Identity forensics with Copilot for Security Identity Analyst Plugin

by Contributed | Oct 24, 2024 | Technology

This article is contributed. See the original author and article here.

Overview

This is a step-by-step guided walkthrough of how to use a custom KQL Copilot for Security plugin for Identity SOC and forensics use cases and how it helps in implementing a consistent security policy for every user, employee, frontline worker, customer, and partner as well as apps, devices, and workloads across multi-cloud and hybrid.

Use case summary

Monitoring and governing Identities using Copilot for Security custom Identity Analyst Plugin:

1. User Risk Assessment: Monitor user risk levels based on their activities. This could include sign-in attempts from unfamiliar locations, repeated failed sign-in attempts, or other suspicious behavior.


2. Sign-in Monitoring: Track user sign-in activities. This includes successful sign-ins, failed attempts, and the location and device used for sign-in. Unusual sign-in activity could be a sign of a potential security threat.


3. Admin Activity Monitoring: Admin accounts have high-level access and can be a prime target for attackers. Monitor admin activities, especially those involving changes to security settings, user privileges, or access controls.


4. Application Usage Monitoring: Keep an eye on the usage of applications within your organization. Unusual application activity, such as a high number of downloads or an increase in usage outside of normal business hours, could indicate a potential security issue.


5. Privileged Identity Management: Monitor the lifecycle of privileged identities within your organization. This includes the creation, modification, and deletion of privileged accounts.


6. Access Review: Regularly review user access to various resources within your organization. This can help ensure that users only have access to the resources they need for their job functions, reducing the risk of insider threats.

In this guide, we will provide high-level steps to get started using the new tooling. We will start by adding the custom plugin and it’s recommended for organizations to test this in their dev environment first.

Installation

1. Use the following steps to obtain and install the custom Identity Analyst Plugin for Copilot for Security: Go to securitycopilot.microsoft.com


2. Download the IdentitySecurityAnalyst.yml file from here.


3. Select the plugins icon down in the left corner.

4. Under Custom upload, select upload plugin

5. Select the Copilot for Security plugin and upload the IdentitySecurityAnalyst.yml file

6. Click Add

7. Under Custom you will now see the plug-in. Ensure it is enabled.

The custom package contains the following prompts:

Let us get started with more use cases leveraging Copilot for Security capabilities:

User Risk Assessment

Fetches the user risk levels based on their activities. This could include sign-in attempts from unfamiliar locations, repeated failed sign-in attempts, or other suspicious behavior.

In Copilot for Security, you can either directly invoke the plugin via selling the concerned skill under prompt–system capabilities or type ‘/IdentityGetUserRiskAssesment’ as shown below:

A sample result will be:

User Sign-In Activities

Fetches user sign-in activities. This includes successful sign-ins, failed attempts, and the location and device used for sign-in. Unusual sign-in activity could be a sign of a potential security threat.

In Copilot for Security, you can either directly invoke the plugin via selling the concerned skill under prompt–system capabilities or type ‘/IdentityGetSignInMonitoring’  or prompt with ‘Get users signin activities using Identity analyst plugin’.

Admin Activities Monitoring

Fetches Admin Activity Monitoring logs. Admin accounts have high-level access and can be a prime target for attackers. Monitor all admin activities, especially those involving changes to security settings, user privileges, or access controls.

In Copilot for Security, you can either directly invoke the plugin via selling the concerned skill under prompt–system capabilities or type ‘/IdentityGetAdminActivityMonitoring’  or prompt with ‘Get admin activities monitoring using Identity analyst plugin’. 

Applications Usage Monitoring

Fetches Application Usage Monitoring logs to keep an eye on the usage of applications within your organization. Unusual application activity, such as a high number of downloads or an increase in usage outside of normal business hours, could indicate a potential security issue.

In Copilot for Security, you can either directly invoke the plugin via selling the concerned skill under prompt–system capabilities or type ‘/IdentityGetApplicationUsageMonitoring’  or prompt with ‘Get application usage monitoring using Identity analyst plugin’.

Privileged Identity Management (PIM) Monitoring

Fetches Privileged Identity Management logs to monitor the lifecycle of privileged identities within your organization. This includes the creation, modification, and deletion of privileged accounts.

In Copilot for Security, you can either directly invoke the plugin via selling the concerned skill under prompt–system capabilities or type ‘/IdentityPIMMonitoring or prompt with ‘Get Privileged Identity Management monitoring using Identity analyst plugin’. 

