{"id":19388,"date":"2024-12-26T07:00:00","date_gmt":"2024-12-26T10:00:00","guid":{"rendered":"https:\/\/darkorchid-wallaby-287256.hostingersite.com\/?p=19388"},"modified":"2024-12-23T14:24:51","modified_gmt":"2024-12-23T17:24:51","slug":"kql-migrator-com-tecnologia-microsoft-security-copilot","status":"publish","type":"post","link":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/","title":{"rendered":"KQL Migrator com tecnologia Microsoft Security Copilot"},"content":{"rendered":"<span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\">Tempo de leitura:<\/span> <span class=\"rt-time\"> 13<\/span> <span class=\"rt-label rt-postfix\">minutos<\/span><\/span>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"307\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/0-Criador-de-Imagem-do-Cabecalho-Blog-DataEX-16-1024x307.png\" alt=\"\" class=\"wp-image-19389\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/0-Criador-de-Imagem-do-Cabecalho-Blog-DataEX-16-980x294.png 980w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/0-Criador-de-Imagem-do-Cabecalho-Blog-DataEX-16-480x144.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) 1024px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador que requer planejamento meticuloso e uma compreens\u00e3o completa da configura\u00e7\u00e3o existente no SIEM herdado e do que precisa ser migrado para o SIEM moderno. Nosso principal ponto de discuss\u00e3o foi como podemos ajudar as organiza\u00e7\u00f5es a traduzir com efici\u00eancia as regras de detec\u00e7\u00e3o de linguagens baseadas em consultas, como AQL (Ariel Query Languages) para KQL (Kusto Query Language) e ajudar as organiza\u00e7\u00f5es, principalmente as equipes de SOC, a converter suas regras YARA, STIX II e OpenIOC intel para o formato KQL<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Foram identificadas duas op\u00e7\u00f5es:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Converter AQL para KQL;<\/li>\n\n\n\n<li>Converter YARA para KQL;<\/li>\n\n\n\n<li>Converta STIX II e OpenIOC intel para KQL.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ambas as op\u00e7\u00f5es exigem habilidades especializadas e podem ser complicadas de concluir. Em primeiro lugar, o usu\u00e1rio precisaria entender precisamente como o AQL \u00e9 mapeado para KQL e, em segundo lugar, exigir o conhecimento da sintaxe usada na gera\u00e7\u00e3o do YARA. Ambas s\u00e3o habilidades de nicho.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"leia-mais-linkedin\">Foi percebido que o AQL \u00e9 semelhante ao SQL e, consequentemente, ao KQL.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Temos o seguinte c\u00f3digo AQL:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Select sourceip, destinationip, &#8220;Process Name&#8221; FROM events WHERE &#8220;Process Name&#8221; IMATCHES &#8216;.*atbroker\\.exe.*|.*bash\\.exe.*|.*bitsadmin\\.exe.*|.*certutil\\.exe.*|.*cmdkey\\.exe.*|.*cmstp\\.exe.*|.*control\\.exe.*|.*csc\\.exe.*|.*cscript\\.exe.*|.*dfsvc\\.exe.*|.*diskshadow\\.exe.*|.*dnscmd\\.exe.*|.*esentutl\\.exe.*|.*eventvwr\\.exe.*|.*expand\\.exe.*|.*extexport\\.exe.*|.*extrac32\\.exe.*|.*findstr\\.exe.*|.*forfiles\\.exe.*|.*ftp\\.exe.*|.*gpscript\\.exe.*|.*hh\\.exe.*|.*ie4uinit\\.exe.*|.*ieexec\\.exe.*|.*infdefaultinstall\\.exe.*|.*installutil\\.exe.*|.*makecab\\.exe.*|.*reg\\.exe.*|.*print\\.exe.*|.*presentationhost\\.exe.*|.*pcwrun\\.exe.*|.*pcalua\\.exe.*|.*odbcconf\\.exe.*|.*msiexec\\.exe.*|.*mshta\\.exe.*|.