Skip to content

Microsoft Intune

Overview

Microsoft Intune helps you protect your workforce's corporate data by managing devices and apps. Intune provides mobile device management (MDM) and mobile app management (MAM) from a secure cloud-based service that is administered using the Microsoft Endpoint Manager admin center. Using Intune, you ensure your workforce's corporate resources (data, devices, and apps) are correctly configured, accessed, and updated, meeting your company's compliance policies and requirements.

This setup guide describe how to forward events produced by Microsoft Intune to Sekoia.io.

Benefit from SEKOIA.IO built-in rules and upgrade Microsoft Intune with the following detection capabilities out-of-the-box.

SEKOIA.IO x Microsoft Intune on ATT&CK Navigator

Microsoft Intune Non-Compliant Device

Detects Microsoft Intune reporting a device in a non-compliant state. This can indicate either a misconfiguration in Intune or a change of configuration on said device.

  • Effort: advanced
Microsoft Intune Policy Change

Detects edits, deletions or creations made to an organization Microsoft Intune policies.

  • Effort: intermediate
RYUK Ransomeware - martinstevens Username

Detects user name "martinstevens". Wizard Spider is used to add the user name "martinstevens" to the AD of its victims. It was observed in several campaigns; in 2019 and 2020.

  • Effort: elementary
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Asset management Information about the set of devices found within the network, along with their current software and configurations

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category ``
Type info

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "{\"time\":\"2022-11-16T09:35:22.0835000Z\",\"tenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\",\"category\":\"AuditLogs\",\"operationName\":\"Rename device ManagedDevice\",\"properties\":{\"ActivityDate\":\"11/16/2022 9:35:22 AM\",\"ActivityResultStatus\":1,\"ActivityType\":3,\"Actor\":{\"ActorType\":1,\"Application\":\"5926fc8e-304e-4f59-8bed-58ca97cc39a4\",\"ApplicationName\":\"Microsoft Intune portal extension\",\"IsDelegatedAdmin\":false,\"Name\":null,\"ObjectId\":\"d9851461-2e64-43b5-bc4d-a3b3c115c19e\",\"PartnerTenantId\":\"00000000-0000-0000-0000-000000000000\",\"UserPermissions\":[\"*\"],\"UPN\":\"Pipin.Saquet@theShire.com\"},\"AdditionalDetails\":\"\",\"AuditEventId\":\"6f3dfd87-3320-41a1-88ff-672a7e731162\",\"Category\":4,\"RelationId\":null,\"TargetDisplayNames\":[\"<null>\"],\"TargetObjectIds\":[\"fee80c12-4b53-4196-ac97-8e249e749ab3\"],\"Targets\":[{\"ModifiedProperties\":[{\"Name\":\"DeviceManagementAPIVersion\",\"Old\":null,\"New\":\"5022-09-16\"}],\"Name\":null}]},\"resultType\":\"Success\",\"resultDescription\":\"None\",\"correlationId\":\"1012dc54-3990-42a6-854e-15b93f707cd3\",\"identity\":\"Pipin.Saquet@theShire.com\"}",
    "event": {
        "kind": "event",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-11-16T09:35:22.083500Z",
    "action": {
        "name": "Rename device ManagedDevice",
        "target": "user",
        "type": "AuditLogs"
    },
    "user": {
        "name": "Pipin.Saquet@theShire.com",
        "roles": [
            "*"
        ]
    },
    "related": {
        "user": [
            "Pipin.Saquet@theShire.com"
        ]
    }
}

