all_windows_vms =\r\nHeartbeat\r\n| where TimeGenerated > now(-7d)\r\n| where OSType == 'Windows'\r\n| summarize makeset(Resource);\r\nProtectionStatus\r\n| where TimeGenerated > now(-5m)\r\n| where Resource in (all_windows_vms)\r\n| where ThreatStatus <> 'No threats detected' or ThreatStatusRank <> '150' or Threat <> ''\r\n| sort by Resource asc\r\n| extend HostCustomEntity = Computer<\/pre>\n
The last line is used to identity an entity. Optionally, we can associate a logic app for an automated response. Once that first malware detection is found:<\/p>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2020\/10\/AzureSentinelWindowsDefenderIncidents.png\")
<\/a><\/p>\nYou can do the usual operational stuff with these incidents. Note that this data is recorded and your effectiveness as a security organisation is visible in the Security Efficiency Workbook in Azure Sentinel – even the watchers are watched! If you open an incident you can click investigate which opens a new Investigation screen that leverages the Entity Behavior data. In my case, the computer is the entity.<\/p>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2020\/10\/AzureSentinelWindowsDefenderIncidentInvestigation.png\")
<\/a><\/p>\nThe break-out dialogs allow me to query Log Analytics to learn more about the machine and its state at the time and the state of Windows Defender. For example, I can see who was logged into the machine at that time and what processes were running. Pretty nice, eh?<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
In this post, I will explain how one can monitor Windows Defender and create incidents for it with Azure VMs. Background Windows Defender is built into Windows Server 2016 and Windows Server 2019. It’s free and pretty decent. But it surprises me how many of my customers (all) choose Defender over third-parties for their Azure … Continue reading “Monitoring & Alerting for Windows Defender in Azure VMs”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":21619,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[466,170,426,346,465,467,423,259,464],"class_list":["post-22240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-analytic-rules","tag-azure","tag-azure-monitor-logs","tag-azure-security-center","tag-azure-sentinel","tag-entity-behavior","tag-log-analytics","tag-windows-defender","tag-workbooks"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
- ThreatStatusDetails<\/strong>: A longer description<\/li>\n