Automate Security Investigations Through AI [Clip] — The Azure and AI Show

My name is Dan Ray.

I have had the fortune of working with Frank and Amelia and Joseph and Hal, and I've met Julio before. We met in my hometown of Chicago, Illinois. We could go around while we're giving Amelia a couple minutes to figure out if she can get connected. Joseph, do you want to introduce yourself?

Okay, so yeah, um, good day folks. My name is Joseph Apesu. I am a proud member of this team, and yeah, I've been around for a while with the team for, you know, digging up a lot of topics. So I'm a Microsoft MVP and also certified trainer in the M365 and Copilot space. Yeah, that's a brief about me, and I'm joining here from Abuja, Nigeria. Yeah. Thank you.

Excellent. Hal, you're our latest host or MVP, right?

Well, I don't know about that, but an MVP is what I am. That's Frank's usual description is he's been there 31 years. And well, yeah, that's pretty neat. My name is Hal Hostetter. I live in Tucson, Arizona. I am an M365, basically. That's supposed to be apps and services. I do Outlook. I've been doing that for a good many years. And so I am here to just answer questions and do things and help out any way that I can as far as making this show a marvelous success. Yes, yes.

I meant new to the show, Hal, not new to the MVP program.

Well, yeah, that too. I've only been to the show here 3 or 4 times. At least. It's a lot of fun. I'm glad that— I don't know whether it was you or Frank, but I will thank both of you, Dan and Frank, for having invited me here.

Yeah.

Frank started this almost 4 years ago. And we had a previous show that was monthly, and the monthly show was, you know, if you missed one, you had to wait a whole month to present or to, you know, to queue up content that you wanted to share. And so Frank had the idea in, I want to say, 2023 or 2022 of like, hey, let's do a monthly— or sorry, let's turn the monthly show into a weekly show, and he's been hosting it ever since. And Amelia came along, and Joseph came along, and we've had tons of guest speakers. So this week we have Divya joining us again, and Christian as well. Divya, I think you're presenting first, and I will watch. I have admin controls as well as Joseph, so we can make your, you know, your screen share or your slides appear, those kind of things. So if you want to share your screen and we can start with you.

So you should be able to—

Yeah, let me share it to the— it should be shared now. And I'll just watch for Divya's screen.

Okay, yeah, because while I'm present in the presentation, I won't be able to see you guys because I have like a double screen.

I can monitor.

Okay, so okay, um, okay, uh, the user screen, do you hear me well?

I can hear you for certain.

Okay, um, do you want me to start?

Yeah, go ahead and start.

Okay, so, well, I will explain a little bit how we are evolving in the security analysis and incident response in cyber defense and cybersecurity by automating security investigations through AI. So just in a nutshell, I'm not going really deep in here, but for the people who don't know me, that is probably everybody here and everybody watching the stream, I'm Cristian. I work as a cyber defense expert for a Swiss company, and I'm also a blogger. In case you want to contact me or in case you have any question, feel free to scan the QR code and you will have all the ways to reach me. So in my presentation today, I will be speaking about how we automate the security incidents through AI, obviously. And the way I will explain it is by following this agenda. First of all, I will start with the context, then I will show a little bit of the architecture and how we are building everything on a high level and why are we choosing the tools we are choosing. Then, I will focus a little bit on a technical level regarding the role-based access control in Azure, and I will finish with the actual workflow of the automation. And I will show a little bit of a couple of use cases. One is for a phishing email that results in a security incident, and the other one, it belongs to a malware incident in a workstation. So yeah, starting a little bit of the context why we need to automate security investigations. It's because the life of a security analyst is not easy. We work, you know, security incidents tend to be really stressful moments, especially for the customers, but also for the security analyst. So these results in security analyst fatigue that may lead to some mistakes during investigations. We also tend to have repetitive tasks such as, you know, IP analysis, URL analysis, doing the same incident over and over again, maybe some noisy incidents, maybe we suffer a large amount of incidents at the same time. So this is all, you know, a little bit in pain.

there.

