Deploys Microsoft Sentinel as cloud-native SIEM/SOAR for multi-cloud security ops. Configures AWS/Azure/GCP data connectors, KQL detection queries, Logic Apps playbooks, and PB-scale threat hunting.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 为多云环境建立集中式安全运营中心时
Deploys Microsoft Sentinel SIEM/SOAR for multi-cloud security ops: configures AWS/Azure/GCP data connectors, KQL detection queries, Logic Apps playbooks, petabyte-scale threat hunting.
Deploys Microsoft Sentinel as cloud-native SIEM/SOAR for multi-cloud security ops. Configures data connectors for AWS/Azure/GCP logs, KQL detection queries, Logic Apps playbooks, and petabyte-scale threat hunting.
Implements AWS CloudTrail log analysis with Athena queries, CloudWatch Logs Insights, and SIEM integration for security monitoring, threat detection, forensics, identifying unauthorized access, privilege escalation, and suspicious API activity.
Share bugs, ideas, or general feedback.
不适用于：AWS 独立环境（Security Hub 和 GuardDuty 已足够）、需要 EDR 能力的终端检测（使用 Defender for Endpoint），或合规态势监控（参见 building-cloud-security-posture-management）。
创建针对安全数据优化的 Log Analytics 工作区，并启用多云摄入的数据连接器。
# 创建 Log Analytics 工作区
az monitor log-analytics workspace create \
--resource-group security-rg \
--workspace-name sentinel-workspace \
--location eastus \
--retention-time 365 \
--sku PerGB2018
# 在工作区上启用 Microsoft Sentinel
az sentinel onboarding-state create \
--resource-group security-rg \
--workspace-name sentinel-workspace
# 启用 AWS CloudTrail 连接器
az sentinel data-connector create \
--resource-group security-rg \
--workspace-name sentinel-workspace \
--data-connector-id aws-cloudtrail \
--kind AmazonWebServicesCloudTrail \
--aws-cloud-trail-data-connector '{
"awsRoleArn": "arn:aws:iam::123456789012:role/SentinelCloudTrailRole",
"dataTypes": {"logs": {"state": "Enabled"}}
}'
# 启用 Azure AD 登录和审计日志
az sentinel data-connector create \
--resource-group security-rg \
--workspace-name sentinel-workspace \
--data-connector-id azure-ad \
--kind AzureActiveDirectory \
--azure-active-directory '{
"dataTypes": {
"alerts": {"state": "Enabled"},
"signinLogs": {"state": "Enabled"},
"auditLogs": {"state": "Enabled"}
}
}'
使用 Kusto Query Language 创建分析规则以检测云特定威胁。将每条规则映射到 MITRE ATT&CK 技术。
// 检测不可能的旅行 - 来自地理位置遥远处的登录
let timeframe = 1h;
let distance_threshold = 500; // 千米
SigninLogs
| where TimeGenerated > ago(timeframe)
| where ResultType == 0 // 仅成功登录
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
Latitude = toreal(LocationDetails.geoCoordinates.latitude),
Longitude = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),
PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiff < 60
| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) / 1000
| where Distance > distance_threshold
| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff
// 检测 CloudTrail 中的 AWS IAM 凭据滥用
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("ConsoleLogin", "AssumeRole", "GetSessionToken")
| where ErrorCode == ""
| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),
IPList = make_set(SourceIpAddress, 10)
by UserIdentityArn, bin(TimeGenerated, 1h)
| where DistinctIPs > 3
| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList
// 检测 S3 对象批量删除（潜在勒索软件）
AWSCloudTrail
| where TimeGenerated > ago(1h)
| where EventName == "DeleteObject" or EventName == "DeleteObjects"
| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)
by UserIdentityArn, bin(TimeGenerated, 10m)
| where DeleteCount > 100
| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected
创建当分析规则触发事件时执行的自动化响应手册。常见操作包括封锁用户、隔离资源和用威胁情报丰富告警。
{
"definition": {
"triggers": {
"Microsoft_Sentinel_incident": {
"type": "ApiConnectionWebhook",
"inputs": {
