Implementation Guide: Correlate SIEM Alerts & Threat Intelligence — Prioritize Remediation by Mission Impact & Detect APT/Insider Threat

sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py
sudo python cef_installer.py [WORKSPACE_ID] [PRIMARY_KEY]

// Verify Defender for Endpoint telemetry is flowing
DeviceEvents
| where TimeGenerated > ago(1h)
| summarize count() by DeviceName
| order by count_ desc
| take 20

// Verify Azure AD logs
SigninLogs
| where TimeGenerated > ago(1h)
| summarize count() by UserPrincipalName, ResultType
| order by count_ desc

// Verify network device CEF logs
CommonSecurityLog
| where TimeGenerated > ago(1h)
| summarize count() by DeviceVendor, DeviceProduct
| order by count_ desc

// Check for log source gaps — find systems with no logs in 24h
DeviceInfo
| summarize last_seen = max(TimeGenerated) by DeviceName
| where last_seen < ago(24h)
| project DeviceName, last_seen, hours_silent = datetime_diff('hour', now(), last_seen)
| order by hours_silent desc

# Enriches and prioritizes Sentinel alerts using vulnerability and threat
# intel data

# alert_prioritization.py
# Enriches and prioritizes Sentinel alerts using vulnerability and threat intel data

from openai import AzureOpenAI
from azure.monitor.query import LogsQueryClient
from azure.identity import ClientSecretCredential
import os, json, requests
from datetime import datetime, timedelta

# Azure clients
credential = ClientSecretCredential(
    os.environ["AZURE_TENANT_ID"],
    os.environ["AZURE_CLIENT_ID"],
    os.environ["AZURE_CLIENT_SECRET"]
)
logs_client = LogsQueryClient(credential, endpoint="https://api.loganalytics.azure.us/v1")
openai_client = AzureOpenAI(
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
    api_key=os.environ["AZURE_OPENAI_KEY"],
    api_version="2024-08-01-preview"
)

SENTINEL_WORKSPACE_ID = os.environ["SENTINEL_WORKSPACE_ID"]

# Load CISA KEV catalog
def get_kev_catalog() -> dict:
    """Load CISA Known Exploited Vulnerabilities catalog."""
    resp = requests.get("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json")
    resp.raise_for_status()
    kev_list = resp.json().get("vulnerabilities", [])
    return {v["cveID"]: v for v in kev_list}  # Dict keyed by CVE ID for fast lookup

# Mission impact classification matrix
MISSION_IMPACT = {
    "ERP_SERVER": {"impact": "Critical", "score": 10, "mission": "Financial operations, payroll, billing"},
    "DOMAIN_CONTROLLER": {"impact": "Critical", "score": 10, "mission": "All authentication and access control"},
    "CUI_FILE_SERVER": {"impact": "Critical", "score": 9, "mission": "CUI storage — CMMC scope"},
    "EMAIL_SERVER": {"impact": "High", "score": 7, "mission": "All communications"},
    "VPN_GATEWAY": {"impact": "High", "score": 8, "mission": "Remote access for all personnel"},
    "WORKSTATION_PM": {"impact": "Medium", "score": 5, "mission": "Program management — CUI access"},
    "WORKSTATION_STANDARD": {"impact": "Low", "score": 3, "mission": "General productivity"},
    "PRINTER": {"impact": "Low", "score": 2, "mission": "Non-critical"}
}


def get_asset_vulnerabilities(asset_name: str) -> list:
    """Query Tenable vulnerability data for a specific asset (via Tenable API or SQL)."""
    TENABLE_API_KEY = os.environ.get("TENABLE_API_KEY", "")
    TENABLE_SECRET = os.environ.get("TENABLE_SECRET", "")

    headers = {
        "X-ApiKeys": f"accessKey={TENABLE_API_KEY};secretKey={TENABLE_SECRET}",
        "Content-Type": "application/json"
    }

    # Search for asset by hostname
    resp = requests.post(
        "https://cloud.tenable.com/assets/search",  # Tenable.io; use internal URL for Tenable.sc
        headers=headers,
        json={"filter": {"and": [{"property": "hostname", "operator": "eq", "value": asset_name}]}}
    )

    if resp.status_code != 200:
        return []

    assets = resp.json().get("assets", [])
    if not assets:
        return []

    asset_id = assets[0].get("id")

    # Get vulnerabilities for this asset
    vuln_resp = requests.get(
        f"https://cloud.tenable.com/workbenches/assets/{asset_id}/vulnerabilities",
        headers=headers,
        params={"date_range": 90}
    )

    if vuln_resp.status_code != 200:
        return []

    return vuln_resp.json().get("vulnerabilities", [])[:20]  # Top 20 vulns


def prioritize_alert_with_ai(alert: dict, asset_context: dict,
                              vulnerabilities: list, kev_catalog: dict) -> dict:
    """Use Azure OpenAI to generate prioritization narrative for a Sentinel alert."""