Additionally, you know, threat actors nowadays use AI, as well. So it's like a little bit of Tom and Jerry cartoons. We try to pursue one to another, and this is kind of an AI race between threat actors and hackers and defense teams. So this adds complexity to the security incidents, obviously, to the malware, to social engineering techniques, and so on. This is called asymmetry of scale, by the way. Also, security analysts, we need to be fast, right? When a security incident triggers or we detect something, the faster we are, the more preventive we are being, right? In the end, if, for example, if malware is infecting a workstation of a user, the faster we react, the less files it could gather, the less impact the customer will have, right? This is pretty obvious, but we need to be the faster we can when analyzing. Also, we are missing sometimes alert context in alerts because maybe we don't have the whole view, and the old automations we used to have, like for example, you know, sending artifacts like IP addresses, like senders to third-party solutions, it's fine, but we don't get, like, the whole context. We don't have, like, a 360 view of the whole security incident. So this is an issue, as well, because, yeah, we are paying a third party, but this third party is not, like, getting all the information they need. And obviously, the last one is scalability, right? And the more security incidents we have, the more analysts we need. And also, in multi-tenant environments like MSSPs or multi-customer security operation centers, the more customers you have, the more analysts you need to perform the analysis, right? And this is an issue because in the end, you are not doing the best performance, let's say. So yeah, this is an issue, right? We need to automate security analysis. How we are doing that on a really high level, again, this is the architecture. We are building everything, especially for cloud security, I would say in Azure, obviously. And why in Azure? It's because we have guarantees by Microsoft that none of the data we are using and none of the data that the AI is gathering, it's used neither for training purposes and it cannot be leaked outside of the tenant. So, in this small figure, assume that the whole tenant is this bluish circle. square, and if anything leaves this square, it's data that is going outside to the wild internet. If it's inside the square, it is not exiting the tenant, so the data is secure 100% by Microsoft. So yeah, the first thing we need is the detection method and the security orchestration. This is performed by Sentinel and the Defender platform, obviously. Here, we have some, you know, we have detections in place for workstations, for email, for identity, and everything is orchestrated through Microsoft Sentinel, where we will document security investigations, we will execute the automations, and we will, you know, drive the whole thing. This is basically like the steering wheel of the security investigation. Additionally, for the automation itself, we will use Logic Apps and Azure Function Apps. Each one has a purpose and a meaning. For example, Logic Apps are in charge of the orchestration and, you know, deciding what paths to follow, and Function Apps are in charge of the computational power. When we need computational muscle, we need to do some complex actions, then we can rely on Azure Function Apps. The communication between them, and this is important, it's through API calls, through HTTP POST, PATCH, and GET connections. And also important, the communication between them is not exiting the tab. So again, we are not, during the security incident, we are not compromising again the customer or ourselves during the analysis. Additionally, we can have some third-party services. In this case, you know, as a sample, I attached VirusTotal or URLScan, but We will communicate with them as well with API connections. But this is important to mention that in this case, the information and the data like artifacts, like user information or whatever we need to submit, it's exiting the tenant. So this needs to be encrypted through HTTPS securely or through another method. Finally, as an AI and large language model provider. We will rely on Azure Foundry and only in Azure Foundry, and this is important because if we rely on another AI service provider, I don't know, ChatGPT, Cloud Code, you name it, if we rely on them, we cannot guarantee 100% that this data is not being used to train the AI model or it cannot be leaked. In this case, as a preventive measure to avoid data leaks and avoid language model to train with our data, we will rely only on Azure Fabric. Moving forward, why to use Logic Apps and Azure Functions? As I said, the Logic Apps, you just You know, low code. So in my case, I'm not an expert in developing, so I'm not a programmer. I know a little bit about Python, about C++, but it's not like my area of expertise, right? So in this case, for me, it's really useful to have this low-code, beautiful way to see it where we can organize the logic behind the automation. And also, it is given by Microsoft the native connectors to Microsoft Sentinel. To other services from Microsoft such as