Azure Sentinel PowerShell Module

“Azure Sentinel is a cloud-native SIEM that provides intelligent security analytics for your entire enterprise at cloud scale. Get limitless cloud speed and scale to help focus on what really matters. Easily collect data from all your cloud or on-premises assets, Office 365, Azure resources, and other clouds. Effectively detect threats with built-in machine learning from Microsoft’s security analytics experts. Automate threat response, using built-in orchestration and automation playbooks.” read more

Rules in Azure Sentinel create the basic logic on which Incidents get created. Currently the only way to add, change or delete rules is through the Azure portal. As we’re running a cloud Security Operations Center at Wortell with many customers connected, doing this manually is no option for us.

PowerShell Module

At the moment there is no documented API, ARM or PowerShell module to configure Azure Sentinel. After doing some research we were able to find the API’s that are currently being used by the Azure Portal and based on that we’ve written a PowerShell module to manage Azure Sentinel through PowerShell.

About the Module

The module currently provide the following functions, if you are missing a feature or have found a bug please create a issue

  1. Set-AzSentinel
  2. New-AzSentinelAlertRule
  3. Get-AzSentinelAlertRule
  4. Import-AzSentinelAlertRule
  5. Remove-AzSentinelAlertRule
  6. Get-AzSentinelIncident
  7. Get-AzSentinelHuntingRule
  8. New-AzSentinelHuntingRule
  9. Remove-AzSentinelHuntingRule
  10. Import-AzSentinelHuntingRule

One of the most used features of the module is Import-AzSentinelAlertRule which gives you the possibility to create and maintain your Azure Sentinel Alert rules from one ore more JSON/YAML files. Therefore we have created a standard JSON and YAML Format which included all the available properties:

The table below describes the property values you need to set in the schema.

Working With the Module

Version 0.6.1 of the AzSentinel module is currently available in PowerShell Gallery

The module itself requires PowerShell Core 6 or above, the Az module to be installed, and the powershell-yaml module because of support for YAML files. Other than that you just need an Azure Log Analytics workspace 😉

Install

The module can also be used from Azure Automation and Azure Functions v2 with support for PowerShell Core

Now the module is installed we can start using the functions, we won’t be able to discuss all the functions in this blog post but they are all very well documented included with multiple examples in docs folder

Enable Azure Sentinel

To enable Azure sentinel on your existing workspace run the following command:

Import Alert Rules

Now that Azure Sentinel is enabled we can start importing our Alert rules, please take a look at the great work done by Edoardo Gerosa for collecting and converting all existing and new alert rules into the JSON format supported by this PowerShell module.

Import Rules

Now if we update our JSON file and change some values and run the the import command the function automatically detects that the rule already exits and then makes a comparison to see if we want to change some values:

The same way of working also applies for hunting  rules, for hunting rules  you can use the following JSon layout:

 

In the next blog post I will explain how I found the API’s and reversed engineered this to a PowerShell module

Infrastructure as Code – Deploy Azure VNet with dynamic subnets

A frequently asked question about rolling out Azure VNet with different subnets in a infrastructure as code environment is where and how to define the subnets in your Azure ARM template. In the most examples online the number of subnets is configured in the template and the name and addressPrefix is configured in the parameter file. The big disadvantage with this scenario is that when you deploy a VNet with for example two subnets and later you decide to add more subnets you have two choices both of which are uncomfortable for an Infrastructure as code release pipeline. Continue reading “Infrastructure as Code – Deploy Azure VNet with dynamic subnets”

Move Azure VM with Managed Disk to another Resource Group

At the moment of writing this blog it’s unfortunately not possible to move an Azure VM with Managed disk to another Resource Group or to another Description. However, Microsoft says on the Azure Portal that this will be possible in the near feature. For the time being, I have chosen to write a small PowerShell script that will do the move fully automated for you. At the moment the only way to move an Azure VM with Managed Disk to another resource group is redeploying the VM. To achieve this you need to perform the following steps (some from the portal and some from PowerShell) manually:

  1. Shutdown VM
  2. Collect the required information like Networking, VM size, Storage etc.
  3. Create a Snapshot
  4. Create or use an existing Azure Storage Account to copy the Snapshot to
  5. Remove the VM
  6. Create a new Azure VM in the new Resource Group with the collected information and Snapshot disk from the Azure Blob
  7. The Azure VM will start automatically, check if the VM functions as it should and remove the Snapshot and Azure Storage Account.