{
    "message": "{\"time\":\"2022-11-21T14:09:13.8152000Z\",\"tenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\",\"category\":\"AuditLogs\",\"operationName\":\"Delete MobileAppAssignment\",\"properties\":{\"ActivityDate\":\"11/21/2022 2:09:13 PM\",\"ActivityResultStatus\":1,\"ActivityType\":1,\"Actor\":{\"ActorType\":1,\"Application\":\"5926fc8e-304e-4f59-8bed-58ca97cc39a4\",\"ApplicationName\":\"Microsoft Intune portal extension\",\"IsDelegatedAdmin\":false,\"Name\":null,\"ObjectId\":\"d9851461-2e64-43b5-bc4d-a3b3c115c19e\",\"PartnerTenantId\":\"00000000-0000-0000-0000-000000000000\",\"UserPermissions\":[\"*\"],\"UPN\":\"Pipin@TheShire.com\"},\"AdditionalDetails\":\"Key = GroupPropertyNamesValue = Target.GroupId Key = IgnoreTruncatePropertyNamesValue = Target.GroupId \",\"AuditEventId\":\"59fa433c-2f2b-4ac6-a2c5-4c88ed70fce6\",\"Category\":5,\"RelationId\":null,\"TargetDisplayNames\":[\"Remove-HPbloatware.ps1\",\"<null>\"],\"TargetObjectIds\":[\"a7c6992d-0260-4d73-8c4c-13b16c0d7638\",\"38b059fb-6e7c-494d-99a9-0f51e6c3cfaa_1_0\"],\"Targets\":[{\"ModifiedProperties\":[],\"Name\":\"Remove-HPbloatware.ps1\"},{\"ModifiedProperties\":[{\"Name\":\"Target.Type\",\"Old\":null,\"New\":\"GroupAssignmentTarget\"},{\"Name\":\"Settings.Type\",\"Old\":null,\"New\":\"Win32LobAppAssignmentSettings\"},{\"Name\":\"Id\",\"Old\":null,\"New\":\"38b059fb-6e7c-494d-99a9-0f51e6c3cfaa_1_0\"},{\"Name\":\"Intent\",\"Old\":null,\"New\":\"Required\"},{\"Name\":\"Target.GroupId\",\"Old\":null,\"New\":\"SDP_MDM_WINDOWSDEVICE(38b059fb-6e7c-494d-99a9-0f51e6c3cfaa)  \"},{\"Name\":\"Target.DeviceAndAppManagementAssignmentFilterId\",\"Old\":null,\"New\":\"<null>\"},{\"Name\":\"Target.DeviceAndAppManagementAssignmentFilterType\",\"Old\":null,\"New\":\"None\"},{\"Name\":\"Settings.Notifications\",\"Old\":null,\"New\":\"ShowAll\"},{\"Name\":\"Settings.DeliveryOptimizationPriority\",\"Old\":null,\"New\":\"NotConfigured\"},{\"Name\":\"Source\",\"Old\":null,\"New\":\"Direct\"},{\"Name\":\"SourceId\",\"Old\":null,\"New\":\"<null>\"},{\"Name\":\"DeviceManagementAPIVersion\",\"Old\":null,\"New\":\"5022-09-01\"}],\"Name\":\"<null>\"}]},\"resultType\":\"Success\",\"resultDescription\":\"None\",\"correlationId\":\"f1e94900-1bc8-48fc-b097-fa23ab9c160f\",\"identity\":\"Pipin@TheShire.com\"}",
    "event": {
        "kind": "event",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-11-21T14:09:13.815200Z",
    "action": {
        "name": "Delete MobileAppAssignment",
        "target": "user",
        "type": "AuditLogs"
    },
    "user": {
        "name": "Pipin@TheShire.com",
        "roles": [
            "*"
        ]
    },
    "related": {
        "user": [
            "Pipin@TheShire.com"
        ]
    }
}

{
    "message": "{\"time\":\"2022-11-02T15:50:50.9419000Z\",\"tenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\",\"category\":\"DeviceComplianceOrg\",\"operationName\":\"DeviceCompliance\",\"resultType\":\"None\",\"properties\":{\"DeviceName\":\"DESKTOP-086N6KI\",\"UPN\":\"Pipin.Saquet@theShire.com\",\"ComplianceState\":\"1\",\"ComplianceState_loc\":\"Compliant\",\"OSDescription\":\"Windows\",\"OSVersion\":\"10.0.19044.2130\",\"OS\":\"Windows\",\"OS_loc\":\"Windows\",\"OwnerType\":1,\"OwnerType_loc\":\"Company\",\"DeviceId\":\"06334044-1a53-47d6-b6f8-ec9dcba8fa93\",\"LastContact\":\"2022-10-28 08:27:37.0000000\",\"UserId\":\"41ab6092-2435-4ed0-a28b-d638523d096e\",\"IMEI\":\"\",\"SerialNumber\":\"5CG21492VW\",\"RetireAfterDatetime\":\"\",\"ManagementAgents\":2,\"ManagementAgents_loc\":\"MDM\",\"DeviceType\":1,\"UserName\":\"Saquet Pipin\",\"InGracePeriodUntil\":\"9999-12-31 23:59:59.0000000\",\"DeviceHealthThreatLevel\":null,\"DeviceHealthThreatLevel_loc\":\"Unknown\",\"UserEmail\":\"Pipin.Saquet@theShire.com\",\"BatchId\":\"9ed4cac5-3d86-4760-980d-f1331dfc5ee9\",\"IntuneAccountId\":\"2b9f48a7-75d9-4a72-9b2e-16fd38e121ef\",\"AADTenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\"}}",
    "event": {
        "kind": "event",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-11-02T15:50:50.941900Z",
    "action": {
        "name": "DeviceCompliance",
        "target": "user",
        "type": "DeviceComplianceOrg"
    },
    "host": {
        "id": "06334044-1a53-47d6-b6f8-ec9dcba8fa93",
        "os": {
            "full": "Windows",
            "version": "10.0.19044.2130"
        }
    },
    "user": {
        "email": "Pipin.Saquet@theShire.com",
        "id": "2b9f48a7-75d9-4a72-9b2e-16fd38e121ef",
        "name": "Saquet Pipin"
    },
    "related": {
        "user": [
            "Saquet Pipin"
        ]
    }
}