Teams, Outlook, and the most important thing, you are able to connect to Graph API so you can perform remediations towards user accounts or even devices. As I said, it drives the automation logic. On the other hand, we have the Function Apps that are serverless computation, So we can rely on another language, programming languages such as Python, Node, and therefore we can rely on their own libraries. In case of, I don't know, if we need to analyze large volumes of data, we can use Pandas from Python, for example. Also, it's prepared for heavy workload since it's programmed, it's code, we can do whatever we want there. Also, we can use these Function Apps as microservices. The combination of these 2 solutions are basically the best way nowadays to automate security incidents, in my opinion. How do we handle the permissions and the privileges in these Logic Apps? Because again, If we are analyzing a security incident, maybe sometime, hopefully not that many times, but we will need to perform remediations. Maybe we need to reset a user's account, maybe we need to disable a user, maybe we need to isolate a device, a workstation, right? So, how do we handle these permissions? First of all, the Logic Apps is— they have a service principal ID so we can assign permissions through the managed identity in Entra ID. And especially in my case, I suggest— my recommendation is to do that through groups. So you can assign the service principal IDs of the Logic Apps to the Entra ID group specifically designed for Logic Apps. So this way you don't need to assign permissions manually. And we need to follow obviously the principle of least privilege for the Logic App and all its assignments. Also, in case the Logic App needs some specific privileges such as, for example, Key Vault access or whatever, we will handle that through, again, managed identities. In case of multi-tenant Logic Apps, We need to register in the tenant we want to perform the actions. We need to register an application, I believe. I'm still learning about that, but I believe it's to register an application there and then assign the permissions through that application. So the incident pipeline together with the investigation, and I'm going, and I know I'm going a little bit fast because I want to focus more in the technical details. So this is more of a context. So the incident pipeline, it's first of all the alert triggers because it detects suspicious activity through the Defender agents installed in workstation or Defender for Office 365 or Defender for Identity or Defender for Cloud Apps, you name it. Then, we have in Sentinel, we have the incident creation. where all the security alerts are grouped. And then here, we can start the orchestration of the security incident. Here, as well, in Sentinel, where the security analyst will be able to document the incident, you know, run the automations they want, also change severity, or, you know, this is more on an organizational level. cases, let's say. And then once the incident is created in Sentinel, the automation rule that is checking all the incident creation will automatically assign a playbook, which is the, the objective of the automation, right? So in this case, for example, if we trigger a phishing email, we'll have an automation rule that triggers a playbook for phishing analysis, for example. So the Logic App that is included in this playbook executes itself and then starts the automation logic that I will explain in a minute and calls the services it needs to call, calls the AI agents it needs to call, and then performs the action we want to perform. After the Logic App is executed, the automated analysis starts, obviously, and then in case it's needed and in case it follows the logic, the remediations and the containment actions are performed. So after the investigation is concluded, the incident is back to the incident queue so it's reviewed by a security analyst and nothing else, hopefully. So more or less, and this is a little bit of a context, so if you are not related with cybersecurity, a medium-complex security incident, and we are speaking about perhaps a malware incident or a phishing where a user clicked and got compromised, But nothing else, more or less it's about 60 minutes of an analysis. Obviously, the remediations and containment actions normally are at the first, but you cannot be 100% sure sometimes. Maybe you need your time to be 100% sure that the user was compromised, and then you expect the remediations to be a little bit late. Through this AI automation, it's more or less, and according to my experience and the things I've been observing in the last 2 months, the investigation for the same analysis will take more or less 5 minutes and with the same results. So then we have a human review in case, you know, Meta says, I'm sorry, the security analysis got wrong, we have the human review, but in the human review we need to be— we need to say that the containment actions have already been done, so there is nothing to worry about. It's more than a review, then, you know, the analyst doesn't need to do anything else, in fact. So, um, any questions so far? I know it's a little bit too much data in a minute.