    # Check if any asset vulnerabilities are in KEV catalog
    kev_matches = []
    for vuln in vulnerabilities:
        cve = vuln.get("cve_id", "")
        if cve in kev_catalog:
            kev_matches.append({
                "cve": cve,
                "vuln_name": vuln.get("plugin_name", ""),
                "cvss": vuln.get("cvss3_base_score", ""),
                "kev_note": kev_catalog[cve].get("notes", ""),
                "ransomware_campaign_use": kev_catalog[cve].get("knownRansomwareCampaignUse", "Unknown")
            })

    # Build enriched context
    enriched_context = {
        "alert": {
            "title": alert.get("AlertName", alert.get("Title", "Unknown")),
            "severity": alert.get("AlertSeverity", alert.get("Severity", "Unknown")),
            "tactics": alert.get("Tactics", []),
            "techniques": alert.get("Techniques", []),
            "description": alert.get("Description", "")[:500],
            "entity": alert.get("Entities", [{}])[0] if alert.get("Entities") else {},
            "time": alert.get("TimeGenerated", str(datetime.utcnow()))
        },
        "asset_context": asset_context,
        "kev_vulnerabilities_on_asset": kev_matches,
        "top_vulnerabilities": [
            {"cve": v.get("cve_id", ""), "cvss": v.get("cvss3_base_score", ""),
             "name": v.get("plugin_name", "")[:100]}
            for v in vulnerabilities[:5]
        ]
    }

    prioritize_prompt = f"""You are a senior security analyst for a defense contractor operating
under CMMC Level 2. Analyze this security alert and provide a mission-impact-based
prioritization assessment.

ENRICHED ALERT CONTEXT:
{json.dumps(enriched_context, indent=2, default=str)}

Provide a prioritization assessment with:

## PRIORITY SCORE: [1-10] | PRIORITY LEVEL: [CRITICAL/HIGH/MEDIUM/LOW/INFORMATIONAL]

## MISSION IMPACT ASSESSMENT
- What mission functions are at risk if this alert represents a real threat?
- Can operations continue if this system is compromised/isolated for remediation?
- CMMC scope impact: Is this system in the CMMC boundary? (Yes/No — [reason])

## THREAT ASSESSMENT
- Is this likely a true positive, false positive, or requires investigation?
- Which MITRE ATT&CK tactic/technique does this represent (if any)?
- Does the presence of KEV vulnerabilities on this asset increase threat likelihood?
- Any indicators of APT behavior vs. commodity threat vs. insider threat?

## RECOMMENDED ANALYST ACTIONS
List specific, ordered actions:
1. [Immediate — within 1 hour]
2. [Short-term — within 4 hours]
3. [Follow-up — within 24 hours]

## ESCALATION RECOMMENDATION
- Escalate to ISSM/CISO? [Yes/No — reason]
- Trigger incident response plan? [Yes/No — reason]
- CMMC reportable incident? [Yes/No — reason]
- Notify DIBCAC/DCSA? [Yes/No — reason]

[ANALYST REVIEW REQUIRED — Do not execute automated response without analyst confirmation]"""

    response = openai_client.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        messages=[
            {"role": "system", "content": "You are a senior cybersecurity analyst specializing in defense contractor CMMC compliance and threat analysis. Provide concise, actionable prioritization assessments."},
            {"role": "user", "content": prioritize_prompt}
        ],
        temperature=0.1,
        max_tokens=1500
    )

    return {
        "alert_id": alert.get("SystemAlertId", "Unknown"),
        "prioritization_narrative": response.choices[0].message.content,
        "kev_matches": len(kev_matches),
        "enriched_context": enriched_context
    }

