Microsoft Sentinel Triage AssistanT (STAT)

The Calculate-RiskScore module applies specific logic depending on the input module:

• AAD Risks: Based on Azure AD Identity Protection risk levels (High: 10, Medium: 5, Low: 3, None: 0). If ScorePerItem=True, returns the sum; otherwise, returns the highest severity score.
• Microsoft Defender for Endpoint (MDE): Calculated from UsersHighestRiskScore, HostsHighestRiskScore, and IPsHighestRiskScore. If ScorePerItem=True, returns the sum of the three; otherwise, returns the maximum value. (High: 10, Medium: 5, Low: 3, Informational: 1).
• Related Alerts: Based on Alert Severity (High: 10, Medium: 5, Low: 3, Informational: 1). If ScorePerItem=True, returns the sum; otherwise, returns the highest severity. Note: Adds 10 points per unique MITRE tactic associated with the incident/alerts.
• KQL Module: If ScorePerItem=True, score is 5 * ItemCount * ScoreMultiplier. If False, score is 5 * ScoreMultiplier if results exist.
• Threat Intelligence: If ScorePerItem=True, score is 10 * MatchedTIItemCount * ScoreMultiplier. If False, score is 10 * ScoreMultiplier if matches found.
• Watchlist: If ScorePerItem=True, score is 10 * WatchlistMatchCount * ScoreMultiplier. If False, score is 10 * ScoreMultiplier if matches found.
• UEBA: Sum of InvestigationPriorityMax * ScoreMultiplier, plus 10 * ScoreMultiplier if TI matches are found, plus AnomalyTacticsCount * 10 * ScoreMultiplier for unique MITRE tactics in anomalies.
• File Module: Calculated as (HashesLinkedToThreatCount * 10 * ScoreMultiplier). ScorePerItem has no impact.
• MDCA: If ScorePerItem=True, score is (AboveThresholdCount * 10 * ScoreMultiplier). If False, score is 10 * ScoreMultiplier if AboveThresholdCount > 0.

When running queries, you have access to three specialized tables built from the entity data of the Sentinel Incident. You can use these via join or where clauses to correlate incident data with other logs.

Available Entity Tables

accountEntities

Contains user-related data:

• UserPrincipalName
• SamAccountName
• ObjectSID
• AADUserId
• ManagerUPN

ipEntities

Contains IP-related data:

• IPAddress
• Latitude
• Longitude
• Country
• State

hostEntities

Contains host-related data:

• FQDN
• Hostname

Query Examples

Using a Join:

accountEntities
| join kind=inner (SigninLogs | where ResultType == 50126 | summarize FailureCount=count() by UserPrincipalName | where FailureCount >= 10) on UserPrincipalName

Using a Where clause:

let UPNs = accountEntities | project UserPrincipalName;
SigninLogs
| where UserPrincipalName in (UPNs) and ResultType == 50126
| summarize FailureCount=count() by UserPrincipalName
| where FailureCount >= 10

You can incorporate scores from external sources (e.g., 3rd party threat intelligence or vulnerability management) by formatting a custom JSON message.

Requirements:

• The ModuleName must be set to Custom.
• The ScoringData array must contain objects with a Score property as an integer. If the property is missing or not an integer, the item is dropped.
• ScorePerItem and ScoreLabel are ignored for custom data; the ScoreLabel from the JSON will be used, and all items in the array are processed regardless of the ScorePerItem setting.
• The Score provided in the ScoringData will be multiplied by the ScoringData-ScoreMultiplier parameter.

{
   "ModuleName": "Custom",
   "ScoringData": [
      {
         "Score": 5,
         "ScoreLabel": "Virus Total - Medium Risk"
      },
      {
         "Score": 10,
         "ScoreLabel": "Custom Vulnerability Management Score"
      }
   ]
}

The Get-MDEInsights module retrieves risk scores and exposure levels from Microsoft Defender for Endpoint (MDE). It analyzes machines where a user has logged on interactively or machines associated with specific IP addresses.

Supported Entity Types

• Accounts: Requires objectSid to be available.
• IPs: Analyzes specific IP addresses.
• Hosts: Uses MdatpDeviceId if present; otherwise, it constructs the FQDN from the raw entity.

Trigger Parameters

/* Example of expected parameter usage in a playbook context */
{
  "AddIncidentComments": true,
  "Base Module Body": "{{BaseModuleBody}}",
  "LookbackInDays": 7
}