*msdt\\.exe.*|.*msconfig\\.exe.*|.*msbuild\\.exe.*|.*mmc\\.exe.*|.*microsoft.workflow.compiler\\.exe.*|.*mavinject\\.exe.*|.*vsjitdebugger\\.exe.*|.*tracker\\.exe.*|.*te\\.exe.*|.*sqltoolsps\\.exe.*|.*sqlps\\.exe.*|.*sqldumper\\.exe.*|.*rcsi\\.exe.*|.*msxsl\\.exe.*|.*msdeploy\\.exe.*|.*mftrace\\.exe.*|.*dxcap\\.exe.*|.*dnx\\.exe.*|.*csi\\.exe.*|.*cdb\\.exe.*|.*bginfo\\.exe.*|.*appvlp\\.exe.*|.*xwizard\\.exe.*|.*wsreset\\.exe.*|.*wscript\\.exe.*|.*wmic\\.exe.*|.*wab\\.exe.*|.*verclsid\\.exe.*|.*syncappvpublishingserver\\.exe.*|.*scriptrunner\\.exe.*|.*schtasks\\.exe.*|.*sc\\.exe.*|.*runscripthelper\\.exe.*|.*runonce\\.exe.*|.*rundll32\\.exe.*|.*rpcping\\.exe.*|.*replace\\.exe.*|.*regsvr32\\.exe.*|.*regsvcs\\.exe.*|.*register-cimprovider\\.exe.*|.*regedit\\.exe.*|.*regasm\\.exe.*|&#8217; GROUP BY &#8220;Process Name&#8221;,sourceip LAST 3 DAYS<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Essa consulta tem como objetivo rastrear o uso de execut\u00e1veis espec\u00edficos para atividades administrativas ou potencialmente mal-intencionadas. Ao agrupar os resultados por nome do processo e IP de origem, ele ajuda a detectar padr\u00f5es ou anomalias que podem indicar incidentes de seguran\u00e7a ou viola\u00e7\u00f5es de pol\u00edtica.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Usando o Microsoft Security Copilot<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">E se pud\u00e9ssemos fazer com que o Security Copilot primeiro explicasse o c\u00f3digo e depois o convertesse em Kusto?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Usamos o seguinte prompt:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\/askGPT I am planning a SIEM migration from AQL query based to Microsoft Sentinel KQL. As AQL expert can you create a detailed summary that explains the following AQL query in square brackets [ Select sourceip, destinationip, &#8220;Process Name&#8221; FROM events WHERE &#8220;Process Name&#8221; IMATCHES &#8216;.*atbroker\\.exe.*|.*bash\\.exe.*|.*bitsadmin\\.exe.*|.*certutil\\.exe.*|.*cmdkey\\.exe.*|.*cmstp\\.exe.*|.*control\\.exe.*|.*csc\\.exe.*|.*cscript\\.exe.*|.*dfsvc\\.exe.*|.*diskshadow\\.exe.*|.*dnscmd\\.exe.*|.*esentutl\\.exe.*|.*eventvwr\\.exe.*|.*expand\\.exe.*|.*extexport\\.exe.*|.*extrac32\\.exe.*|.*findstr\\.exe.*|.*forfiles\\.exe.*|.*ftp\\.exe.*|.*gpscript\\.exe.*|.*hh\\.exe.*|.*ie4uinit\\.exe.*|.*ieexec\\.exe.*|.*infdefaultinstall\\.exe.*|.*installutil\\.exe.*|.*makecab\\.exe.*|.*reg\\.exe.*|.*print\\.exe.*|.*presentationhost\\.exe.*|.*pcwrun\\.exe.*|.*pcalua\\.exe.*|.*odbcconf\\.exe.*|.*msiexec\\.exe.*|.*mshta\\.exe.*|.*msdt\\.exe.*|.*msconfig\\.exe.*|.*msbuild\\.exe.*|.*mmc\\.exe.*|.*microsoft.workflow.compiler\\.exe.*|.*mavinject\\.exe.*|.*vsjitdebugger\\.exe.*|.*tracker\\.exe.*|.*te\\.exe.*|.*sqltoolsps\\.exe.*|.*sqlps\\.exe.*|.*sqldumper\\.exe.*|.*rcsi\\.exe.*|.*msxsl\\.exe.*|.*msdeploy\\.exe.*|.*mftrace\\.exe.*|.*dxcap\\.exe.*|.*dnx\\.exe.*|.*csi\\.exe.*|.*cdb\\.exe.*|.*bginfo\\.exe.*|.*appvlp\\.exe.*|.*xwizard\\.exe.*|.*wsreset\\.exe.*|.*wscript\\.exe.*|.*wmic\\.exe.*|.*wab\\.exe.*|.*verclsid\\.exe.*|.*syncappvpublishingserver\\.exe.*|.*scriptrunner\\.exe.*|.*schtasks\\.exe.*|.*sc\\.exe.*|.*runscripthelper\\.exe.*|.*runonce\\.exe.*|.*rundll32\\.exe.*|.*rpcping\\.exe.*|.*replace\\.exe.*|.*regsvr32\\.exe.*|.*regsvcs\\.exe.*|.*register-cimprovider\\.exe.*|.*regedit\\.exe.*|.*regasm\\.exe.