Access Review Monitoring

Fetches Access Review logs to regularly review user access to various resources within your organization. This can help ensure that users only have access to the resources they need for their job functions, reducing the risk of insider threats.

In Copilot for Security, you can either directly invoke the plugin via selling the concerned skill under prompt–system capabilities or type ‘/IdentityAccessReviewMonitoring or prompt with ‘Get Access Review monitoring using Identity analyst plugin’. 

Conclusion

This plugin is based on KQL that presents a relatively simple and scalable way to leverage the existing repositories of proven KQL queries within the Microsoft security ecosystem, One of the suggestions is you can customize the Custom KQL plugin YML file and make the time range to be as input parameter from Copilot for Security instead of specific hard-coded input. These can then be used as a basis to bring AI enrichment onto security data already present within Microsoft Identity for more details on Microsoft Copilot for Security custom plugins via KQL please visit  https://learn.microsoft.com/en-us/copilot/security/plugin-kql. Give it a go and give us your feedback so we can continuously improve the product for your benefit.

Microsoft Connected Cache for Enterprise and Education preview

by Contributed | Oct 23, 2024 | Technology

This article is contributed. See the original author and article here.

Delivery Optimization and Microsoft Connected Cache are comprehensive solutions from Microsoft for minimizing internet bandwidth consumption. Delivery Optimization acts as the distributed content source and Connected Cache acts as the dedicated content source. Organizations have benefited from these solutions, realizing significant bandwidth savings of up to 98 percent with Windows 11 upgrades, Windows Autopilot device provisioning, Microsoft Intune application installations, and monthly update deployments.

Until now, Connected Cache could only be deployed to Configuration Manager with distribution points. With the release of Connected Cache for Enterprise and Education to public preview on October 30, organizations will have more flexibility in deploying Connected Cache directly to host machines running Windows Server, Windows client, and Linux [Ubuntu and Red Hat Enterprise Linux (RHEL)].

Supporting scenarios that are important to enterprises

While Delivery Optimization is mostly known for being a peer-to-peer delivery solution, it’s also the downloader that pulls update content in Windows from the cloud and provides enterprise and education users with tools to manage bandwidth traffic, throttling capabilities, and more.

Connected Cache technology complements Delivery Optimization as a dedicated software caching solution that can be deployed within enterprise and education organizations’ networks. Once deployed to host machines within a network, Connected Cache nodes will transparently and dynamically cache the Microsoft-published content that downstream Windows devices need to download. Using this solution, content requests from Delivery Optimization can be served by the locally deployed Connected Cache node instead of the cloud. This results in fast, bandwidth-efficient delivery across connected devices. Microsoft worked closely with numerous enterprise and education organizations to gather information about their bandwidth management needs. We used the great feedback we received to develop Connected Cache as a solution that supports the scenarios most important to you.

Moving from on premises to hybrid or fully cloud-managed scenario

Enterprises and educational institutions have used solutions like Configuration Manager for device management and content distribution. Many of these organizations:

• Manage all or part of their device tenant with Intune or other mobile device management (MDM).


• Are tasked with decommissioning their Configuration Manager distribution points.


• Are still faced with the challenge of managing content delivery bandwidth.

To support the on-prem to hybrid or fully cloud managed scenario, Connected Cache can be deployed directly to hardware or a virtual machine (VM) running either Windows Server 2022 using Windows Subsystem for Linux (WSL) 2, which is an enterprise-ready, lightweight, first-party solution, or certain Linux distros (Ubuntu 22.04 and RHEL 8 and 9).

Branch office

Many enterprises and educational institutions have a global presence with remote locations where:

• Hundreds of Windows workstations are present.


• No dedicated server hardware or administrator is present on-site.


• Internet bandwidth may be limited and/or internet connectivity may be intermittent.


• Reserving bandwidth for office operations may be more important than download performance of Microsoft content.

To support the branch office scenario, Connected Cache can be deployed directly to Windows 11 workstations using WSL 2.

Enterprise or educational sites

The traditional enterprise or educational site occupies one or more buildings, and may have multiple locations where:

• Hundreds to thousands of Windows workstations, Windows servers, or virtual machines are present.


• Reuse of existing hardware is important (decommissioned Configuration Manager distribution point, file server, cloud print server) or dedicated server hardware is available on-site.


• Internet bandwidth may range from great to limited (T1), and/or internet connectivity may be intermittent.


• Reserving bandwidth for office or educational operations, especially during peak times, is a top priority.


• Performant downloads are necessary to support mass update, upgrade, or Autopilot provisioning operations.

