Скачать или смотреть Automated IR with the Power of Kusto - Bert-Jan Pals

Bert-Jan Pals (Defensive Security Expert) presents a practical KustoCon session focused on using Kusto Query Language (KQL) and related tools to automate and scale Incident Response (IR) activities across the Microsoft Defender XDR and Microsoft Sentinel platforms.

The talk addresses the need for faster time to contain and a more standardized investigation approach by shifting from manual actions to automation. Key topics include leveraging the Advanced Hunting tab for bulk response actions and configuring Custom Detection Rules for high-fidelity auto-remediation, using an example of detecting a Sliver C2 beacon and automating device isolation.

Bert-Jan also demonstrates how Workbooks can be used to standardize analyst triage, provide critical context (like linking an Anonymous IP sign-in to a subsequent MFA registration), and introduces his open-source triage and response tool, KustoHawk. KustoHawk unifies XDR and Sentinel data using the Graph API to run predefined KQL queries based on a Device ID or User Principal Name (UPN) and generate comprehensive reports for effective triage.

🌟 Key Topics & Timestamps
00:00 - Introduction, Welcome, and Presenter Introductions
01:26 - Agenda: Why Automate, Response Actions, Custom Detection Rules, Workbooks, Logic Apps, APIs, and KustoHawk.
03:21 - Key Challenges in IR: Time to Contain, Lack of Standardization, and Manual Actions.
04:31 - Overview of Supported Response Actions (Device, File, User, Email).
05:33 - Scaling Response Actions from the Advanced Hunting Tab.
08:36 - The Importance of Entity Mapping for Automation.
09:29 - Leveraging Custom Detection Rules for Auto-Remediation and Auto-IR.
11:31 - Example: Detecting a Sliver C2 Beacon and setting up automated isolation.
17:15 - Using Workbooks to Standardize Investigations and Provide Context.
19:35 - Demo: Cloud Investigation Workbook for user triage.
25:37 - Overview of API Support for KQL (Azure Monitor, Graph API, Defender API).
28:35 - Introduction and Demo of KustoHawk: Triage & Response Tool.
40:48 - Discussion: KustoHawk vs. Workbooks/Logic Apps (Unifying XDR/Sentinel Data).