{
    "message": "{\"time\":\"2022-11-17T07:39:02.4103000Z\",\"tenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\",\"category\":\"Devices\",\"operationName\":\"Devices\",\"resultType\":\"None\",\"properties\":{\"DeviceId\":\"a2f25343-1d87-4876-9e72-de6111b614e5\",\"DeviceName\":\"Pipin.Saquet_AndroidForWork_10/17/2022_2:23 PM\",\"UPN\":\"Pipin.Saquet@theShire.com\",\"LastContact\":\"2022-11-17 07:03:14.6829201\",\"OSVersion\":\"12.0\",\"OS\":\"Android (Personally-Owned Work Profile)\",\"CompliantState\":\"Compliant\",\"Ownership\":\"Personal\",\"ManagedBy\":\"Intune\",\"Model\":\"SM-G996B\",\"SerialNumber\":\"0\",\"Manufacturer\":\"samsung\",\"CreatedDate\":\"2022-10-17 14:23:27.0091131\",\"DeviceState\":\"Managed\",\"UserEmail\":\"Pipin.Saquet@theShire.com\",\"UserName\":\"Pipin.Saquet\",\"IMEI\":\"88888\",\"PhoneNumber\":\"+*******0016\",\"DeviceRegistrationState\":\"Registered\",\"ReferenceId\":\"5f02959f-d014-4f53-a1be-892a7e7dd450\",\"ManagedDeviceName\":\"Pipin.Saquet_AndroidForWork_10/17/2022_2:23 PM\",\"GraphDeviceIsManaged\":true,\"CategoryName\":\"\",\"EncryptionStatusString\":\"True\",\"SubscriberCarrierNetwork\":\"Orange F\",\"JoinType\":\"Azure AD registered\",\"SupervisedStatusString\":\"False\",\"WifiMacAddress\":\"aaa:ffff\",\"StorageTotal\":0,\"StorageFree\":0,\"AndroidPatchLevel\":\"2022-10-01\",\"MEID\":\"\",\"InGracePeriodUntil\":\"9999-12-31 23:59:59.9999999\",\"JailBroken\":\"false\",\"SkuFamily\":\"\",\"EasID\":\"afw72216560A482C5F77A4E4A9E38E58\",\"PrimaryUser\":\"a7b9fde1-d8d5-438b-9516-7ef639dfe244\",\"BatchId\":\"3068a7ce-6e3a-438f-a943-634dd1412bc5\",\"IntuneAccountId\":\"2b9f48a7-75d9-4a72-9b2e-16fd38e121ef\",\"AADTenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\"}}",
    "event": {
        "kind": "event",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-11-17T07:39:02.410300Z",
    "action": {
        "name": "Devices",
        "target": "user",
        "type": "Devices"
    },
    "host": {
        "id": "a2f25343-1d87-4876-9e72-de6111b614e5",
        "mac": [
            "aaa:ffff"
        ],
        "name": "Pipin.Saquet_AndroidForWork_10/17/2022_2:23 PM",
        "type": "SM-G996B",
        "os": {
            "full": "Android (Personally-Owned Work Profile)",
            "version": "12.0"
        }
    },
    "microsoft": {
        "intune": {
            "compliant_state": "Compliant"
        }
    },
    "service": {
        "name": "Intune"
    },
    "source": {
        "mac": "aaa:ffff"
    },
    "user": {
        "email": "Pipin.Saquet@theShire.com",
        "id": "2b9f48a7-75d9-4a72-9b2e-16fd38e121ef",
        "name": "Pipin.Saquet"
    },
    "related": {
        "user": [
            "Pipin.Saquet"
        ]
    }
}