*|&#8217; GROUP BY &#8220;Process Name&#8221;,sourceip LAST 3 DAYS]<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Abaixo est\u00e1 o OUTPUT<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Resumo detalhado do detalhamento da consulta AQL<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Vis\u00e3o geral da consulta<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A consulta AQL fornecida foi projetada para pesquisar nomes de processos espec\u00edficos em logs de eventos e retornar os endere\u00e7os IP de origem e destino associados a esses processos. Aqui est\u00e1 um detalhamento da consulta:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Detalhamento da consulta AQL<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Selecione a cl\u00e1usula<\/strong>:<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>sourceip: o endere\u00e7o IP de origem do qual o evento se originou.<\/li>\n\n\n\n<li>destinationip: o endere\u00e7o IP de destino para o qual o evento foi direcionado.<\/li>\n\n\n\n<li>&#8220;Nome do processo&#8221;: O nome do processo envolvido no evento.<\/li>\n\n\n\n<li><strong>Da cl\u00e1usula<\/strong>:<\/li>\n\n\n\n<li>events: o conjunto de dados ou tabela do qual a consulta est\u00e1 recuperando dados.<\/li>\n\n\n\n<li><strong>Cl\u00e1usula Where<\/strong>:<\/li>\n\n\n\n<li>&#8220;Nome do processo&#8221; IMATCHES &#8216;.*atbroker\\.exe.*|. *bash\\.exe.*|. *bitsadmin\\.exe.*|. *certutil\\.exe.*|. *cmdkey\\.exe.*|. *cmstp\\.exe.*|. *controle\\.exe.*|. *csc\\.exe.*|. *cscript\\.exe.*|. *dfsvc\\.exe.*|. *diskshadow\\.exe.*|. *dnscmd\\.exe.*|. *esentutl\\.exe.*|. *eventvwr\\.exe.*|. *expandir\\.exe.*|. *extexport\\.exe.*|. *extrac32\\.exe.*|. *findstr\\.exe.*|. *paraarquivos\\.exe.*|. *ftp\\.exe.*|. *gpscript\\.exe.*|. *hh\\.exe.*|. *ie4uinit\\.exe.*|. *ieexec\\.exe.*|. *infdefaultinstall\\.exe.*|. *installutil\\.exe.*|. * makecab \\ .exe.* |. *reg\\.exe.*|. *impress\u00e3o\\.exe.*|. *PresentationHost\\.exe.*|. *pcwrun\\.exe.*|. *pcalua\\.exe.*|. *odbcconf\\.exe.*|. *msiexec\\.exe.*|. *mshta\\.exe.*|. *msdt\\.exe.*|. *msconfig\\.exe.*|. *msbuild\\.exe.*|. *mmc\\.exe.*|. *Microsoft.Workflow.Compiler\\.exe.*|. *mavinject\\.exe.*|. *vsjitdebugger\\.exe.*|. *rastreador\\.exe.*|. *te\\.exe.*|. *SQLTocessps\\.exe.*|. *sqlps\\.exe.*|. *sqldumper\\.exe.*|. *rcsi\\.exe.*|. *msxsl\\.exe.*|. *msdeploy\\.exe.*|. *mftrace\\.exe.*|. *dxcap\\.exe.*|. *dnx\\.exe.*|. *csi\\.exe.*|. *cdb\\.exe.*|. *bginfo\\.exe.*|. *appvlp\\.exe.*|. *xwizard\\.exe.*|. *wsreset\\.exe.*|. *wscript\\.exe.*|. *wmic\\.exe.*|. * wab \\ .exe. * |. *verclsid\\.exe.*|. *syncappvpublishingserver\\.exe.*|. *roteirista\\.exe.*|. *schtasks\\.exe.*|. *sc\\.exe.*|. *runscripthelper\\.exe.*|. *runonce\\.exe.*|. *rundll32\\.exe.*|. *rpcping\\.exe.*|. *substituir\\.exe.*|. *regsvr32\\.exe.*|. *regsvcs\\.exe.*|. *register-cimprovider\\.exe.*|. *regedit\\.exe.*|. *regasm\\.exe.*&#8217;: essa condi\u00e7\u00e3o filtra eventos para incluir apenas aqueles em que o nome do processo corresponde a qualquer um dos padr\u00f5es especificados. O operador IMATCHES \u00e9 usado para correspond\u00eancia de express\u00f5es regulares que n\u00e3o diferenciam mai\u00fasculas de min\u00fasculas.<\/li>\n\n\n\n<li><strong>Agrupar por cl\u00e1usula<\/strong>:<\/li>\n\n\n\n<li>&#8220;Nome do processo&#8221;, sourceip: Os resultados s\u00e3o agrupados pelo nome do processo e endere\u00e7o IP de origem.<\/li>\n\n\n\n<li><strong>Intervalo de tempo<\/strong>:<\/li>\n\n\n\n<li>\u00daLTIMOS 3 DIAS: A consulta \u00e9 limitada a eventos que ocorreram nos \u00faltimos tr\u00eas dias.