-- LOLBIN Execution Pattern (Living Off the Land) | Maps to: MITRE T1218
-- (System Binary Proxy Execution)

let lolbins = dynamic(["certutil.exe","mshta.exe","regsvr32.exe","rundll32.exe",
                        "msiexec.exe","wscript.exe","cscript.exe","powershell.exe",
                        "cmd.exe","bitsadmin.exe","wmic.exe","installutil.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(1h)
| where FileName in~ (lolbins)
| where ProcessCommandLine has_any ("http", "ftp", "\\\\", "base64", "bypass", "hidden", "encoded", "downloadstring")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| join kind=leftouter (
    DeviceInfo | summarize arg_max(TimeGenerated, *) by DeviceName
) on DeviceName
| extend RiskScore = case(
    ProcessCommandLine has "bypass" and ProcessCommandLine has "base64", 9,
    ProcessCommandLine has "downloadstring", 8,
    ProcessCommandLine has "encoded", 7,
    5)
| where RiskScore >= 7
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          RiskScore, OSPlatform

-- Abnormal Data Exfiltration Pattern | Maps to: MITRE T1048 (Exfiltration
-- Over Alternative Protocol)

let baseline_period = 30d;
let detection_period = 1d;
let threshold_multiplier = 3.0;

let user_baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(baseline_period) .. ago(detection_period))
| where ActionType == "NetworkSignatureInspected" or ActionType == "ConnectionSuccess"
| summarize
    avg_daily_bytes = sum(SentBytes) / 30.0,
    avg_daily_connections = count() / 30.0
  by DeviceName, InitiatingProcessAccountName;

let current_activity = DeviceNetworkEvents
| where TimeGenerated > ago(detection_period)
| where ActionType == "ConnectionSuccess"
| summarize
    current_bytes = sum(SentBytes),
    current_connections = count(),
    dest_ips = make_set(RemoteIP)
  by DeviceName, InitiatingProcessAccountName;

user_baseline
| join kind=inner current_activity on DeviceName, InitiatingProcessAccountName
| extend
    bytes_ratio = toreal(current_bytes) / avg_daily_bytes,
    connection_ratio = toreal(current_connections) / avg_daily_connections
| where bytes_ratio > threshold_multiplier
| extend
    anomaly_description = strcat(
        "Data transfer ",
        round(bytes_ratio, 1), "x above baseline. ",
        "Current: ", current_bytes / 1048576, " MB. ",
        "Baseline avg: ", round(avg_daily_bytes / 1048576, 1), " MB/day."
    )
| project
    InitiatingProcessAccountName, DeviceName,
    current_bytes, avg_daily_bytes, bytes_ratio,
    current_connections, anomaly_description, dest_ips
| order by bytes_ratio desc

-- DCSync / LSASS Access | Maps to: MITRE T1003 (OS Credential Dumping)

DeviceProcessEvents
| where TimeGenerated > ago(1h)
| where (FileName =~ "mimikatz.exe"
    or ProcessCommandLine has_any ("sekurlsa", "lsadump", "dcsync", "kerberoast")
    or (FileName =~ "procdump.exe" and ProcessCommandLine has "lsass")
    or (FileName =~ "taskmgr.exe" and ProcessCommandLine has "lsass"))
| project TimeGenerated, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName
| extend Severity = "CRITICAL",
         MITRE_Technique = "T1003 - OS Credential Dumping",
         Recommended_Action = "Isolate endpoint immediately. Assume credential compromise."

let business_hours_start = 6;  // 6 AM local
let business_hours_end = 20;   // 8 PM local
let cui_servers = dynamic(["CUIFILESVR01", "CUIFILESVR02", "SHAREPOINT-CUI"]);

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where hourofday(TimeGenerated) < business_hours_start or hourofday(TimeGenerated) > business_hours_end
| where RemoteDeviceName in~ (cui_servers) or RemoteUrl has_any (cui_servers)
| summarize
    access_count = count(),
    access_times = make_list(TimeGenerated),
    files_accessed = make_set(RemoteUrl)
  by InitiatingProcessAccountName, DeviceName
| where access_count > 10  // More than 10 after-hours accesses
| extend Alert = "Unusual after-hours CUI access volume — potential insider threat indicator"

# threat_hunt_report_generator.py

def generate_monthly_threat_hunt_report(
    sentinel_findings: dict,
    period: str,
    organization: str
) -> str:
    """Generate a monthly threat hunt report from Sentinel analytics results."""

    findings_json = json.dumps(sentinel_findings, indent=2, default=str)

    hunt_report_prompt = f"""Generate a monthly Threat Hunt Report for {organization} for {period}.

