Communitygithub.com

使用 Sentinel 构建云 SIEM

通过配置多云数据连接器（AWS、Azure、GCP）、编写 KQL 检测和搜寻查询以及构建自动化 Logic Apps 响应剧本，将 Microsoft Sentinel 部署为云原生 SIEM/SOAR。适用于建立多云环境的集中式安全运营中心、从传统 SIEM 迁移或执行 PB 级威胁搜寻；不适用于仅限 AWS 的场景（Security Hub/GuardDuty 已足够）或端点 EDR 需求。

使用 Sentinel 构建云 SIEM 是什么？

该技能详细指导用户如何使用 Microsoft Sentinel 构建一个云原生安全信息和事件管理（SIEM）及安全编排自动化响应（SOAR）平台。它专注于多云环境，覆盖从初始工作区配置、数据连接器部署，到使用 Kusto 查询语言（KQL）编写高级检测规则，以及在 Azure Logic Apps 中构建自动化响应剧本的完整设置流程。主要优势包括通过统一的界面集中处理来自 AWS、Azure 和 GCP 的安全日志，从而消除孤岛，以及支持大规模（PB 级）威胁搜寻和与 Microsoft 威胁情报的无缝集成。该技能基于 Azure CLI 命令和 KQL 脚本提供了逐步指导，并包含了在检测到可疑活动（如异地登录或批量 S3 删除）时自动禁用 Azure AD 用户的真实 SOAR 工作流。它强调了跨云关联身份的重要性，并提供了常见陷阱——例如未能关联不同云提供商的用户活动（这可能会遗漏完整的攻击链）。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-cloud-siem-with-sentinel
查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

使用 Sentinel 构建云 SIEM 是做什么的？

何时使用

  • 当为多云环境建立集中式安全运营中心时
  • 当从传统 SIEM 平台（Splunk、QRadar）迁移到云原生架构时
  • 当为云特定威胁构建自动化事件响应工作流时
  • 当跨 PB 级安全遥测数据执行大规模威胁搜寻时
  • 当将威胁情报源与云安全日志分析集成时

请勿使用于仅限 AWS 的环境（Security Hub 和 GuardDuty 已足够）、需要 EDR 功能的端点检测（使用 Defender for Endpoint）或合规性态势监控（请参阅 building-cloud-security-posture-management）。

前提条件

  • 具有在 Log Analytics 工作区上启用 Microsoft Sentinel 的 Azure 订阅
  • 目标日志源的数据连接器权限（AWS CloudTrail、Azure Activity、GCP）
  • 用于自动化响应剧本的 Logic Apps 或 Azure Functions
  • 具备编写检测规则和搜寻查询所需的 KQL（Kusto 查询语言）能力

工作流

步骤 1：预配 Sentinel 工作区和数据连接器

创建一个针对安全数据优化的 Log Analytics 工作区，并启用用于多云数据引入的数据连接器。

# 创建 Log Analytics 工作区
az monitor log-analytics workspace create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --location eastus \
  --retention-time 365 \
  --sku PerGB2018

# 在工作区上启用 Microsoft Sentinel
az sentinel onboarding-state create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace

# 启用 AWS CloudTrail 连接器
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id aws-cloudtrail \
  --kind AmazonWebServicesCloudTrail \
  --aws-cloud-trail-data-connector '{
    "awsRoleArn": "arn:aws:iam::123456789012:role/SentinelCloudTrailRole",
    "dataTypes": {"logs": {"state": "Enabled"}}
  }'

# 启用 Azure AD 登录和审核日志
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id azure-ad \
  --kind AzureActiveDirectory \
  --azure-active-directory '{
    "dataTypes": {
      "alerts": {"state": "Enabled"},
      "signinLogs": {"state": "Enabled"},
      "auditLogs": {"state": "Enabled"}
    }
  }'

步骤 2：编写 KQL 检测规则

使用 Kusto 查询语言创建分析规则以检测特定于云的威胁。将每个规则映射到 MITRE ATT&CK 技术。

// 检测不可能旅行 - 从地理距离遥远的位置登录
let timeframe = 1h;
let distance_threshold = 500; // km
SigninLogs
| where TimeGenerated > ago(timeframe)
| where ResultType == 0 // 仅成功登录
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
          Latitude = toreal(LocationDetails.geoCoordinates.latitude),
          Longitude = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),
         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiff < 60
| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) / 1000
| where Distance > distance_threshold
| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff

