Migrate Windows Server DNS (3.2.2) to Defender XDR Custom Detections

Solutions/Windows Server DNS/Data/Solution_DNS.json

@@ -29,11 +29,19 @@
     "Hunting Queries/Solorigate-Encoded-Domain-URL.yaml"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Windows Server DNS",
-  "Version": "3.0.1",
+  "Version": "3.2.2",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
     "ASimDnsActivityLogs",
     "DNS"
+  ],
+  "XDR Workbooks": [],
+  "XDR Detections": [
+    "XDR Detections/DNS_HighNXDomainCount_detection.yaml",
+    "XDR Detections/DNS_HighReverseDNSCount_detection.yaml",
+    "XDR Detections/DNS_Miners.yaml",
+    "XDR Detections/DNS_TorProxies.yaml",
+    "XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml"
   ]
 }

Solutions/Windows Server DNS/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/DNS.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Windows%20Server%20DNS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n<P style=\"color:red\">**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 5, **Hunting Queries:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/DNS.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Windows%20Server%20DNS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n<P style=\"color:red\">**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 5, **XDR Detections:** 5, **Hunting Queries:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -51,6 +51,47 @@
       }
     ],
     "steps": [
+      {
+        "name": "contentSelection",
+        "label": "Content selection",
+        "elements": [
+          {
+            "name": "DeployAnalyticsRule",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployAnalyticsRule",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+          },
+          {
+            "name": "DeployWorkbook",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployWorkbook",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+          },
+          {
+            "name": "DeployDataConnector",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployDataConnector",
+            "defaultValue": true,
+            "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
+          },
+          {
+            "name": "DeployCustomDetection",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployCustomDetection",
+            "defaultValue": false,
+            "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch."
+          },
+          {
+            "name": "DeployHuntingQuery",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployHuntingQuery",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
+          }
+        ]
+      },
       {
         "name": "dataconnectors",
         "label": "Data Connectors",
@@ -60,28 +101,14 @@
             "name": "dataconnectors1-text",
             "type": "Microsoft.Common.TextBlock",
             "options": {
-              "text": "Installing this solution will deploy two data connectors,"
+              "text": "This Solution installs the data connector for Windows Server DNS. You can get Windows Server DNS custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
             }
           },
           {
             "name": "dataconnectors2-text",
             "type": "Microsoft.Common.TextBlock",
             "options": {
-              "text": "1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here (https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector."
-            }
-          },
-          {
-            "name": "dataconnectors3-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent."
-            }
-          },
-          {
-            "name": "dataconnectors4-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "NOTE: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported."
+              "text": "This Solution installs the data connector for Windows Server DNS. You can get Windows Server DNS custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
             }
           },
           {
@@ -173,7 +200,7 @@
                 "name": "analytic1-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with\nNXDomain records in the prior 10-day baseline period)."
+                  "text": "Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period)."
                 }
               }
             ]
@@ -390,7 +417,12 @@
     "outputs": {
       "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
       "location": "[location()]",
-      "workspace": "[basics('workspace')]"
+      "workspace": "[basics('workspace')]",
+      "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]",
+      "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]",
+      "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]",
+      "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]",
+      "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]"
     }
   }
 }