Question

我想使用Azure Log Analytics为用户帐户上可能发生的强行尝试创建监视警报。就是说，当用户帐户在多次尝试失败后成功通过O365身份验证后，我希望得到Azure的通知（或者至少能够手动运行脚本以获取数据）。

我知道如何解析日志，例如，获取在定义的时间内所有用户未成功登录的尝试次数（请参见以下示例）：

SigninLogs
| where TimeGenerated between(datetime("2018-11-19 00:00:00") .. datetime("2018-11-19 23:59:59")) 
| where ResultType == "50074"
| summarize FailedSigninCount = count() by UserDisplayName 
| sort by FailedSigninCount desc

但是我不知道如何编写以下内容：

用户创建了9次失败的登录尝试（类型50074），并且创建了成功的登录尝试。
在60秒内。

任何帮助都会感激不尽。

Answer 1

查看Azure Sentinel社区GitHub，看看那里的查询是否有帮助。具体来说，我添加了https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/SigninBruteForce-AzurePortal.txt，我认为您追求的目标或多或少-也在下面进行了补充。希望有帮助。

// Evidence of Azure Portal brute force attack in SigninLogs:
// This query returns results if there are more than 5 authentication failures and a successful authentication 
// within a 20-minute window.
let failureCountThreshold = 5;
let successCountThreshold = 1;
let timeRange = ago(1d);
let authenticationWindow = 20m;
SigninLogs
| where TimeGenerated >= timeRange 
| extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser
| extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)
| extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city)
| where AppDisplayName contains "Azure Portal"
// Split out failure versus non-failure types
| extend FailureOrSuccess = iff(ResultType in ("0", "50125", "50140"), "Success", "Failure")
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), 
makeset(IPAddress), makeset(OS), makeset(Browser), makeset(City), makeset(ResultType),
FailureCount=countif(FailureOrSuccess=="Failure"),
SuccessCount = countif(FailureOrSuccess=="Success") 
by bin(TimeGenerated, authenticationWindow), UserDisplayName, UserPrincipalName, AppDisplayName
| where FailureCount>=failureCountThreshold and SuccessCount>=successCountThreshold

Azure日志分析：重复登录失败后监视成功登录

1 个答案: