Communitygithub.com

使用Sentinel建置雲端SIEM

部署Microsoft Sentinel作為雲端原生SIEM/SOAR，透過配置多雲資料連接器（AWS、Azure、GCP）、撰寫KQL偵測與狩獵查詢，以及建置自動化Logic Apps回應腳本，建立集中式SOC。

使用Sentinel建置雲端SIEM 是什麼？

此技能專注於使用Microsoft Sentinel建置雲端SIEM/SOAR解決方案。它提供從頭到尾的工作流程，包括佈建Sentinel工作區、啟用AWS、Azure與GCP的多雲資料連接器、撰寫Kusto查詢語言（KQL）的偵測規則以識別特定威脅，以及使用Azure Logic Apps建立自動化回應腳本。所涵蓋的偵測案例包括不可能的移動、IAM憑證濫用、大量S3物件刪除以及跨帳戶橫向移動。它也包含Sentinel Data Lake的長期紀錄保留與威脅狩獵，並整合Microsoft Threat Intelligence以對抗惡意基礎設施。此技能支援Azure CLI與KQL範例，協助安全團隊在多重雲端環境中建立集中式SOC。特別指出不適用於僅使用AWS Security Hub與GuardDuty即可滿足需求的AWS-only環境，或需要EDR功能的端點偵測。

相容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-cloud-siem-with-sentinel
查看原文→瀏覽所有技能

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

說明文件

使用Sentinel建置雲端SIEM 是做什麼的？

使用時機

  • 為多雲端環境建立集中式安全營運中心時
  • 從傳統SIEM平台（Splunk、QRadar）遷移至雲端原生架構時
  • 為雲端特定威脅建置自動化事件回應流程時
  • 跨PB級安全遙測資料執行大規模威脅狩獵時
  • 將威脅情資摘要與雲端安全記錄分析整合時

請勿使用於僅需AWS Security Hub和GuardDuty即可滿足的AWS-only環境、需要EDR功能的端點偵測（請使用Defender for Endpoint），或法規遵循狀態監控（請參閱建置雲端安全態勢管理）。

先決條件

  • 具有已啟用Microsoft Sentinel的Log Analytics工作區的Azure訂閱
  • 目標記錄來源（AWS CloudTrail、Azure Activity、GCP）的資料連接器權限
  • 用於自動化回應腳本的Logic Apps或Azure Functions
  • 具備KQL（Kusto查詢語言）能力，用以撰寫偵測規則和狩獵查詢

工作流程

步驟1：佈建Sentinel工作區與資料連接器

建立針對安全資料最佳化的Log Analytics工作區，並啟用多雲端資料擷取的連接器。

# 建立Log Analytics工作區
az monitor log-analytics workspace create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --location eastus \
  --retention-time 365 \
  --sku PerGB2018

# 在工作區上啟用Microsoft Sentinel
az sentinel onboarding-state create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace

# 啟用AWS CloudTrail連接器
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id aws-cloudtrail \
  --kind AmazonWebServicesCloudTrail \
  --aws-cloud-trail-data-connector '{
    "awsRoleArn": "arn:aws:iam::123456789012:role/SentinelCloudTrailRole",
    "dataTypes": {"logs": {"state": "Enabled"}}
  }'

# 啟用Azure AD登入與稽核記錄
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id azure-ad \
  --kind AzureActiveDirectory \
  --azure-active-directory '{
    "dataTypes": {
      "alerts": {"state": "Enabled"},
      "signinLogs": {"state": "Enabled"},
      "auditLogs": {"state": "Enabled"}
    }
  }'

步驟2：撰寫KQL偵測規則

使用Kusto查詢語言建立分析規則，以偵測雲端特定威脅。將每個規則對應至MITRE ATT&CK技術。

// 偵測不可能移動 - 從地理上相距遙遠的地點登入
let timeframe = 1h;
let distance_threshold = 500; // km
SigninLogs
| where TimeGenerated > ago(timeframe)
| where ResultType == 0 // 僅限成功登入
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
          Latitude = toreal(LocationDetails.geoCoordinates.latitude),
          Longitude = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),
         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiff < 60
| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) / 1000
| where Distance > distance_threshold
| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff

// 從CloudTrail偵測AWS IAM憑證濫用
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("ConsoleLogin", "AssumeRole", "GetSessionToken")
| where ErrorCode == ""
| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),
            IPList = make_set(SourceIpAddress, 10)
            by UserIdentityArn, bin(TimeGenerated, 1h)
| where DistinctIPs > 3
| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList

// 偵測大量S3物件刪除（潛在勒索軟體）
AWSCloudTrail
| where TimeGenerated > ago(1h)
| where EventName == "DeleteObject" or EventName == "DeleteObjects"
| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)
            by UserIdentityArn, bin(TimeGenerated, 10m)
| where DeleteCount > 100
| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected

步驟3：使用Logic Apps建置SOAR腳本

建立自動化回應腳本，在分析規則觸發事件時執行。常見動作包括封鎖使用者、隔離資源，以及使用威脅情資豐富警示。

{
  "definition": {
    "triggers": {
      "Microsoft_Sentinel_incident": {
        "type": "ApiConnectionWebhook",
        "inputs": {
          "body": {"incidentArmId": "subscriptions/@{triggerBody()?['workspaceInfo']?['SubscriptionId']}/resourceGroups/@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}/providers/Microsoft.OperationalInsights/workspaces/@{triggerBody()?['workspaceInfo']?['WorkspaceName']}/providers/Microsoft.SecurityInsights/Incidents/@{triggerBody()?['object']?['properties']?['incidentNumber']}"},
          "host": {"connection": {"name": "@parameters('$connections')['microsoftsentinel']['connectionId']"}}
        }
      }
    },
    "actions": {
      "Get_incident_entities": {
        "type": "ApiConnection",
        "inputs": {"method": "post", "path": "/Incidents/entities"}
      },
      "For_each_account_entity": {
        "type": "Foreach",
        "foreach": "@body('Get_incident_entities')?['Accounts']",
        "actions": {
          "Disable_Azure_AD_user": {
            "type": "ApiConnection",
            "inputs": {
              "method": "PATCH",
              "path": "/v1.0/users/@{items('For_each_account_entity')?['AadUserId']}",
              "body": {"accountEnabled": false}
            }
          },
          "Add_comment_to_incident": {
            "type": "ApiConnection",
            "inputs": {
              "body": {"message": "使用者 @{items('For_each_account_entity')?['Name']} 已由自動化腳本停用"}
            }
          }
        }
      }
    }
  }
}

步驟4：配置Sentinel資料湖以進行長期狩獵

啟用Sentinel資料湖以進行PB級紀錄保留，並使用KQL和SQL端點進行進階威脅狩獵。

// 威脅狩獵查詢：偵測跨AWS帳戶的橫向移動
let suspicious_roles = AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName == "AssumeRole"
| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)
| where AssumedRoleArn contains "cross-account" or AssumedRoleArn contains "admin"
| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)
            by UserIdentityArn, AssumedRoleArn
| where AssumeCount > 10 and UniqueSourceAccounts > 2;
suspicious_roles
| join kind=inner (
    AWSCloudTrail
    | where TimeGenerated > ago(7d)
    | where EventName in ("RunInstances", "CreateFunction", "PutBucketPolicy")
) on UserIdentityArn
| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress

步驟5：整合威脅情資

連接威脅情資提供者，並建立基於指標的比對規則，以偵測與已知惡意基礎設施的通訊。

# 啟用Microsoft Threat Intelligence連接器
az sentinel data-connector create \
  --resource-group security-rg \
  --workspace-name sentinel-workspace \
  --data-connector-id microsoft-ti \
  --kind MicrosoftThreatIntelligence \
  --microsoft-threat-intelligence '{
    "dataTypes": {"microsoftEmergingThreatFeed": {"lookbackPeriod": "2025-01-01T00:00:00Z", "state": "Enabled"}}
  }'

// 將網路指標與雲端流程記錄進行比對
let TI_IPs = ThreatIntelligenceIndicator
| where TimeGenerated > ago(30d)
| where isnotempty(NetworkIP)
| distinct NetworkIP;
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestIP_s in (TI_IPs)
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s