// 从 CloudTrail 检测 AWS IAM 凭证滥用
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("ConsoleLogin", "AssumeRole", "GetSessionToken")
| where ErrorCode == ""
| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),
            IPList = make_set(SourceIpAddress, 10)
            by UserIdentityArn, bin(TimeGenerated, 1h)
| where DistinctIPs > 3
| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList

// 检测大规模 S3 对象删除（潜在的勒索软件）
AWSCloudTrail
| where TimeGenerated > ago(1h)
| where EventName == "DeleteObject" or EventName == "DeleteObjects"
| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)
            by UserIdentityArn, bin(TimeGenerated, 10m)
| where DeleteCount > 100
| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected

步骤 3：使用 Logic Apps 构建 SOAR 剧本

创建自动化响应剧本，当分析规则触发事件时执行。常见操作包括阻止用户、隔离资源和用威胁情报丰富警报。

{
  "definition": {
    "triggers": {
      "Microsoft_Sentinel_incident": {
        "type": "ApiConnectionWebhook",
        "inputs": {
          "body": {"incidentArmId": "subscriptions/@{triggerBody()?['workspaceInfo']?['SubscriptionId']}/resourceGroups/@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}/providers/Microsoft.OperationalInsights/workspaces/@{triggerBody()?['workspaceInfo']?['WorkspaceName']}/providers/Microsoft.SecurityInsights/Incidents/@{triggerBody()?['object']?['properties']?['incidentNumber']}"},
          "host": {"connection": {"name": "@parameters('$connections')['microsoftsentinel']['connectionId']"}}
        }
      }
    },
    "actions": {
      "Get_incident_entities": {
        "type": "ApiConnection",
        "inputs": {"method": "post", "path": "/Incidents/entities"}
      },
      "For_each_account_entity": {
        "type": "Foreach",
        "foreach": "@body('Get_incident_entities')?['Accounts']",
        "actions": {
          "Disable_Azure_AD_user": {
            "type": "ApiConnection",
            "inputs": {
              "method": "PATCH",
              "path": "/v1.0/users/@{items('For_each_account_entity')?['AadUserId']}",
              "body": {"accountEnabled": false}
            }
          },
          "Add_comment_to_incident": {
            "type": "ApiConnection",
            "inputs": {
              "body": {"message": "用户 @{items('For_each_account_entity')?['Name']} 已被自动化剧本禁用"}
            }
          }
        }
      }
    }
  }
}

步骤 4：配置 Sentinel 数据湖以进行长期搜寻

启用 Sentinel 数据湖以实现 PB 级日志保留，并使用 KQL 和 SQL 端点进行高级威胁搜寻。

// 威胁搜寻查询：检测跨 AWS 账户的横向移动
let suspicious_roles = AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName == "AssumeRole"
| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)
| where AssumedRoleArn contains "cross-account" or AssumedRoleArn contains "admin"
| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)
            by UserIdentityArn, AssumedRoleArn
| where AssumeCount > 10 and UniqueSourceAccounts > 2;
suspicious_roles
| join kind=inner (
    AWSCloudTrail
    | where TimeGenerated > ago(7d)
    | where EventName in ("RunInstances", "CreateFunction", "PutBucketPolicy")
) on UserIdentityArn
| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress

步骤 5：集成威胁情报

连接威胁情报提供商并创建基于指标匹配的规则，以检测与已知恶意基础设施的通信。

# 启用 Microsoft 威胁情报连接器
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id microsoft-ti \
  --kind MicrosoftThreatIntelligence \
  --microsoft-threat-intelligence '{
    "dataTypes": {"microsoftEmergingThreatFeed": {"lookbackPeriod": "2025-01-01T00:00:00Z", "state": "Enabled"}}
  }'

// 将网络指标与云流日志进行匹配
let TI_IPs = ThreatIntelligenceIndicator
| where TimeGenerated > ago(30d)
| where isnotempty(NetworkIP)
| distinct NetworkIP;
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestIP_s in (TI_IPs)
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s