{
    "message": "{\"time\":\"2022-11-18T09:04:24.7065000Z\",\"tenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\",\"category\":\"OperationalLogs\",\"operationName\":\"Compliance\",\"resultType\":\"None\",\"properties\":{\"IntuneAccountId\":\"2b9f48a7-75d9-4a72-9b2e-16fd38e121ef\",\"AlertDisplayName\":\"Managed Device Pipin.Saquet_Windows_10/4/2022_12:43 PM is not Compliant\",\"AlertType\":\"Managed Device Not Compliant\",\"AADTenantId\":\"163381f4-6b9c-43c2-8b57-bfc16b7354f2\",\"Description\":\"Windows10CompliancePolicy.AntivirusRequired_IID_aae45eb0-5edb-fc0b-7adf-47a5d6b12208||||Windows10CompliancePolicy.AntivirusRequired||Equals 0||2||./Vendor/MSFT/DeviceStatus/Antivirus/Status\",\"DeviceDnsDomain\":\"\",\"DeviceHostName\":\"TheShire-W744\",\"IntuneDeviceId\":\"45241578-2168-4649-9edc-2e9025b699ac\",\"DeviceName\":\"Pipin.Saquet_Windows_10/4/2022_12:43 PM\",\"DeviceNetBiosName\":\"TheShire-W744\",\"DeviceOperatingSystem\":\"Windows 10.0.19044.2251\",\"ScaleUnit\":\"AMSUB0502\",\"ScenarioName\":\"Microsoft.Management.Services.Diagnostics.SLAEvents.DeviceNotInComplianceSecurityAlert\",\"StartTimeUtc\":\"2022-11-18T09:04:24.7065Z\",\"UserName\":\"Pipin.Saquet\",\"UPNSuffix\":\"TheShire.com\",\"UserDisplayName\":\"Saquet Saquet\",\"IntuneUserId\":\"7d5c7f0f-8740-4e9d-96a9-5c2d4baf1d70\",\"OperationalLogCategory\":\"DeviceCompliance\"}}",
    "event": {
        "reason": "Windows10CompliancePolicy.AntivirusRequired_IID_aae45eb0-5edb-fc0b-7adf-47a5d6b12208||||Windows10CompliancePolicy.AntivirusRequired||Equals 0||2||./Vendor/MSFT/DeviceStatus/Antivirus/Status",
        "kind": "event",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-11-18T09:04:24.706500Z",
    "action": {
        "name": "Compliance",
        "target": "user",
        "type": "OperationalLogs"
    },
    "host": {
        "name": "TheShire-W744"
    },
    "user": {
        "id": "2b9f48a7-75d9-4a72-9b2e-16fd38e121ef",
        "name": "Pipin.Saquet"
    },
    "related": {
        "user": [
            "Pipin.Saquet"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
action.name keyword The name of the action
action.target keyword The target of the action
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
host.id keyword Unique host id.
host.mac keyword Host MAC addresses.
host.name keyword Name of the host.
host.os.full keyword Operating system name, including the version or code name.
host.os.version keyword Operating system version as a raw string.
host.type keyword Type of host.
microsoft.intune.compliant_state keyword Intune compliant status
network.application keyword Application level protocol name.
service.name keyword Name of the service.
source.ip ip IP address of the source.
source.mac keyword MAC address of the source.
user.email keyword User email address.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.
user.roles keyword Array of user roles at the time of the event.

Configure

To forward Microsoft Intune events from Microsoft to Sekoia.io you need to send your event to an Azure Event Hub where Sekoia.io will collect the events.

image

Prerequisite

To send Microsoft Intune logs to Sekoia.io, there are some prerequisites:

  • Have access to the Sekoia.io XDR Operations Center
  • Be a Intune Service Administrator to perfom the interconnection with Azure Event Hub
  • Be a Contributor on Azure to setup an Event Hub.

Create an Azure Event Hub

Overview

Azure Event Hubs is a cloud-based event streaming platform and event ingestion service provided by Microsoft Azure. It is designed to handle large amounts of event data generated by various applications, devices, and services in real-time. Event Hub enables you to ingest, process, and store events, logs, telemetry data, and other streaming data for further analysis, monitoring, and processing.

This setup guide will show you how to create an Event Hub.

Theses changes have to be made from the Azure Web Portal.

Some resources created during this procedure are needed to connect Sekoia.io to the Event Hub, you can complete the following table to save all the useful informations for later use.

