splunk
MS Defender Advanced Hunting
Overview
Details
This App can query MS Defender Advanced Hunting with their format.
Please feel freeeeee to contact me if you have any questions or requests.
Please feel freeeeee to contact me if you have any questions or requests.
Technical Add-on MS Defender Advanced Hunting
1. Overview
This App can query MS Defender Advanced Hunting with their query format (KQL) through Defender API.
There are two plans in Defender API and this app support both.
- Defender for Endpoint Plan 1
- Defender for Endpoint Plan 2
This plan is relevant when creating an app on Azure AD.
Please refer this for more detail about the plan.
2. Installation
- Create an App on Microsoft Azure AD with plan 1 or plan 2 following this. I recommend to use plan 2.
- Defender for Endpoint Plan 1
- Defender for Endpoint Plan 2
- Keep a note your Directory (Tenant) ID, Application (Client) ID and Client Secret of your Azure App.
- Go to Splunk setup page.
- Apps -> Manage App -> Set up
- Set Directory (Tenant) ID, Application (Client) ID, Client Secret and your plan version you got previous step.
3. Usage
- advhunt command
- Advanced Hunting Query
3.1 advhunt command
- Returns a list of query results that you set your Advanced Hunting query.
-
There are two following option.
- query: Required. Set your Advanced Hunting Query
- plan: Optional. If not set, this app use the value of setup page.
- Defender for Endpoint Plan 1: set v1
- Defender for Endpoint Plan 2: set v2
-
Example 1
- If you want to search the word contains
\, please use\\\\\\\or\\\x5cin SPL.
- If you want to search the word contains
| advhunt query="DeviceFileEvents
| where Timestamp > ago(1d)
| where FolderPath matches regex 'C:\\\x5cUsers' or FolderPath matches regex 'C:\\\\\\\Users'
| project Timestamp, DeviceId, DeviceName, ActionType, FolderPath, FileName"
| spath input=_raw - Example 2
- Use Defender for Endpoint Plan 2 explicitly.
| advhunt plan=v2 query="AlertInfo | Timestamp > ago(3d) | limit 2"
| spath input=_raw - Example 3
- Query an advanced hunting using the result of the previous SPL
| makeresults
| eval ActionType = "AntivirusReport,HogeReport"
| makemv delim="," ActionType
| mvexpand ActionType
| mvcombine ActionType
| eval query = "('" . mvjoin(ActionType, "', '") . "')"
| map search="| advhunt query=\"DeviceEvents | where ActionType has_any $query$ \" | spath input=_raw | table * "4. Note
-
To use this app, users need following privileges.
- list_storage_passwords
- admin_all_objects
-
If you use Plan 1, you can't query againt some schema.
- ex. AlertInfo, AlertEvidence
-
Quotas and resource allocation of API
5. Debug
- Please check the internal log.
index=_internal source="*advanced_hunting*" NOT "__init__"Release Notes
Version 0.0.5
June 8, 2022
Support Defender for Endpoint Plan 2