关键概念

术语定义
KQLKusto 查询语言，Microsoft Sentinel 的主要查询语言，用于搜索、分析和可视化安全数据
分析规则Sentinel 中的检测逻辑，它按计划评估日志数据，并在条件匹配时创建事件
SOAR 剧本由事件触发的自动化工作流，用于执行响应操作，如阻止账户、丰富警报或通知团队
数据连接器将安全日志从云服务、身份提供商和第三方工具引入 Sentinel 的集成模块
Sentinel 数据湖PB 级存储层，提供长期日志保留，具有 KQL 和 SQL 查询接口，用于高级搜寻
工作簿Sentinel 中的交互式仪表板，显示安全数据、趋势和运营指标的视图
监视列表Sentinel 中的参考数据表，用于为警报添加上下文，如 VIP 用户列表或批准的 IP 范围
Fusion 检测机器学习驱动的关联引擎，可自动检测跨数据源的多阶段攻击

工具与系统

  • Microsoft Sentinel：基于 Azure Log Analytics 构建的云原生 SIEM/SOAR 平台，具有 AI 驱动的威胁检测功能
  • Azure Logic Apps：低代码自动化平台，用于构建由 Sentinel 事件触发的 SOAR 剧本
  • Microsoft 威胁情报：集成威胁源，提供 IP、域和 URL 指标，用于与安全日志进行匹配
  • Azure Data Explorer：高性能分析引擎，为 Sentinel KQL 查询提供支持，用于大规模数据探索
  • MITRE ATT&CK Navigator：用于将 Sentinel 检测规则映射到对手战术和技术的框架

常见场景

场景：检测跨云凭据窃取活动

上下文：攻击者通过网络钓鱼攻陷一个 Azure AD 账户，然后通过联合身份使用该账户访问 AWS 资源。Sentinel 需要将 Azure 登录异常与异常的 AWS API 活动关联起来。

方法：

  1. 创建检测 Azure AD 不可能旅行或异常登录风险的分析规则
  2. 编写一个 KQL 查询，将被攻陷的 Azure AD 身份与 AWS CloudTrail AssumeRoleWithSAML 事件关联
  3. 构建一个 Fusion 检测规则，将 Azure AD 风险事件与后续的 AWS 权限提升活动联系起来
  4. 部署一个 SOAR 剧本，自动禁用 Azure AD 账户并撤销 AWS STS 会话
  5. 创建一个工作簿，显示从初始攻陷到横向移动再到 AWS 的时间线
  6. 在数据湖中运行一个搜寻查询，检查是否有其他账户受到类似模式的影响

陷阱：未跨云提供商关联身份会遗漏完整的攻击链。将分析规则频率设置得过低（例如 24 小时）会使攻击者在数小时内未被发现。

输出格式

Microsoft Sentinel SOC Operations Report
==========================================
工作区: sentinel-workspace
数据源: 14 个连接器已激活
报告周期: 2025-02-01 至 2025-02-23

数据引入:
  Azure AD 登录日志:     2.3 TB (23 天)
  AWS CloudTrail:            1.8 TB (23 天)
  Azure Activity:            0.9 TB (23 天)
  Defender for Cloud 警报: 45 GB (23 天)
  总引入量:           5.1 TB

检测摘要:
  活跃分析规则: 87
  已创建事件: 234
    严重: 8 | 高: 34 | 中: 89 | 低: 103
  平均检测时间 (MTTD): 4.2 分钟
  平均响应时间 (MTTR): 18 分钟

主要事件类型:
  检测到不可能旅行:          42 个事件
  AWS 未授权 API 调用模式:   28 个事件
  S3 中大规模文件删除:            3 个事件
  可疑 Azure AD 应用注册: 12 个事件

自动化:
  已执行剧本: 156
  账户已自动禁用: 23
  事件已自动丰富: 198
  误报率: 12%

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target

achieving-cmmc-level-2-compliance

>-

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

analyzing-active-directory-acl-abuse

Detect dangerous ACL misconfigurations in Active Directory using ldap3

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups

analyzing-azure-activity-logs-for-threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

analyzing-bootkit-and-rootkit-samples

Analyzes bootkit and advanced rootkit malware infecting the Master

analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user

analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

analyzing-certificate-transparency-for-phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to

analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files

analyzing-cobaltstrike-malleable-c2-profiles

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

analyzing-command-and-control-communication

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

analyzing-cyber-kill-chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

analyzing-disk-image-with-autopsy

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

analyzing-dns-logs-for-exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

相关技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community