{ "id": "StealthTalkAnomalousAuth", "title": "StealthTalk Anomalous Authentication", "publisher": "StealthTalk", "logo": "\"StealthTalk\"", "descriptionMarkdown": "The StealthTalk Anomalous Authentication connector ingests four classes of anomalous user-authentication events from the StealthTalk Enterprise messenger into a custom Log Analytics table via the Logs Ingestion API.\n\nEvents:\n- **OffHoursLogin** - login outside the user's configured working hours.\n- **NewDeviceLogin** - login from a previously-unseen device.\n- **GeoAnomalyLogin** - login from a country/city that does not match the user's assigned geo zone.\n- **MultiFailLogin** - multiple consecutive failed authentication attempts.", "graphQueries": [ { "metricName": "Total events received", "legend": "StealthTalk anomalous-auth events", "baseQuery": "StealthTalkAnomalousAuth_CL" } ], "sampleQueries": [ { "description": "All anomalous-auth events in the last 24 hours", "query": "StealthTalkAnomalousAuth_CL\n| where TimeGenerated > ago(24h)\n| order by TimeGenerated desc" }, { "description": "Top users by event count (last 7 days)", "query": "StealthTalkAnomalousAuth_CL\n| where TimeGenerated > ago(7d)\n| summarize EventCount = count() by UserId\n| top 20 by EventCount desc" }, { "description": "StealthTalk events visible through the standard ASIM Authentication union", "query": "imAuthentication()\n| where TimeGenerated > ago(24h)\n| where EventVendor == \"StealthTalk\"" } ], "dataTypes": [ { "name": "StealthTalkAnomalousAuth_CL", "lastDataReceivedQuery": "StealthTalkAnomalousAuth_CL\n| summarize Time = max(TimeGenerated)\n| where isnotnull(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ "StealthTalkAnomalousAuth_CL\n| summarize LastEvent = max(TimeGenerated)\n| project IsConnected = iff(isnull(LastEvent), false, LastEvent > ago(7d))" ] } ], "availability": { "status": 1, "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "read and write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } }, { "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", "providerDisplayName": "Keys", "scope": "Workspace", "requiredPermissions": { "action": true } } ], "customs": [ { "name": "StealthTalk Enterprise instance", "description": "A deployed StealthTalk Enterprise tenant with admin access to configure the outgoing webhook to the Log Analytics workspace." }, { "name": "Microsoft Entra App Registration", "description": "A service principal that StealthTalk uses to authenticate to the Logs Ingestion API. Must have the **Monitoring Metrics Publisher** role on the deployed Data Collection Rule." } ] }, "instructionSteps": [ { "title": "STEP 1 - Auto-deployed ingestion infrastructure (review only)", "description": "When the Solution is installed via the Microsoft Sentinel Content Hub, the following resources are deployed automatically into the workspace's resource group:\n\n1. **Custom log table** `StealthTalkAnomalousAuth_CL` (21-field stream).\n2. **Data Collection Endpoint** `StealthTalk-Sentinel-DCE`.\n3. **Data Collection Rule** `StealthTalk-Sentinel-DCR` with `Custom-StealthTalkAnomalousAuth_CL` stream declaration and a one-to-one transform.\n4. **ASIM Authentication 0.1.3 parsers** as workspace saved-search functions: `vimAuthenticationStealthTalk` (filtering) and `ASimAuthenticationStealthTalk` (non-filtering).\n5. **`imAuthentication` extension parser** that registers the StealthTalk source in the workspace ASIM Authentication union (overrides Microsoft's `imAuthentication` saved-search to include the StealthTalk vim parser).\n6. **`ASimDisabledParsers` watchlist** + Microsoft Sentinel onboarding state (idempotent).\n\nNo user action is required at this step beyond installing the Solution. The remaining steps configure StealthTalk to push events into the deployed DCR. Pre-requisite: Microsoft's `FullDeploymentAuthentication.json` ASIM Authentication parser pack must be deployed in the workspace before this Solution is installed." }, { "title": "STEP 2 - Capture the DCE endpoint and DCR Immutable ID", "description": "In the Azure portal, open the Data Collection Endpoint and Data Collection Rule resources deployed in Step 1:\n\n- From the **Data Collection Endpoint** properties, copy the **Logs Ingestion endpoint URI** (looks like `https://stealthtalk-sentinel-dce-..ingest.monitor.azure.com`).\n- From the **Data Collection Rule** Overview, copy the **Immutable ID** (looks like `dcr-`).\n\nYou will paste both values into the StealthTalk admin console in Step 5." }, { "title": "STEP 3 - Create a Microsoft Entra App Registration for StealthTalk", "description": "Create a new App Registration in your Microsoft Entra tenant. Generate a client secret (or use a certificate). Note the **Tenant ID**, **App (client) ID** and **Client secret**. StealthTalk uses this service principal to authenticate to the Logs Ingestion API via OAuth." }, { "title": "STEP 4 - Grant the App Registration the Monitoring Metrics Publisher role on the DCR", "description": "Open the Data Collection Rule deployed in Step 1 -> **Access control (IAM)** -> **+ Add role assignment**.\n\n- Role: **Monitoring Metrics Publisher**\n- Assign access to: **User, group, or service principal**\n- Select the App Registration from Step 3\n\nRBAC role assignments cannot be performed by the Solution install template, so this step is manual." }, { "title": "STEP 5 - Configure StealthTalk to send events", "description": "In the StealthTalk admin console, configure the Microsoft Sentinel/Log Analytics integration with the values captured in Steps 2 and 3:\n\n- **DCE endpoint** - the Logs Ingestion endpoint URI from Step 2\n- **DCR Immutable ID** - from Step 2\n- **Stream name** - `Custom-StealthTalkAnomalousAuth_CL`\n- **Tenant ID, App (client) ID, Client secret** - from Step 3\n\nSave and trigger a test event. The StealthTalk console reports success/failure of the OAuth handshake and the first event delivery." }, { "title": "STEP 6 - Verify ingestion and ASIM normalisation", "description": "Run the **Sample queries** above in **Logs**. All must return rows within a few minutes of test events:\n\n- Raw `StealthTalkAnomalousAuth_CL` table populated.\n- ASIM union view via `imAuthentication() | where EventVendor == 'StealthTalk'` returns the same events normalised to the ASIM Authentication schema.\n\nIf the raw table is empty: verify the StealthTalk console reports successful OAuth and event delivery, and confirm the App Registration has the **Monitoring Metrics Publisher** role on the DCR (Step 4). If the raw table has rows but ASIM union is empty: re-check that Microsoft's `FullDeploymentAuthentication.json` parser pack is deployed." }, { "title": "STEP 7 - Enable analytic rules, hunting queries, workbook, and playbook", "description": "In the Microsoft Sentinel **Content hub**, open the **StealthTalk Anomalous Authentication** Solution and click **Manage**. Enable the four Analytic Rule templates, the three Hunting Query templates, the Workbook, and the Microsoft Teams Playbook. For the Playbook, after deployment, grant its system-assigned managed identity the **Microsoft Sentinel Responder** role on the workspace, and grant the **Azure Security Insights** service principal the **Microsoft Sentinel Automation Contributor** role on the playbook's resource group. Then create an **Automation Rule** in Microsoft Sentinel that runs the playbook on incidents from the four StealthTalk analytic rules." } ] }