Name Value Description Example
hub_name To be completed at step 3 Name of the Event Hub sekoia_event_hub
hub_connection_string To be completed at step 5 Connection string–primary key Endpoint=sb://company-eventhub.servicebus.windows.net/;SharedAccessKeyName=sekoiaio;SharedAccessKey=XXXXXX;EntityPath=sekoia_event_hub
hub_consumer_group To be completed at step 6 Name of the comsumer group consumergroup_sekoiaio
storage_container_name To be completed at step 7 Name of your container (same as the Event Hub name) sekoia_event_hub
storage_connection_string To be completed at step 8 Storage connection string DefaultEndpointsProtocol=https;AccountName=sekoiaiocheckpoint;AccountKey=XXXXX

As a prerequisite, you need to choose an existing Resource group, or create a new one (e.g. company-resource-group).

Step 1: Find your Subscription ID

  1. Go to: Home > Cost Management + Billing > Subscriptions.
  2. From there, keep the relevant “Subscription ID” that will be used along the process.
image

Step 2: Create Event Hub Namespace

  1. Navigate to Home > Event Hubs.
  2. Create an Event Hub Namespace.
  3. Select your Subscription and your Resource group.
    Click on create new if you want your Event Hub Namespace in a new Resource group.
  4. Choose a namespace name.
  5. Select a location based on your events location.
  6. Select the pricing tier plan based on your utilisation: Standard or Premimum (We don't recommend to choose the Basic plan due to its limitations.)
  7. Select the throughput units number based on your events, or enable the auto inflate mode:
    1 throughput unit can process up to 1 MB per second or 1000 events per second (whichever comes first).
image

Step 3: Create Event Hub Instance

When your Event Hub Namespace is created you can create an Event Hub inside:
1. Navigate to Home > Event Hubs > company-eventhubnamespace.
2. Create an Event Hub.

Info

We advise at least the following values:
- cleanup policy: Delete
- retention time: 168h (7 days)

image

Info

Carefully store the Event Hub name that will be used for sekoia playbook configuration.

Step 4: Create “Shared Access Policies” for the Event Hub Namespace

  1. Navigate to Home > Event Hubs > company-eventhubnamespace | Shared access policies.
  2. Create a policy (e.g. RootManageSharedAccessKey) with the claims Manage, Send and Listen.
image

Step 5: Create “Shared Access Policies” for the Event Hub

  1. Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Shared access policies.
  2. Create a policy (e.g. sekoiaio) with the claims Listen.
image
  1. Once created, click on the policy.
image

Info

Carefully store the connection string–primary key that will be used for sekoia playbook configuration.

Step 6: Create a Consumer group

  1. Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Consumer groups.
  2. Create a Consumer group (e.g. consumergroup_sekoiaio).
image

Info

Carefully store the Consumer group name that will be used for sekoia playbook configuration.

Step 7: Create a Storage Account with a container

In order to allow Sekoia.io keep track of the consumed events, the next step consists in creating a dedicated Storage account.

  1. Navigate to Home > Storage accounts.
  2. Create a Storage account.
  3. Select your Subscription and your Resource group.
  4. Choose a Storage account name.

  5. Select a Region.

    Info

    You must choose the Region used during the Event Hub Namespace creation.

  6. Select your perfomance and redundancy parameters.

    Info

    We advise at least the following values:
    - performance: standard
    - redundancy: Geo-Redundancy storage (GRS)

image

When your storage account is created you can create an container inside.
1. Navigate to Home > Storage accounts > storageaccoutname | containers.
2. Create an container.

Keep the Public Acces Level to Private.

Info

The container name should be the same as the Event Hub name. Carefully store that container name that will be used for sekoia playbook configuration.

Step 8: Retrieve Connection String

You have to retrieve the connection string from Azure Web Portal.

  1. Go to Home > Storage accounts > storageaccoutname | Access Keys.
  2. Click on "Show Keys" on the first Connection String.
image

Info

Carefully store the Connection String that will be used for sekoia playbook configuration.

Further Readings

Send logs from Microsoft Intune to Azure Event Hub

When you have an Event Hub follow this guide to send your events from Microsoft 365 Defender to the Event Hub.

Create the intake

Go to the intake page and create a new intake from the format Microsoft Intune.

Create and configure a playbook on Sekoia.io to collect logs from an Azure Event Hub

  1. In the playbook section, create a playbook with the Trigger module Consume Eventhub messages in Microsoft Azure technology
  2. Setup Module configuration (= default)
  3. Setup Trigger configuration:
    • Event Hub informations: use the table completed during the creation of the Event Hub.
    • Intake informations:
      • intake_key = Intake key that can be found on intake page
      • intake_server = https://intake.sekoia.io
image

Troubleshoot

Go to events page and search events in last 5 minutes by intake key customer.intake_key:"<Your_Intake_Key>"

No events - Please check the configuration and fill the fields with the right information

  • It is possible to investigate on the tab Run and see the response by clicking on the module
image