Get email notifications on new incidents from Microsoft 365 Defender

by Contributed | Dec 23, 2020 | Technology

This article is contributed. See the original author and article here.

A new Microsoft 365 Defender feature now lets you receive notification emails directly to your mailbox for each new incident or incident update, this will help you to stay on top of the incident queue.

Get notifications based on incident severity or by device group. You can also choose to only be notified on the first update for each incident.

The notification email contains important details like the incident name, severity, and category.

This notification email enables you to review your incidents effectively, without requiring any trouble ticketing system or API integrations.  It can be a big help in transitioning your security operations processes and leveraging the great efficiency improvements provided through the incident’s alert correlation capabilities

Once you get the notification, you can go directly to the incident and start your investigation right away. For more information on investigating incidents, see Investigate incidents in Microsoft 365 Defender.

If you are looking for more information on how to set up incident email notification in Microsoft 365 Defender, see the full instructions.

Log Analytics UI – Visualization control menu upgraded

by Contributed | Dec 23, 2020 | Technology

This article is contributed. See the original author and article here.

Intro:

Visualizing your data is a great way to gain insight and quickly learn what you need from your logs.

We have improved our chart tab in Log Analytics offering a new way to control your visualization making it easier for you to reach the exact visualization you need.

The new control pane:

The new control pane for visualization is located to the right hand side of the visual:

The new pane offers a clean, modern look and offers a more intuitive way to manage your visual.

The new pane may also be collapsed to allow focus on the visualization and save screen real-estate.

Feedback

We appreciate your feedback! comment on this blog post and let us know what you think of the new visualizations control pane.

Calling REST API service using JSON object with fixed order of elements

by Contributed | Dec 23, 2020 | Technology

This article is contributed. See the original author and article here.

When calling a REST API service with a JSON payload from Logic Apps, Logic Apps reorders JSON elements alphabetically, while some services expects the elements to be in a fixed order causing the service call to fail with an error.

This behavior happens when constructing the JSON payload inside a compose action or the HTTP action body field; after save, the elements are automatically reordered alphabetically.

The standard definition of a JSON object is:

An object is an unordered collection of zero or more name/value pairs, where a name is a string and a value is a string, number, boolean, null, object, or array.

For Example:

A service expects the following JSON object: 

{

“Name”: “XXX XXXX”,

“Age”: “XX”

}

Logic Apps reorder the elements of the JSON object to become as follows:

{

“Age”: “XX”,

“Name”: “XXX XXXX”

}

To workaround this, please use the following steps:

1. Use Variables – initialize variable action to initialize a string variable setting the value to the JSON object string.


2. Use the initialized variable as the body for the HTTP action calling the service.

Your workflow should look as follows:

The Mysterious Case of the Self-Moving FSMO Roles

by Contributed | Dec 23, 2020 | Technology

This article is contributed. See the original author and article here.

Hello all!  This is Chris Cartwright from Directory Services.  I had a coworker, Eric Jansen, reach out to me from the field and ask about an incident on site he was looking into a scenario where “the PDCE (Primary Domain Controller Emulator) and DNM (Domain Naming Master) mysteriously moved…” to a DC in another site.  He said what was weird was who the logs said performed it.  He also said that the other site used their own procedures to build their DCs, which apparently included using Windows Servers Essentials for the base OS.  Now, I have never heard of anyone doing that in an enterprise environment, but it got us curious… 

Administrators are running the beautiful, pristine Contoso domain forest, (with 2 DCs of course…because two is one, and one is none!).  They were built with Windows Server 2012 R2 Datacenter.  They know that the FSMOs are still on the first DCs built, and can see that by running “netdom query fsmo“:    

One day, Contoso-HQ has a new subsidiary, Tailspin Toys that needs Active Directory services for their store.  Per Contoso’s Organizational Policy, this company will exist on the same domain, and they have authorized admins at that site to promote the new DCs for that site.  In preparation for this, the Contoso admins create the site and subnets for the new company’s location.   

30 days go by and the admins at Contoso notice something odd: 

The problem is…nobody authorized that change.  They call the admins at Tailspin Toys and asked if they knew anything about this, and they didn’t…. Not good.   

So, the first thing that they did was figure out when the change occurred.  To do that they used Repadmin.exe with the /ShowObjMeta switch, to see when the FSMORoleOwner attribute changed for the roles that they were interested in.   The timestamp for the last modification to that attribute can be found by looking at the object metadata for that attribute at the following DN locations (for each respective role): 

• RID Master – “cn=Rid Manager$,cn=system,dc=contoso,dc=com”


• Infrastructure Master – “cn=infrastructure, dc=contoso,dc=com”


• PDC Emulator – “dc=contoso,dc=com“


• Domain Naming Master – “cn=partitions,dc=configuration, dc=contoso,dc=com“


• Schema Master – “cn=schema,dc=configuration, dc=contoso,dc=com“

In this case, they were interested in the Domain Naming Master, and the PDCE Emulator role movements operations. 

Once the Contoso Admins figured out when the role was moved and where the change originated from, they now know where to start their search in the event logs.  With that said, the Contoso admins transfer the roles back, and then start digging through the logs.   

They find these two events in the Directory Services logs on ContosoDC1: 

(PDC) 

(Domain Naming Master) 

 So, the change did come from ContosoDC3, but the admins know that they can look at the logs on DC3 to see what user account initiated this, because it’s listed with “User.” 

So, they take a look at ContosoDC3…but what they see isn’t exactly what they expected: 

The user is SYSTEM.  Has ContosoDC3 become self-aware?  Should we expect robots from the future?  The administrators continue digging, now focusing on the security logs during the same timeframe.  At 8:54:35 PM, the same time that they saw the roles move in the Directory Services log, they now find the following in the security logs on ContosoDC3: 

Note the Login ID… 

This log entry continued… 

This event looks interesting.  “An operation was performed on an object.”  The operation in this case was a “Change PDC Operation” (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/99dd371d-9ede-417f-beb1-a065c10ef68f) 

This just goes to show how important it is to have proper auditing in place...you DO have proper auditing setup, enabled, and verified in your environment, don’t you?  If not, I suggest you take a look at Michael Hildebrand’s blog that discusses this in more detail, here.     

So, what happened?  Well, answering that would have taken a little more logging.  Procmon, for example, would have shown that the source port used above came from the silsvc.exe process on the same server.   

So, what is this silsvc.exe you ask?  That’s the Server Infrastructure Licensing Service, and fortunately, it has its own log: 

And the final nail in the coffin is the very next event – “The Correction” 

To sum everything up, do not put Windows Server Essentials into an existing large enterprise – it was never meant to co-exist, and all of the folks (at least that I talked to in both CSS and PFE) had never seen this scenario before.  In the real-world scenario where this happened, those remote ‘spoke site’ DC’s were only meant to be stood up temporarily, and they were.  They were stood up just long enough for the compliance threshold to be met, which moved the roles unknowingly to the ‘spoke site’, and the next day those DC’s were taken offline permanently.  It just happened that those DC’s were removed on a Friday afternoon and the repercussions weren’t felt until the following week. 

We tested this with Server 2012 R2 Essentials and Server 2016 Essentials while manually moving the time forward and saw the same results.  Server 2019 Essentials has the same warning, however we were unable to reproduce the issue just by simply moving the time 30 days into the future: 

So, it’s being tested the old-fashioned way, and we’ll update on that later in 2021!