building-cloud-siem-with-sentinel

使用 Sentinel 构建云 SIEM

何时使用

• 当为多云环境建立集中式安全运营中心时
• 当从传统 SIEM 平台（Splunk、QRadar）迁移到云原生架构时
• 当为云特有威胁构建自动化事件响应工作流时
• 当跨数 PB 级安全遥测数据执行大规模威胁狩猎时
• 当将威胁情报源与云安全日志分析集成时

请勿使用 于仅使用 AWS 且 Security Hub 和 GuardDuty 已足够的场景，需要 EDR 能力的端点检测场景（请使用 Defender for Endpoint），或合规态势监控场景（参见 building-cloud-security-posture-management）。

先决条件

• 在 Log Analytics 工作区上启用了 Microsoft Sentinel 的 Azure 订阅
• 针对目标日志源（AWS CloudTrail、Azure Activity、GCP）的数据连接器权限
• 用于自动化响应剧本的 Logic Apps 或 Azure Functions
• 编写检测规则和狩猎查询所需的 KQL（Kusto 查询语言）熟练度

工作流

步骤 1：预配 Sentinel 工作区和数据连接器

创建针对安全数据优化的 Log Analytics 工作区，并为多云摄取启用数据连接器。

# Create Log Analytics workspace
az monitor log-analytics workspace create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --location eastus \
  --retention-time 365 \
  --sku PerGB2018

# Enable Microsoft Sentinel on the workspace
az sentinel onboarding-state create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace

# Enable AWS CloudTrail connector
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id aws-cloudtrail \
  --kind AmazonWebServicesCloudTrail \
  --aws-cloud-trail-data-connector '{
    "awsRoleArn": "arn:aws:iam::123456789012:role/SentinelCloudTrailRole",
    "dataTypes": {"logs": {"state": "Enabled"}}
  }'

# Enable Azure AD sign-in and audit logs
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id azure-ad \
  --kind AzureActiveDirectory \
  --azure-active-directory '{
    "dataTypes": {
      "alerts": {"state": "Enabled"},
      "signinLogs": {"state": "Enabled"},
      "auditLogs": {"state": "Enabled"}
    }
  }'

步骤 2：编写 KQL 检测规则

使用 Kusto 查询语言创建分析规则，以检测云特有威胁。将每条规则映射到 MITRE ATT&CK 技术。

// Detect impossible travel - sign-ins from geographically distant locations
let timeframe = 1h;
let distance_threshold = 500; // km
SigninLogs
| where TimeGenerated > ago(timeframe)
| where ResultType == 0 // Successful sign-ins only
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
          Latitude = toreal(LocationDetails.geoCoordinates.latitude),
          Longitude = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),
         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiff < 60
| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) / 1000
| where Distance > distance_threshold
| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff

// Detect AWS IAM credential abuse from CloudTrail
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("ConsoleLogin", "AssumeRole", "GetSessionToken")
| where ErrorCode == ""
| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),
            IPList = make_set(SourceIpAddress, 10)
            by UserIdentityArn, bin(TimeGenerated, 1h)
| where DistinctIPs > 3
| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList

// Detect mass S3 object deletion (potential ransomware)
AWSCloudTrail
| where TimeGenerated > ago(1h)
| where EventName == "DeleteObject" or EventName == "DeleteObjects"
| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)
            by UserIdentityArn, bin(TimeGenerated, 10m)
| where DeleteCount > 100
| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected

步骤 3：使用 Logic Apps 构建 SOAR 剧本

创建在分析规则触发事件时执行的自动化响应剧本。常见操作包括阻止用户、隔离资源以及使用威胁情报丰富警报。

{
  "definition": {
    "triggers": {
      "Microsoft_Sentinel_incident": {
        "type": "ApiConnectionWebhook",
        "inputs": {
          "body": {"incidentArmId": "subscriptions/@{triggerBody()?['workspaceInfo']?['SubscriptionId']}/resourceGroups/@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}/providers/Microsoft.OperationalInsights/workspaces/@{triggerBody()?['workspaceInfo']?['WorkspaceName']}/providers/Microsoft.SecurityInsights/Incidents/@{triggerBody()?['object']?['properties']?['incidentNumber']}"},
          "host": {"connection": {"name": "@parameters('$connections')['microsoftsentinel']['connectionId']"}}
        }
      }
    },
    "actions": {
      "Get_incident_entities": {
        "type": "ApiConnection",
        "inputs": {"method": "post", "path": "/Incidents/entities"}
      },
      "For_each_account_entity": {
        "type": "Foreach",
        "foreach": "@body('Get_incident_entities')?['Accounts']",
        "actions": {
          "Disable_Azure_AD_user": {
            "type": "ApiConnection",
            "inputs": {
              "method": "PATCH",
              "path": "/v1.0/users/@{items('For_each_account_entity')?['AadUserId']}",
              "body": {"accountEnabled": false}
            }
          },
          "Add_comment_to_incident": {
            "type": "ApiConnection",
            "inputs": {
              "body": {"message": "User @{items('For_each_account_entity')?['Name']} disabled by automated playbook"}
            }
          }
        }
      }
    }
  }
}

