Learning Path 8 - Lab 1 - Exercise 2 - Create a Scheduled Query from a template

Lab scenario

You’re a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to detect and mitigate threats using Microsoft Sentinel. After connecting your data sources to Microsoft Sentinel, you create custom analytics rules to help discover threats and anomalous behaviors in your environment.

Analytics rules search for specific events or sets of events across your environment, alert you when certain event thresholds or conditions are reached, generate incidents for your SOC to triage and investigate, and respond to threats with automated tracking and reMediation processes.

Important: The lab exercises for Learning Path #8 are in a standalone environment. If you exit the lab before completing it, you will be required to re-run the configurations again.

Estimated time to complete this lab: 45 minutes

Note: Microsoft Sentinel has been predeployed in your Azure subscription with the name sentinelworkspace-01, and the Azure Activity solution and data connector have been installed and connected.

Task 1: Create a Scheduled Query rule

In this task, you create a Microsoft Sentinel analytics scheduled query rule.

Log in to WIN1 virtual machine as Admin with the password: Pa55w.rd.
Open the Microsoft Edge browser.
In the Edge browser, navigate to Defender XDR at https://security.microsoft.com.
In the Sign in dialog box, copy, and paste in the Tenant Email account provided by your lab hosting provider and then select Next.
In the Enter password dialog box, copy, and paste in the Tenant Password provided by your lab hosting provider and then select Sign in.

Note: You may be prompted to enter the Temporary Access Pass (TAP) instead of a password. This is also provided in the resources tab. If prompted, copy and paste the TAP value and select Sign in.
In the Microsoft Defender navigation menu, scroll down and expand the Microsoft Sentinel section.
Expand the Configuration section and select Analytics.
Make sure that you are in the Rule templates tab in the command bar and search for the New CloudShell User rule.
From the rule summary blade, make sure you’re receiving data by reviewing the green icon under Data sources: Azure Activity.

Note: If you do not see it in a connected state, and you ran the Prerequisite task above, you may need to wait longer for the process to complete.
Select Create rule to continue.
In the Analytics rule wizard, on the General tab, change the Severity to Medium.
Select Next: Set rule logic > button:
For the rule query, select View query results. You shouldn’t receive any results nor any errors.
Close the Logs window by selecting the upper right X and select OK to discard to save changes to go back to the wizard.

Scroll down and under Query scheduling set the following:

Setting	Value
Run Query every	5 minutes
Lookup data from the last	1 Days

Note: We are purposely generating many incidents for the same data. This enables the Lab to use these alerts.

Under the Alert threshold area, leave the value unchanged since we want the alert to register every event.
Under the Event grouping area, leave the Group all events into a single alert as the selected option since we want to generate a single alert every time it runs, as long as the query returns more results than the specified alert threshold above.
Select the Next: Incident settings > button.
On the Incident settings tab, review the default options.
Select the Next: Automated response > button.
Select the Next: Review and create > button.
Select Save.

Task 2: Edit your new rule

In the Microsoft Defender navigation menu, scroll down and expand the Microsoft Sentinel section.
Expand the Configuration section and select Analytics.
Make sure that you are in the Active rules tab in the command bar and select the New CloudShell User rule.
Right click the rule and select Edit from the pop-up menu.
Select the Next: Set rule logic > button.
Select the Next: Incident settings > button.
Select the Next: Automated response > button.
On the Automated response tab under Automation rules, select + Add new.
For the Automation rule name, enter Tier 2.
For the Actions, select Assign owner.
Then select Assign to me.
Select Apply
Select the Next: Review and create > button.
Select Save.

Task 3: Test your new rule

In this task, you test your new scheduled query rule. You start by enabling Cloud Shell in the Azure portal, which will trigger the rule you created in the previous task and generate an incident.