Hunt MDE with GSA events

Group by: DestinationFqdn, DestinationPort, DeviceId, InitiatingProcessFileName, InitiatingProcessName, Protocol, RemotePort, RemoteUrl, TransportProtocol
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This rule correlates the Microsoft Defender for Endpoint DeviceNetworkEvents table with the Global Secure Access NetworkAccessTraffic table. By doing this, you can enrich the MDE events which contains detailed process information with the GSA events that contains detailed HTTP header information and more.

References

https://hybridbrothers.com/correlating-defender-for-endpoint-and-global-secure-access-logs/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceInfo` action `any`: Device information
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `any`: Network activity

Rule body

let gsa_events = NetworkAccessTraffic
    // Join DeviceInfo to get MDE DeviceID
    | join kind=inner ( 
        DeviceInfo
        | distinct DeviceId, AadDeviceId
    ) on $left.DeviceId == $right.AadDeviceId
    // Remove Entra Device ID from GSA logs
    | project-away DeviceId
    // Rename MDE Device ID to DeviceId column
    | project-rename DeviceId = DeviceId1;
// Get all MDE network events
DeviceNetworkEvents
// Get HTTP details if HTTP connection is logged
| extend HttpStatus = toint(todynamic(AdditionalFields).status_code),
    BytesIn = toint(todynamic(AdditionalFields).response_body_len),
    BytesOut = toint(todynamic(AdditionalFields).request_body_len),
    HttpMethod = tostring(todynamic(AdditionalFields).method),
    UrlHostname = tostring(todynamic(AdditionalFields).host),
    UrlPath = tostring(todynamic(AdditionalFields).uri),
    UserAgent = tostring(todynamic(AdditionalFields).user_agent),
    HttpVersion = tostring(todynamic(AdditionalFields).version)
// Join GSA logs
| join kind=inner gsa_events on 
    DeviceId,
    $left.RemoteUrl == $right.DestinationFqdn,
    $left.RemotePort == $right.DestinationPort,
    $left.Protocol == $right.TransportProtocol,
    $left.InitiatingProcessFileName == $right.InitiatingProcessName
| project-rename TimeGeneratedGsa = TimeGenerated1, TimestampMde = Timestamp
| project-away Type, TenantId, TimeGenerated, TenantId1, Type1, DeviceId1, AadDeviceId

let gsa_events = NetworkAccessTraffic
    // Join DeviceInfo to get MDE DeviceID
    | join kind=inner ( 
        DeviceInfo
        | distinct DeviceId, AadDeviceId
    ) on $left.DeviceId == $right.AadDeviceId
    // Remove Entra Device ID from GSA logs
    | project-away DeviceId
    // Rename MDE Device ID to DeviceId column
    | project-rename DeviceId = DeviceId1;
// Get all MDE network events
DeviceNetworkEvents
// Get HTTP details if HTTP connection is logged
| extend HttpStatus = toint(todynamic(AdditionalFields).status_code),
    BytesIn = toint(todynamic(AdditionalFields).response_body_len),
    BytesOut = toint(todynamic(AdditionalFields).request_body_len),
    HttpMethod = tostring(todynamic(AdditionalFields).method),
    UrlHostname = tostring(todynamic(AdditionalFields).host),
    UrlPath = tostring(todynamic(AdditionalFields).uri),
    UserAgent = tostring(todynamic(AdditionalFields).user_agent),
    HttpVersion = tostring(todynamic(AdditionalFields).version)
// Join GSA logs
| join kind=inner gsa_events on 
    DeviceId,
    $left.RemoteUrl == $right.DestinationFqdn,
    $left.RemotePort == $right.DestinationPort,
    $left.Protocol == $right.TransportProtocol,
    $left.InitiatingProcessFileName == $right.InitiatingProcessName
| project-rename TimeGeneratedGsa = TimeGenerated2, TimestampMde = TimeGenerated
| project-away Type, TenantId, TimeGenerated, TenantId1, Type1, DeviceId1, AadDeviceId

Stages and Predicates

Let binding: `gsa_events` used in Stages 1, 4

let gsa_events = NetworkAccessTraffic
    | join kind=inner ( 
        DeviceInfo
        | distinct DeviceId, AadDeviceId
    ) on $left.DeviceId == $right.AadDeviceId
    | project-away DeviceId
    | project-rename DeviceId = DeviceId1;

Stage 1: `source`

let gsa_events

Stage 2: `source`

DeviceNetworkEvents

Stage 3: `extend`

extend BytesIn, BytesOut, HttpMethod, HttpStatus, HttpVersion, UrlHostname, UrlPath, UserAgent

Stage 4: `join`

join kind=inner (gsa_events) on DeviceId, RemoteUrl, DestinationFqdn, RemotePort, DestinationPort, Protocol, TransportProtocol, InitiatingProcessFileName, InitiatingProcessName

Stage 5: `project-rename`

project-rename

Stage 6: `project-away`

project-away AadDeviceId, DeviceId1, TenantId, TenantId1, TimeGenerated, Type, Type1

Output fields

These fields are emitted when the rule matches.

Field	Source
`BytesIn`	`extend`
`BytesOut`	`extend`
`HttpMethod`	`extend`
`HttpStatus`	`extend`
`HttpVersion`	`extend`
`UrlHostname`	`extend`
`UrlPath`	`extend`
`UserAgent`	`extend`
`TimeGeneratedGsa`	`project-rename`
`TimestampMde`	`project-rename`

Hunt MDE with GSA events

References

Telemetry coverage

Rule body

Stages and Predicates

Let binding: gsa_events used in Stages 1, 4

Stage 1: source

Stage 2: source

Stage 3: extend

Stage 4: join

Stage 5: project-rename

Stage 6: project-away