步骤 4：配置 Sentinel 数据湖以进行长期狩猎

启用 Sentinel 数据湖，以实现 PB 级日志保留，并使用 KQL 和 SQL 端点进行高级威胁狩猎。

// Threat hunting query: detect lateral movement across AWS accounts
let suspicious_roles = AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName == "AssumeRole"
| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)
| where AssumedRoleArn contains "cross-account" or AssumedRoleArn contains "admin"
| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)
            by UserIdentityArn, AssumedRoleArn
| where AssumeCount > 10 and UniqueSourceAccounts > 2;
suspicious_roles
| join kind=inner (
    AWSCloudTrail
    | where TimeGenerated > ago(7d)
    | where EventName in ("RunInstances", "CreateFunction", "PutBucketPolicy")
) on UserIdentityArn
| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress

步骤 5：集成威胁情报

连接威胁情报提供商，并创建基于指标的匹配规则，以检测与已知恶意基础设施的通信。

# Enable Microsoft Threat Intelligence connector
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id microsoft-ti \
  --kind MicrosoftThreatIntelligence \
  --microsoft-threat-intelligence '{
    "dataTypes": {"microsoftEmergingThreatFeed": {"lookbackPeriod": "2025-01-01T00:00:00Z", "state": "Enabled"}}
  }'

// Match network indicators against cloud flow logs
let TI_IPs = ThreatIntelligenceIndicator
| where TimeGenerated > ago(30d)
| where isnotempty(NetworkIP)
| distinct NetworkIP;
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestIP_s in (TI_IPs)
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s

关键概念

术语	定义
KQL	Kusto 查询语言，Microsoft Sentinel 的主要查询语言，用于搜索、分析和可视化安全数据
分析规则	Sentinel 中的检测逻辑，按计划评估日志数据，并在条件匹配时创建事件
SOAR 剧本	由事件触发的自动化工作流，执行响应操作，例如阻止账户、丰富警报或通知团队
数据连接器	将来自云服务、身份提供商和第三方工具的安全日志摄取到 Sentinel 的集成模块
Sentinel 数据湖	PB 级存储层，提供长期日志保留，并具备 KQL 和 SQL 查询接口以进行高级狩猎
工作簿	Sentinel 中的交互式仪表板，显示安全数据、趋势和运营指标的可视化
监视列表	Sentinel 中的参考数据表，用于使用 VIP 用户列表或已批准 IP 范围等上下文丰富警报
融合检测	由机器学习驱动的关联引擎，可跨数据源自动检测多阶段攻击

工具与系统

• Microsoft Sentinel：基于 Azure Log Analytics 构建的云原生 SIEM/SOAR 平台，具备 AI 驱动的威胁检测
• Azure Logic Apps：低代码自动化平台，用于构建由 Sentinel 事件触发的 SOAR 剧本
• Microsoft Threat Intelligence：集成威胁源，提供 IP、域和 URL 指标，用于与安全日志进行匹配
• Azure Data Explorer：高性能分析引擎，为 Sentinel KQL 查询的大规模数据探索提供基础
• MITRE ATT&CK Navigator：用于将 Sentinel 检测规则映射到对手战术和技术的框架

常见场景

场景：检测跨云凭证窃取活动

背景：攻击者通过网络钓鱼入侵了一个 Azure AD 账户，然后利用该账户通过联合身份访问 AWS 资源。Sentinel 需要将 Azure 登录异常与异常的 AWS API 活动关联起来。

方法：

1. 创建一条分析规则，检测 Azure AD 不可能旅行或异常登录风险
2. 编写一个 KQL 查询，将被入侵的 Azure AD 身份与 AWS CloudTrail AssumeRoleWithSAML 事件关联起来
3. 构建一条 Fusion 检测规则，将 Azure AD 风险事件与后续的 AWS 权限提升活动关联起来
4. 部署一个 SOAR playbook，自动禁用 Azure AD 账户并撤销 AWS STS 会话
5. 创建一个工作簿，展示从初始入侵到横向移动到 AWS 的时间线
6. 在数据湖中运行一个搜寻查询，检查影响其他账户的类似模式

陷阱：不跨云提供商关联身份会遗漏完整的攻击链。将分析规则频率设置得太低（例如 24 小时）会让攻击者获得数小时的未被检测访问。

输出格式

Microsoft Sentinel SOC Operations Report
==========================================
Workspace: sentinel-workspace
Data Sources: 14 connectors active
Report Period: 2025-02-01 to 2025-02-23

DATA INGESTION:
  Azure AD Sign-in Logs:     2.3 TB (23 days)
  AWS CloudTrail:            1.8 TB (23 days)
  Azure Activity:            0.9 TB (23 days)
  Defender for Cloud Alerts: 45 GB (23 days)
  Total Ingestion:           5.1 TB

DETECTION SUMMARY:
  Active Analytics Rules: 87
  Incidents Created: 234
    Critical: 8 | High: 34 | Medium: 89 | Low: 103
  Mean Time to Detect (MTTD): 4.2 minutes
  Mean Time to Respond (MTTR): 18 minutes

TOP INCIDENT TYPES:
  Impossible Travel Detected:          42 incidents
  AWS Unauthorized API Call Pattern:   28 incidents
  Mass File Deletion in S3:            3 incidents
  Suspicious Azure AD App Registration: 12 incidents

AUTOMATION:
  Playbooks Executed: 156
  Accounts Auto-Disabled: 23
  Incidents Auto-Enriched: 198
  False Positive Rate: 12%