Sentinel technologies full#

In many organizations this presents a challenge because the SOC generally doesn’t have any access to Key Vaults (and rightly so!).

Sentinel technologies full#

To ensure optimal detection capability, it’s necessary to reach full coverage of Key Vaults with deployed honeytokens. You can examine data within the workbook and from here, launch the entity pages to reveal even more detail. The Incident Investigation workbook displays all the information needed to respond to an alert, along with data points to pivot on during an investigation. You can investigate honeytoken incidents using a pre-defined workbook. You can test these rules by revealing a key or secret for a Key Vault honeytoken, which results in a new security incident being generated.Įach alert contains entity mapping data, such as the user account and IP address as well as custom entities representing the affected Key Vault and corresponding honeytoken key or secret and operation type. Because this monitoring relies upon Key Vault and Azure activity diagnostics logs, we’ll also trigger an incident if the logging configuration is modified. These rules will detect events associated with Key Vault actions such as retrieving key or secret values and other sensitive operations like decryption. We include out-of-box analytics rules which help you monitor honeytoken activity in your environment. Now let’s look at some of the key components of the solution so you can start preparing to evaluate it further. One of the keys in the screenshot above is a honeytoken, can you guess which one? Information they store such as passwords, connection strings, and cryptographic keys are often used for API level access and could be used for privilege escalation and lateral movement if a Key Vault is breached. Key Vault is a highly sensitive resource, designed to protect materials which are of high value to an attacker. Starting today, the solution is based on Azure Key Vault keys and secrets. Manageability is improved using simple UI driven controls to allow deployment at scale and planted honeytokens blend in with existing environment making it hard to differentiate between a honeytoken and its real counterpart. Additional benefits include wider detection coverage since honeytoken objects are embedded throughout the environment. Detection principles remains the same, because there is no legitimate reason to access a honeytoken, any activity indicates the presence of a user who is not familiar with the environment, and could potentially be an attacker.īecause no dedicated infrastructure is required, overall costs to the customer are reduced. This solution moves away from traditional approaches and uses the concept of ‘honeytokens’ by injecting decoy objects into existing workloads. We are excited to announce the Microsoft Sentinel Deception Solution is now in public preview. Introducing the Microsoft Sentinel Deception Solution As our customers continue to shift workloads to Azure, using cloud native capabilities to digitally transform their business, we wanted to offer a solution which can help customers fully leverage the potential this brings in terms of visibility, manageability and reduced cost of ownership. Yet we know there are tangible security benefits with the use of deception. Furthermore, unless significant efforts are made to make the environment look convincingly real, signals giving away the synthetic environment are easy to spot. Security monitoring would trigger an incident for any activity detected as this infrastructure should never be accessed under normal circumstances. Deployment of dedicated infrastructure is costly, both in terms of the assets deployed and associated management overheads. Traditional approaches to deception, often referred to as ‘honeypots’, involved provisioning dedicated infrastructure including servers, databases, and other resources to mimic existing workloads. By planting decoy resources in strategic locations and with heightened monitoring, defenders can lure an attacker in, forcing them to reveal their presence when they would otherwise remain undetected. Whether it’s social engineering or spear phishing, deception plays a major part in most cyber-attacks impacting our customers today. But deception is a two-way street and defenders can use it to their advantage. Among the most successful and well used techniques the adversary has in their toolbox is an attack which involves some form of deception, knowing full well the human vulnerability and ease of which it can be exploited.