No.

Thank you. I won't show the Logic App 100% because sometimes it's an spaghetti block, but I will show you some samples of the Logic App. This is extracted from my test demo. And here, well, I have some data anonymized for security, obviously, but in this case you will see that we are starting from the Microsoft Sentinel incident, and the first thing we will do is to update the incident to assign it to the bot. And you will see here in the right screenshot where the automation bot is the one that is handling everything, and then we add a small delay where just because this is so fast, sometimes we don't have all the logs in Sentinel, so we need to add sometimes a small delay so we have all the data we need. So moving forward, as you can see here, we are extracting the email metadata, which is, you know, network message ID, recipient email address, subject, sender from address, and this is done through a KQL query. in the Log Analytics workspace from Sentinel. So this way, we can extract all the metadata from the incident so we, you know, perform the security investigation, and this is parsed and assigned to variables inside the Logic App. Moving forward— sorry, let me explain the other one. So in this case, when we extract the email itself, not the metadata, this email export, let's call it, it's in Base64. It's a whole string. It's a kilometric string of characters in Base64. So for this reason, we need to submit this Base64 email string into our function app programmed in Python where it will automatically convert this Base64 to understandable language, and also it will remove the data we don't need for the security investigation. This way, this data assigned to variables, as you can see here, like subject, like the from, to, reply-to, and all this information, together with the body of the email, and this is— I will go more deeply into that— this is submitted to the AI agent inside the Logic App, which is like the left screenshot, for analysis. Here it's very important to mention that we don't only gather the metadata of the email for this use case, like, as I said, sender, URLs or whatever, but we are also submitting the body of the email. This way, the AI agent has full context of the security incident. And even though there is no URLs, there is no indicators of compromise in the email artifacts, if the email is trying to use any social engineering techniques, such as ask for money, puts the user in a rush or whatever, this will detect the email as malicious as well. And this is something none of the third-party providers can do that, as far as I know, at least securely, you know, with 100% guarantee that the data is not being used for training or data leaks can happen. Also, in my case, what I like to do Is to give like the one number at the end of the AI phishing analysis, let's say, about how likely is this email to be phishing. If the email is likely to be phishing, maybe it's an 80%, something like that. If the email is likely to be spam or a legitimate email, maybe you have 20% chances. Something like that. And in this case, we will add as a comment in the incident provided by the AI, you know, for the analyst to review the assistant response and all the email metadata for the security analyst. Moving forward, this is like the instructions for the agent, sorry. So we can analyze also the user sign-ins in case the user is compromised. So, we don't only analyze the email itself, but we will analyze the user's behavior, the victim behavior, to determine if the user is compromised or if there is any suspicious activity over the user account, as well, so we can perform the remediations accordingly, right? So, in this case, we have some kind of a logic. I can show you the logic behind this. Inside this if button, if the— sorry, this if block, we can see that if the chances of the phishing to be a— sorry, if the chances of the email to be phishing are above 50%, plus the clicks on this phishing, on this email, sorry, are different to 0, so this means if we are speaking about a phishing email and the user clicked, then we need to start different actions. In this case, we will add the comment like, hey, the user clicked. Then, we will change the severity of the incident to high so we know something is happening there. And then, we will perform an HTTP call to Graph API to reset the user's password. Otherwise, I don't really mind because in this case, this is just an example. But otherwise, we would— we could reduce the severity to low instead of medium. We could add a comment like, hey, the user didn't click, or the user clicked but the email was not suspicious enough, so there is no need, no reason to panic. And then, this is the logic behind this. And here you have a sample of how to reset the user's password through Graph API. This is the blog— sorry, This is the green block here below. I don't know if you see my mouse. Let me— well, I guess you see it in the true section, the green block.

Yeah.