SENTINEL FINDINGS DATA:
{findings_json[:5000]}

Generate the report in the following format:

## THREAT HUNT REPORT
**Organization:** {organization}
**Period:** {period}
**Classification:** CUI // [PROCURE or INTEL as appropriate]
**Prepared by:** Security Operations Center (AI-Assisted)
**Requires Review by:** ISSM before distribution

### EXECUTIVE SUMMARY
- Overall security posture assessment for the period
- Number of incidents investigated: [from data]
- Number of true positives confirmed: [from data]
- Number of high/critical priority events: [from data]
- Key findings for leadership attention (3 bullets max)

### THREAT LANDSCAPE
- Active threat actors targeting the defense industrial base this period
  (Reference publicly available CISA and NSA advisories)
- Most relevant TTPs observed or threatened in the sector
- Relevance to this organization's attack surface

### HUNTING FINDINGS BY TACTIC (MITRE ATT&CK)
For each MITRE tactic with findings this period:
- Tactic name and description
- Events investigated
- True positives confirmed (if any)
- Analyst assessment

### BEHAVIORAL ANOMALIES INVESTIGATED
Summary of user and system behavioral anomalies investigated:
- High-risk users reviewed
- Systems showing unusual patterns
- Disposition of each investigation (Closed — False Positive / Active — Under Investigation / Escalated)

### VULNERABILITIES CORRELATED WITH ACTIVE THREATS
- CISA KEV vulnerabilities present on in-scope assets
- CVEs targeted by active threat campaigns affecting DIB sector
- Remediation status of each

### RECOMMENDATIONS
- Immediate actions (this month)
- Improvement actions (next 90 days)
- CMMC control gaps identified through hunting activities

### METRICS DASHBOARD
| Metric | Value | Trend |
|--------|-------|-------|
| Total alerts generated | [N] | ↑↓→ |
| Alerts requiring investigation | [N] | ↑↓→ |
| Mean time to detect (MTTD) | [hrs] | ↑↓→ |
| Mean time to respond (MTTR) | [hrs] | ↑↓→ |
| False positive rate | [%] | ↑↓→ |
| CMMC incidents reportable | [N] | ↑↓→ |

[DRAFT — AI GENERATED — REQUIRES ISSM REVIEW AND APPROVAL BEFORE DISTRIBUTION]"""

    response = openai_client.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        messages=[
            {"role": "system", "content": "You are a senior threat intelligence and hunt analyst producing monthly security reports for defense contractor leadership. Write with precision, avoid speculation, and clearly distinguish between confirmed findings and analyst assessments."},
            {"role": "user", "content": hunt_report_prompt}
        ],
        temperature=0.1,
        max_tokens=4000
    )

    return response.choices[0].message.content

SYSTEM PROMPT:
You are a CMMC compliance specialist evaluating a security incident for reportability.

Evaluate this incident against:
1. DFARS 252.204-7012 — requires reporting to DoD within 72 hours of discovery of a
   cyber incident affecting CUI or covered defense information
2. CMMC Practice IR.L2-3.6.1 — requires incident handling capability
3. NIST SP 800-171 requirement 3.6.1 — establish an operational incident-handling capability

INCIDENT DETAILS:
{incident_details}

DETERMINE:
1. Is this a "cyber incident" as defined by DFARS 252.204-7012? (Yes/No/Uncertain)
   - Rationale with specific reference to the DFARS definition
2. Was CUI or covered defense information involved? (Yes/No/Unknown)
   - If Unknown: what investigation steps are needed to determine this?
3. DoD reporting required? (Yes — within 72 hours / No / Undetermined)
   - If Yes: Report to DIBNet portal (dibnet.dod.mil)
4. Malware analysis submission required? (Yes/No)
   - If Yes: Submit malware samples to DoD Cyber Crime Center (DC3)
5. Contracting Officer notification required? (Yes/No)
6. eMASS or other system-of-record update required? (Yes/No)

TIMELINE:
[Event X hours ago] — [describe timeline from detection to now]
[Hours remaining to 72-hour reporting deadline if applicable]

RECOMMENDED IMMEDIATE ACTIONS:
[Specific compliance actions with deadlines]

NOTE: This is an AI-assisted assessment. The ISSM and legal counsel must make
the final reporting determination. When in doubt, report.