關鍵概念

術語定義
KQLKusto查詢語言，Microsoft Sentinel的主要查詢語言，用於搜尋、分析和視覺化安全資料
分析規則Sentinel中的偵測邏輯，會依排程評估記錄資料，並在條件符合時建立事件
SOAR腳本由事件觸發的自動化工作流程，執行諸如封鎖帳戶、豐富警示或通知團隊等回應動作
資料連接器將安全記錄從雲端服務、身分提供者和第三方工具擷取至Sentinel的整合模組
Sentinel資料湖PB級儲存層，提供長期記錄保留，並支援KQL和SQL查詢介面，用於進階狩獵
活頁簿Sentinel中的互動式儀表板，顯示安全資料的視覺化圖表、趨勢和營運指標
監看清單Sentinel中的參考資料表，用於豐富警示的上下文，例如VIP使用者清單或核准的IP範圍
Fusion偵測機器學習驅動的關聯引擎，能自動偵測跨資料來源的多階段攻擊

工具與系統

  • Microsoft Sentinel: 基於Azure Log Analytics的雲端原生SIEM/SOAR平台，具備AI驅動的威脅偵測能力
  • Azure Logic Apps: 低程式碼自動化平台，用於建置由Sentinel事件觸發的SOAR腳本
  • Microsoft Threat Intelligence: 整合的威脅摘要，提供IP、網域和URL指標，用於與安全記錄進行比對
  • Azure Data Explorer: 高效能分析引擎，為Sentinel KQL查詢提供基礎，支援大規模資料探索
  • MITRE ATT&CK Navigator: 用於將Sentinel偵測規則對應至對手戰術和技術的框架

常見情境

情境：偵測跨雲端憑證竊取活動

背景：攻擊者透過網路釣魚入侵Azure AD帳戶，然後使用該帳戶透過同盟身分存取AWS資源。Sentinel需要將Azure登入異常與異常的AWS API活動進行關聯。

方法：

  1. 建立偵測Azure AD不可能移動或異常登入風險的分析規則
  2. 撰寫KQL查詢，將受入侵的Azure AD身分與AWS CloudTrail AssumeRoleWithSAML事件進行關聯
  3. 建立Fusion偵測規則，將Azure AD風險事件與隨後的AWS權限提升活動連結起來
  4. 部署SOAR腳本，自動停用Azure AD帳戶並撤銷AWS STS工作階段
  5. 建立活頁簿，顯示從初始入侵到AWS橫向移動的完整時間線
  6. 在資料湖中執行狩獵查詢，檢查是否有影響其他帳戶的類似模式

陷阱：未能跨雲端提供者關聯身分會遺漏完整的攻擊鏈。將分析規則頻率設定過低（例如24小時）會讓攻擊者擁有數小時的未偵測存取時間。

輸出格式

Microsoft Sentinel SOC Operations Report
==========================================
工作區：sentinel-workspace
資料來源：14個活躍連接器
報告期間：2025-02-01 至 2025-02-23

資料擷取：
  Azure AD 登入記錄：     2.3 TB (23天)
  AWS CloudTrail：        1.8 TB (23天)
  Azure Activity：        0.9 TB (23天)
  Defender for Cloud 警示：45 GB (23天)
  總擷取量：               5.1 TB

偵測摘要：
  活躍分析規則：87
  建立的事件：234
    重大：8 | 高：34 | 中：89 | 低：103
  平均偵測時間（MTTD）：4.2分鐘
  平均回應時間（MTTR）：18分鐘

主要事件類型：
  偵測到不可能移動：          42個事件
  AWS未授權API呼叫模式：   28個事件
  S3中的大量檔案刪除：        3個事件
  可疑的Azure AD應用程式註冊：12個事件

自動化：
  已執行的腳本：156
  自動停用的帳戶：23
  自動豐富的事件：198
  誤報率：12%

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target

achieving-cmmc-level-2-compliance

>-

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

analyzing-active-directory-acl-abuse

Detect dangerous ACL misconfigurations in Active Directory using ldap3

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups

analyzing-azure-activity-logs-for-threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

analyzing-bootkit-and-rootkit-samples

Analyzes bootkit and advanced rootkit malware infecting the Master

analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user

analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

analyzing-certificate-transparency-for-phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to

analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files

analyzing-cobaltstrike-malleable-c2-profiles

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

analyzing-command-and-control-communication

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

analyzing-cyber-kill-chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

analyzing-disk-image-with-autopsy

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

analyzing-dns-logs-for-exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

相關技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community