This is how we reset the users in case it clicked in a phishing email. So, it's through a Graph API call, and here we can assign the temporary password, which in this case is temporary password. And we need to force to change the password in the next sign-in so the password is still private for the user. Additionally, and as you can see down below in the left screenshot, you will see that this privilege is assigned through managed identity of the Logic App. So again, everything is handled with no accounts. So, really difficult to compromise this kind of blocks. In the end, well, on the right screenshot, we have the notification. So, we are able to notify the user about this password reset, as well, with a notification HTML that we designed previously. So, the user is aware that, you know, he reported a phishing email, so he knows the outcome of the investigation, and together with the remediations we have made. So just for you to see, this is a real screenshot of a Sentinel incident I simulated. So, you know, on a test tenant, I sent myself a phishing email with a dummy account, and then I clicked with the victim user, and I performed connections, and I did everything so the user got compromised by myself, but compromise in the end. So here, you will see that this is the AI phishing analysis performed. You can see that we have the same artifacts in the beginning of the message that I mentioned in the previous slide. Here, we have the network message ID, the recipient, and the subject, and then it starts the AI analysis. It starts by how likely it is to be phishing, In this case, it's 90%, and it provides the key evidence. Here, it's classic lottery lure. You have won the lottery. The email is, you know, you have won the lottery, click here to win money, basically. And also, it's important to mention here that it's reading and understanding the email body itself. As I said, it's understanding that the email is asking to click the user for to win a prize in the lottery. Also, it provides us complete sender analysis, also analyzes the spoofing and DMARC records to detect some spoof activity and impersonation of legitimate domains, for example, and provided provides also VirusTotal links for the sender domain. In this case, Together with URL analysis, and as you will see in this case that the URL belongs to my blog. But yeah, you will see that the link was the phishing link was forwarded to my blog. So analyzes the blog, submits the information to VirusTotal as well, and performs an analysis of the attachments as well together with. You know, the indicators of compromise in the end. As a final recommendation, the AI gives you, you know, you need to quarantine this email because there is strong evidence of lottery scam and whatever. And finally, attaches again how likely this email is phishing, 90%. Followed by that, since we clicked and we got compromised, it performs a sign-in analysis of this user. And here we have evidences of, you know, Tor activity, where I won't go into too many details, but you will see that the compromise probability of this user is 100% because it detected impossible travels in the account, it detected Tor activity from suspicious IP addresses, and so on. So in the end, it's— the user is compromised. So this is why we performed the password reset before and the revoke of the sessions, as well. I didn't attach a screenshot, but in this automation, it forces the user to sign in again. And in case if there was any threat actor or malicious person getting access into the account, it would automatically get out of the account in seconds. Another example, and I will be fast, I promise. This is the automated Malware sandbox analysis. So in this case, we have a completely different logic. But the important thing here—I won't show you the whole logic up again. Sorry, but here you can see that you are able to in the left screenshot, you are able to get the file path of the malware, and also you are able to run antivirus scans automatically. Additionally, you are able to to generate a SAS token. And, you know, to submit this malware sample to, in this case, a sandbox service, which is ANY.RUN. And you will see that you need to execute a run live response in the workstation to gather the file. So what this automation does basically is joins— well, connects to the workstation that is infected gathers a sample of the malware and sends this sample of the malware to ANY.RUN securely. And in this case, this information doesn't leave— well, more than doesn't leave, it's sent securely through a dedicated blob to ANY.RUN. So in this case, the— sorry, yeah. So, in this case, the security analyst has the sandbox analysis for the malware attached as a link. So, by clicking here, we can observe a sample of the malware being executed live in a safe environment. And this is, again, automatically done, and none of these actions have been performed. I mean, with these actions, I mean this, sandbox submission, password reset, security analysis— none of this has been done by a person. This has been everything done automatically, even, you know, in seconds or in minutes, and when a security analyst would take probably an hour or so in a security incident. So yeah. And yeah, do you have any questions? Concern, insight, I will be happy to answer.

Great job. Loved the slides. They were really— thank you— really well built.

Yeah, thank you very much. So yeah, anybody else?

Great show, thanks.

Yeah, thank you. Let me finish and stop sharing my screen. Okay, thank you very much.

Thank you, Divya. If you, uh, are able to share—

yeah, I'll try sharing.

Yeah, let's see if it works.

I switched.

And, um, we had a couple guests show up unexpected. So Joseph joined us, um, from Nigeria, and, uh, Tim Adayo joined us from, I believe, Texas, depending on where he is in the world. He travels between Nigeria and Texas in the United States. And, uh, who else did we see? Julio was here with us and, uh, is still here. And Hal from Arizona. Hal, how's the weather? Is it— is it—

Um, I'm in a nice spot at the moment. There is nothing but horrendous storms all the way around me. Um, it's going to be a juicy afternoon here.

Yeah, we had— we were without power in, uh, south, south of the city, south of Chicago, for 3 days because of, uh, winds and tornadoes and just really bad weather, probably 3 weeks ago, 2 or 3 weeks ago. And, uh, there's a bunch of trees down, and some of the towns surrounding us were without power for a week or 2. So we felt fortunate that we only lost power for 3 days, but I spent a lot of time at work.

