Azure / Azure/azure-powershell

Version Information for Sentinel Analytics not Available When Using Az.SecurityInsights Module

Open
#18,859 3 comments 0 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad bug customer-reported SecurityInsights Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

Microsoft recently (last 6 months) started versioning analytic rule templates, in an effort to provide updates to the rules when available. This attribute is not visible to the powershell module Az.SecurityInsights. Viewing the version is not possible, and deployed rules with the module omit this attribute. This breaks the newly introduced functionality in Sentinel to streamline analytic rule template updates (since the version is not available Sentinel doesn't know it needs to be updated).

### Issue script & Debug output

```PowerShell
AlertRuleTemplateName : 52aec824-96c1-4a03-8e44-bb70532e6cea
DisplayName : AdminSDHolder Modifications
Description : This query detects modification in the AdminSDHolder in the Active Directory which could
indicate an attempt for persistence.
AdminSDHolder Modification is a persistence technique in which an attacker abuses the SDProp
process in Active Directory to establish a persistent backdoor to Active Directory.
This query searches for the event id 5136 where the Object DN is AdminSDHolder.
Ref: https://attack.stealthbits.com/adminsdholder-modification-ad-persistence
Enabled : True
LastModifiedUtc : 7/1/2022 6:12:54 PM
Query : SecurityEvent
| where EventID == 5136 and EventData contains "CN=AdminSDHolder,CN=System"
| parse EventData with * 'ObjectDN">' ObjectDN "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Computer,
SubjectAccount, SubjectUserSid, SubjectLogonId, ObjectDN
QueryFrequency : 01:00:00
QueryPeriod : 01:00:00
Severity : High
SuppressionDuration : 05:00:00
SuppressionEnabled : False
TriggerOperator : GreaterThan
TriggerThreshold : 0
Tactics : {Persistence}
Id : /subscriptions/79516b6b-b92e-485a-a6d8-4466dd0d891e/resourceGroups/rg-sentinel-01/providers/Mic
rosoft.OperationalInsights/workspaces/microsoftsentinel/providers/Microsoft.SecurityInsights/al
ertRules/a0e41c98-e124-4ddd-abd0-c50694dca034
Name : a0e41c98-e124-4ddd-abd0-c50694dca034
Type : Microsoft.SecurityInsights/alertRules
Etag : "4100adfd-0000-0100-0000-62bf39260000"
Kind : Scheduled
```

### Environment data

```PowerShell
C:\Epic\Sentinel-Analytics\github> $psversiontable

Name Value
---- -----
PSVersion 7.1.3
PSEdition Core
GitCommitId 7.1.3
OS Microsoft Windows 10.0.19043
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
C:\Epic\Sentinel-Analytics\github> get-module az*

ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.8.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
Script 4.13.0 Az.Compute {Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAddition…
Script 3.1.0 Az.OperationalInsights {Disable-AzOperationalInsightsIISLogCollection, D…
Script 1.0.0 Az.SecurityInsights {Get-AzSentinelAlertRule, Get-AzSentinelAlertRule…
Script 0.6.21 AzSentinel {Add-AzSentinelIncidentComment, Disable-AzSentine…

C:\Epic\Sentinel-Analytics\github>
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Az.SecurityInsights implementation behind Get-AzSentinelAlertRule and the analytic-rule model used by the module, then compare it with the Sentinel rule-template response described in the issue. Done means the template version is exposed when retrieving rules and is preserved when deploying them; no source file or test is named, so locate the relevant model and existing command tests first.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
backend-api-design, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.