"body": {"incidentArmId": "subscriptions/@{triggerBody()?['workspaceInfo']?['SubscriptionId']}/resourceGroups/@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}/providers/Microsoft.OperationalInsights/workspaces/@{triggerBody()?['workspaceInfo']?['WorkspaceName']}/providers/Microsoft.SecurityInsights/Incidents/@{triggerBody()?['object']?['properties']?['incidentNumber']}"},
"host": {"connection": {"name": "@parameters('$connections')['microsoftsentinel']['connectionId']"}}
}
}
},
"actions": {
"Get_incident_entities": {
"type": "ApiConnection",
"inputs": {"method": "post", "path": "/Incidents/entities"}
},
"For_each_account_entity": {
"type": "Foreach",
"foreach": "@body('Get_incident_entities')?['Accounts']",
"actions": {
"Disable_Azure_AD_user": {
"type": "ApiConnection",
"inputs": {
"method": "PATCH",
"path": "/v1.0/users/@{items('For_each_account_entity')?['AadUserId']}",
"body": {"accountEnabled": false}
}
},
"Add_comment_to_incident": {
"type": "ApiConnection",
"inputs": {
"body": {"message": "用户 @{items('For_each_account_entity')?['Name']} 已由自动化手册禁用"}
}
}
}
}
}
}
}
启用 Sentinel 数据湖以实现 PB 级日志保留，并使用 KQL 和 SQL 端点进行高级威胁狩猎。
// 威胁狩猎查询：检测跨 AWS 账户的横向移动
let suspicious_roles = AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName == "AssumeRole"
| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)
| where AssumedRoleArn contains "cross-account" or AssumedRoleArn contains "admin"
| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)
by UserIdentityArn, AssumedRoleArn
| where AssumeCount > 10 and UniqueSourceAccounts > 2;
suspicious_roles
| join kind=inner (
AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName in ("RunInstances", "CreateFunction", "PutBucketPolicy")
) on UserIdentityArn
| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress
连接威胁情报提供商，创建基于指标的匹配规则，检测与已知恶意基础设施的通信。
# 启用 Microsoft 威胁情报连接器
az sentinel data-connector create \
--resource-group security-rg \
--workspace-name sentinel-workspace \
--data-connector-id microsoft-ti \
--kind MicrosoftThreatIntelligence \
--microsoft-threat-intelligence '{
"dataTypes": {"microsoftEmergingThreatFeed": {"lookbackPeriod": "2025-01-01T00:00:00Z", "state": "Enabled"}}
}'
// 将网络指标与云流日志匹配
let TI_IPs = ThreatIntelligenceIndicator
| where TimeGenerated > ago(30d)
| where isnotempty(NetworkIP)
| distinct NetworkIP;
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestIP_s in (TI_IPs)
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s
| 术语 | 定义 |
|---|---|
| KQL | Kusto Query Language，Microsoft Sentinel 的主要查询语言，用于搜索、分析和可视化安全数据 |
| 分析规则（Analytics Rule） | Sentinel 中的检测逻辑，按计划评估日志数据，当条件匹配时创建事件 |
| SOAR 手册（SOAR Playbook） | 由事件触发的自动化工作流，执行响应操作，如封锁账户、丰富告警或通知团队 |
| 数据连接器（Data Connector） | 将来自云服务、身份提供商和第三方工具的安全日志摄入 Sentinel 的集成模块 |
| Sentinel 数据湖（Sentinel Data Lake） | PB 级存储层，提供长期日志保留，具有 KQL 和 SQL 查询接口用于高级狩猎 |
| 工作簿（Workbook） | Sentinel 中的交互式仪表板，显示安全数据、趋势和运营指标的可视化 |
| 监视列表（Watchlist） | Sentinel 中的参考数据表，用于通过 VIP 用户列表或已批准 IP 范围等上下文丰富告警 |
| Fusion 检测（Fusion Detection） | 机器学习驱动的关联引擎，自动检测跨数据源的多阶段攻击 |
场景背景：攻击者通过钓鱼入侵 Azure AD 账户，然后使用该账户通过联合身份访问 AWS 资源。Sentinel 需要将 Azure 登录异常与异常 AWS API 活动相关联。
方法：
常见陷阱：不跨云提供商关联身份会遗漏完整的攻击链。将分析规则频率设置太低（如 24 小时）会给攻击者留下数小时的未检测访问时间。
Microsoft Sentinel SOC 运营报告
==========================================
工作区: sentinel-workspace
数据源: 14 个连接器活跃
报告周期: 2025-02-01 至 2025-02-23
数据摄入:
Azure AD 登录日志: 2.3 TB（23 天）
AWS CloudTrail: 1.8 TB（23 天）
Azure Activity: 0.9 TB（23 天）
Defender for Cloud 告警: 45 GB（23 天）
总摄入量: 5.1 TB
检测摘要:
活跃分析规则: 87 条
创建事件: 234 个
严重: 8 | 高: 34 | 中: 89 | 低: 103
平均检测时间（MTTD）: 4.2 分钟
平均响应时间（MTTR）: 18 分钟
主要事件类型:
检测到不可能旅行: 42 个事件
AWS 未授权 API 调用模式: 28 个事件
S3 批量文件删除: 3 个事件
可疑 Azure AD 应用注册: 12 个事件
自动化:
执行手册: 156 次
自动禁用账户: 23 个
自动丰富事件: 198 个
误报率: 12%