Yeah, I'm hoping that doesn't happen here.

Yes, yes, I, I do as well.

I have no work to go to, right?

Well, Larry, um, Charity's son, ended up going to the library because he was here when he wasn't working, and then his work only, I think, was down for 1 day, but You know, he was here to get ready and then coming home to like no power. He spent a lot of time at the library and then, you know, came back here to just sleep basically. But yeah, it's, it's, it's difficult to charge your phone if you don't have power. It's difficult to, you know, make sure you're on time for work if you don't have power. Um, like the garage door. We hadn't even thought of like, oh, we have to put the garage door on the manual mode because can't open it with the electric. Um, just things you don't, you don't think of until you have to, right?

Yeah, well, in my case, it's the, uh, it's the HVAC system. And, uh, yes, when— if power goes away, it's still Oh, what, about 98 Fahrenheit outside right now, something like that? So we don't want that.

No, agreed. You'll lose more than just what's in the fridge and the freezer, right? Pretty much get uncomfortable and too hot for, you know, things that are supposed to be stored at room temperature. Yeah, good luck. We hope, uh, we hope all is well.

Yeah.

Well, so far so good. Yeah. Julio, thanks for joining. You're not too far from me.

Yes, you're welcome.

Appreciate it. Julio is studying for his CCNA, Cisco Certified Network Administrator, I believe.

Cisco Cisco Certified Network Association.

Associate, thank you. And, uh, is interested in getting into an IT career and has done some, uh, AV work in the past. So getting familiar with things like StreamYard helps with, um, experience, Julio. You know, like being on shows like this help you understand like how I showed you how once we get your LinkedIn followers up just a little bit more, you're, you're right on the cusp of 150. And once you get to 150 connections, you can actually share this show with everybody you're connected with. So whether those are instructors or fellow students or people you've met in the tech community, we just need to get you to 150. And then the same way I'm Streaming this to my LinkedIn and to my Facebook. I think today you will be able to stream this to your LinkedIn and potentially either YouTube. You know, we can talk about where else. You don't have to do 2, you can do one if you don't have another place that it makes sense to send it. I don't have a lot of YouTube followers. I have more connections on Facebook than I have on YouTube at this time. So it seemed, you know, better to put it on Facebook than YouTube for me, uh, just to get it out to a lot of different people.

Yes, and, um, speaking about connections, I also, uh, been considering the idea of going back to the university that I graduated to continue as a volunteer. And I talked to a professor and she said I can still participate at least in one club.

What's up with—

okay, yeah, that's great. So yeah, clubs would be a good way to network too.

Yeah, just gotta— I only— I, I, I send emails to instructors, but I can also send emails to other students as well. Yeah, at least those within the college.

Yeah, yeah, it's interesting how you can find connections at different times from different places. It looks like we've got a comment from, uh, one of our, um, one of our, um I want to call them watchers, but they're, they're, they're not listeners, right? Because we're online visually as well as audibly. So somebody watching said hello, and I think that's the comment that we got so far. It's from one of the LinkedIn. So thanks for joining everybody. This has been the Azure and AI Show. Amelia was going to host this week. I think she had some technical difficulties with some of our other guests that stopped by. I think we had 2 people not realizing they were using the same account. I am using Frank's guest account, so that's how I'm able to run the show along with one other person, but I can't run it with 2 other people because that's the limit, is 2 connections for administrating the account. So we had a little technical issue, and apologies, Amelia. Hopefully you'll join us here soon again. And next week I know Frank is back, and I believe we were talking to somebody else about potentially hosting. So I'm not sure who the host next week will be, but Frank will be back in the in the driver's seat, if you will, to you know welcome guests and figure out like how many people we have in the account and what account credentials they're using and all that kind of thing next week. So thanks for joining us online. Have a great rest of your weekend. Hopefully your weather is. Is behaving, and Hal, I hope yours continues to behave and you know keeps you with power even if the weather is a little you know windy or stormy outside. Power in a storm is different than no power in a storm for certain. Indeed. Yeah. So thanks everybody.

See you later. Thank you very much.

Outstanding. See y'all next week.

Yep.