Share via

MS Sentinel is unable to show outbound traffic malicious incidents for AWS Data Connector

Muhammad Sajid Khan 1 Reputation point
2022-06-30T08:27:07.96+00:00

Hi community,

We are unable to detect outbound malicious traffic coming from AWS. AWSVPCFLOW does not have the malicious IP details. We are using AWS S3 Connector that is available in Sentinel for AWS connectivity. We are sending detailed flow logs to sentinel.

But we can see our servers are communicating with malicious IP addresses reported by Threat Intelligence.

We have contacted Microsoft Support multiple times, and they are repeatedly saying that it is not the fault of sentinel, it's working as expected.
This table does not have malicious IP details. AWS never report Malicious IP addresses.
No option found where we can customize the built-in query for outbound events. How can we add joint for AWSVPCFLOW to communicate with the tables that have malicious IP details?

216462-image.png

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,212 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
999 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrew Blumhardt 9,581 Reputation points Microsoft Employee
    2022-06-30T13:43:45.863+00:00

    Let me break this down a bit:

    You have the AWD data connector enabled. That connector creates three tables including AWSVPCFlow. This table provides a source and destination IP address.

    You are seeing IPs in this table that appear to be malicious. Yes? Which threat intelligence provider are you using to reach the verdict? Do you have these same IPs listed as indicators in the Sentinel Threat Intelligence section?

    Sentinel has two primary TI mapping options. The first is a Microsoft Threat Intelligence rule comparing Security Graph IOCs to a limited set of tables. The second is a bring-your-own-TI solution. You add indicators manually or automatically using TAXII or an API-based connector. The Threat Intelligence section in the portal. These indicators are mapped to various entities by "TI Map" rules available in the analytic rule templates.

    You may be referring to the malicious IP mapping seen in the overview page. Thie is a non-alerting enrichment that happens on the backend for a limited set of tables. No options are provided to customize this view. Nice to look at but largely pointless due to the limited scope and lack of alerts. You won't see AWSVPCFlow here any time soon.

    There is a "TI map IP entity to AWSCloudTrail rule template. This checks the AWSCloudTrail table for IP indicators that have been collected in the Threat Intelligence section. You need to set up a TI feed for this to be effective. The rule does not look at the AWSVPCFlow table. You could use this rule as an example and create a custom rule for AWSVPCFlow if these IPs are not part of the AWSCloudTrail table.

    So currently, no TI mapping on AWSVPCFlow but it would not be too difficult to configure.

    1 person found this answer helpful.
  2. Andrew Blumhardt 9,581 Reputation points Microsoft Employee
    2022-07-04T03:56:31.66+00:00

    Microsoft's MSTIC team is responsible for these rules. You might try Sentinel User Voise to raise recommendations. I can't speak for the rule author's choices. Happy to share your feedback internally.

    https://www.microsoft.com/security/blog/microsoft-security-intelligence/

    1 person found this answer helpful.