As you can see there are about 7 steps needed to move an Azure VM with a Managed Disk. The script that I have written will do all the steps automatically with only 3 variables that you need to define while running the script. Continue reading “Move Azure VM with Managed Disk to another Resource Group”

Install KMS Host License Pack for Office 2010 on Windows Server 2016

Currently when you try to install the KMS Host License Pack for Office 2010 on a Windows Server 2016 or Windows 10 you receive the following error message:

The cause of this problem relies in the VBS script that is being triggered at the end of the installation. In order to install the KMS Pack on newer operating systems than Windows server 2008R2 you need to perform the following steps:

  1.  Run KeyManagementServiceHost_en-us.exe until the error message appears. Don’t click OK.
  2. Go to the folder “C:\Program Files (x86)\MSECache\OfficeKMS” and copy the folder to somewhere like (C:\Temp\OfficeKMS)
  3. Click OK on the error message and press ENTER to close the program.
  4. Open the folder with the copy (C:\Temp\OfficeKMS) and edit the file kms_host.vbs:
    1. Search for the line 
    2. And replace it with the line below, this line just says that Windows Server 2016 and Windows 10 (both having version number 10) are also supported:
    3. Start Command prompt with administrative permissions, run the command below and follow the wizard.
Greetings, Pouyan

Office 2016 Customization

Disable Office 2016 – First things first Prompt

When you first launch Office Click to Run or Office 2016, you will get a First things first dialog box come up like below. Users will always click accept, what other choice do they have?

You can  disable this by configuring the below Registry key:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Registration]
“AcceptAllEulas”=dword:00000001

Disable Office 2016 Default File Types Dialog

Another thing I disable on my desktop builds is the Office 2016 Default File Types prompt as shown below. Normal users will not understand what it means. All they will do is ask questions.

Use the registry key below to stop it appearing :

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\General]
“ShownFileFmtPrompt”=dword:00000001

~Pouyan

Disable F12 confirmation at PXE boot into WinPE

When you are performing a PXE boot, most of the time you need to press F12 to trigger the PXE boot action. Then after connection is initiated with the PXE server, the boot rom image asks for the F12 key to be pressed again. If the key is not pressed, the machine will continue to boot normally into the installed OS (if available). This can be confusing for some Admins because they except the client to boot through to the Boot image, or maybe they want to create a fully automated OSD Deployment. Continue reading “Disable F12 confirmation at PXE boot into WinPE”

Distribute Office Click-To-Run via Microsoft Intune (MDM) – Part 2

You might have tried following this guide in order to deploy Office Pro Plus (Click-to-Run) via Intune, resulting in the MSI being deployed but the Office bits not being streamed. I’ve found many people in my inbox struggling and eager to find a solution. I’m glad that Pouyan Khabazi and Paul Huijbregts (both from Wortell) have spent time investigating and came with a workaround/fix. This guide is 100% their work and all credits go out to them:

~Pieter Wigleven

Please read more about the solution on Microsoft Blog:

https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2016/08/17/distribute-office-click-to-run-via-microsoft-intune-mdm-part-2/

Remove cached passwords on Windows

Windows caches your user names and passwords entered for network shares, drives etc. That’s fine until there’s an incorrect password or username in the cache, and you want to remove it.

The utility to delete cached credentials is hard to find. It stores both certificate data and also user passwords.

Open a command prompt, or enter the following in the run command:

rundll32.exe keymgr.dll, KRShowKeyMgr

Disable windows 10 non enterprise store tab’s

With the new Windows Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps. Continue reading “Disable windows 10 non enterprise store tab’s”