To support the enterprise or educational site scenarios, Connected Cache can be deployed directly to hardware or VMs running Windows Server 2022. Deployments can be made using WSL 2. or certain Linux distros (Ubuntu 22.04 and RHEL 8 and 9).

Bulk management and deployment

Connected Cache Azure resources are typically managed using the Microsoft Azure portal web interface, but they can also be managed using Command-Line Interface (CLI). Connected Cache nodes can be remotely deployed via PowerShell or Linux shell scripts that require no direct user input, enabling deployment of cache nodes without on-site presence.

Create a Connected Cache in the Azure portal.

PowerShell snippet demonstrating use of Connected Cache CLI.

PowerShell script demonstrating use of bulk creations of cache nodes using CLI.

Telemetry by content type

Organizations want to have insights into the health of cache nodes and what content is being delivered to their devices. The Connected Cache Azure portal displays a near real-time and historical view of the outbound traffic in Mbps and volume by content type. These insights help ensure the cache is deployed correctly and devices are successfully pulling content from it. Further details such as cache efficiency (expressed as the percentage of content coming from Connected Cache), per site data, and per country data, will be available in Windows Update for Business reports.

Connected Cache management in Azure portal shows Office, Windows Update, and Intune downloads.

Deploy Microsoft Connected Cache for Enterprise and Education

Starting October 30, 2024, Windows Enterprise (E3, E5, and F3) and Windows Education (A3 and A5) users will be able to use the Azure Marketplace to create “Microsoft Connected Cache for Enterprise and Education” Azure resources that will be used to manage Connected Cache deployments. Once the Connected Cache Azure resource has been created, users can create as many cache nodes as required to support their network topologies or content deployment. Please see the Microsoft Connected Cache for Enterprise and Education documentation overview page for more details.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

How to Introduce Custom Delay Between Two Messages in Azure Bot Composer

by Contributed | Oct 21, 2024 | Technology

This article is contributed. See the original author and article here.

Enhancing User Experience with Timely Responses

Building a conversational bot using Azure Bot Composer offers a myriad of possibilities to create a seamless and engaging user experience. One such feature that can significantly enhance user interaction is introducing a custom delay between two messages. This small yet impactful addition can mimic human-like pauses, making conversations feel more natural and thoughtful.

This blog will guide you through the steps to introduce custom delays between messages in Azure Bot Composer.

Why Introduce a Delay?

Introducing delays between messages can serve several purposes:

• Natural Flow: Mimics human conversation, making interactions feel less robotic.


• Attention Management: Gives users time to read and process information before moving on to the next message.


• Contextual Relevance: Helps in maintaining the context, especially in scenarios where the bot provides detailed explanations or instructions.


• Expected wait time : It often happens that we might want to make an outbound call from Azure bot composer to outside and fetch a response back, it might also need some time to get the desired response, for example when we would like to fetch a token in return, in such scenarios we would like to introduce intentional delay

Setting Up Azure Bot Composer

Before we dive into introducing custom delays, ensure you have Azure Bot Composer installed and set up. You can download it from the official GitHub repository and follow the installation instructions provided. 

Install Composer 

Step-by-Step Guide to Introduce Custom Delays

Step 1: Open Your Bot Project

Launch Azure Bot Composer and open your existing bot project or create a new one. Navigate to the dialog where you want to introduce the delay.

Step 2: Add a New Action

Within your dialog, click on the ‘+ Add’ button to insert a new action. From the list of available actions, select ‘Send a response’. This is the message you want to introduce the delay.

[Activity
Type = delay
Value = "5000"
]

Make sure to add this code as JSON, by clicking on view source code and then add above, it should look like :

Enter the message text you want to send after the delay. This could be any text, such as a follow-up question or additional information.

By default, the typing activity lasts for a short duration. To customize the delay, you can adjust the duration of the typing activity. Click on the typing activity and set the desired duration (in milliseconds) in the properties pane. For example, setting it to 3000 milliseconds will introduce a 3-second delay. Make sure to keep this value below 15 secs.

Step 3: Test Your Bot

Once you have configured the delay and follow-up message, it’s time to test your bot. Click on the ‘Test in Emulator’ button to launch the Bot Framework Emulator. Interact with your bot to ensure that the delay is working as expected, and the messages are being sent in the correct sequence.

Conclusion

Introducing custom delays between messages in Azure Bot Composer is a simple yet powerful way to enhance user experience. By following the steps outlined in this guide, you can create more natural and engaging conversations that keep users interested and informed.