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Resumo<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Essa consulta AQL foi projetada para identificar e agrupar eventos com base em nomes de processos espec\u00edficos que geralmente est\u00e3o associados a atividades suspeitas ou mal-intencionadas. Ao se concentrar nesses processos, a consulta ajuda a monitorar e investigar poss\u00edveis incidentes de seguran\u00e7a. Os resultados fornecem informa\u00e7\u00f5es sobre os endere\u00e7os IP de origem e destino envolvidos, o que pode ser crucial para uma an\u00e1lise e resposta adicionais.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A consulta retorna o nome do processo, o IP de origem e o IP de destino para eventos que correspondem aos nomes de processo especificados, agrupados por nome de processo e IP de origem, nos \u00faltimos tr\u00eas dias.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;Esta pr\u00f3xima etapa para ver se o Security Copilot pode ajudar a converter o AQL em algo mapeado para a Linguagem de Consulta Kusto do Microsoft Sentinel:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea pode analisar a consulta AQL acima e mape\u00e1-la para KQL, \u00e9 importante garantir que o mapeamento se correlacione diretamente com o esquema em KQL. Voc\u00ea tamb\u00e9m pode mostrar a sa\u00edda da consulta em uma tabela. Apresente os mapeamentos em uma tabela:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">&nbsp;Consulta e sa\u00edda KQL<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Mapeamento de consulta KQL<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DeviceProcessEvents | where TimeGenerated &gt;= ago(3d) | where InitiatingProcessFileName matches regex @'(?i).*atbroker\\.exe.*|.*bash\\.exe.*|.*bitsadmin\\.exe.*|.*certutil\\.exe.*|.*cmdkey\\.exe.*|.*cmstp\\.exe.*|.*control\\.exe.*|.*csc\\.exe.*|.*cscript\\.exe.*|.*dfsvc\\.exe.*|.*diskshadow\\.exe.*|.*dnscmd\\.exe.*|.*esentutl\\.exe.*|.*eventvwr\\.exe.*|.*expand\\.exe.*|.*extexport\\.exe.*|.*extrac32\\.exe.*|.*findstr\\.exe.*|.*forfiles\\.exe.*|.*ftp\\.exe.*|.*gpscript\\.exe.*|.*hh\\.exe.*|.*ie4uinit\\.exe.*|.*ieexec\\.exe.*|.*infdefaultinstall\\.exe.*|.*installutil\\.exe.*|.*makecab\\.exe.*|.*reg\\.exe.*|.*print\\.exe.*|.*presentationhost\\.exe.*|.*pcwrun\\.exe.*|.*pcalua\\.exe.*|.*odbcconf\\.exe.*|.*msiexec\\.exe.*|.*mshta\\.exe.*|.*msdt\\.exe.*|.*msconfig\\.exe.*|.*msbuild\\.exe.*|.*mmc\\.exe.*|.*microsoft.workflow.compiler\\.exe.*|.*mavinject\\.exe.*|.*vsjitdebugger\\.exe.*|.*tracker\\.exe.*|.*te\\.exe.*|.*sqltoolsps\\.exe.*|.*sqlps\\.exe.*|.*sqldumper\\.exe.*|.*rcsi\\.exe.*|.*msxsl\\.exe.*|.*msdeploy\\.exe.*|.*mftrace\\.exe.*|.*dxcap\\.exe.*|.*dnx\\.exe.*|.*csi\\.exe.*|.*cdb\\.exe.*|.*bginfo\\.exe.*|.*appvlp\\.exe.*|.*xwizard\\.exe.*|.*wsreset\\.exe.*|.*wscript\\.exe.*|.*wmic\\.exe.*|.*wab\\.exe.*|.*verclsid\\.exe.*|.*syncappvpublishingserver\\.exe.*|.*scriptrunner\\.exe.*|.*schtasks\\.exe.*|.*sc\\.exe.*|.*runscripthelper\\.exe.*|.*runonce\\.exe.*|.*rundll32\\.exe.*|.*rpcping\\.exe.*|.*replace\\.exe.*|.*regsvr32\\.exe.*|.*regsvcs\\.exe.*|.*register-cimprovider\\.exe.*|.*regedit\\.exe.*|.*regasm\\.exe.*&#8217; | summarize by InitiatingProcessFileName<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sa\u00edda da consulta<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td>IniciandoNome_do_Arquivo_do_Processo<\/td><\/tr><\/thead><tbody><tr><td>csc.exe<\/td><\/tr><tr><td>gpupdate.exe<\/td><\/tr><tr><td>microsoftedgeupdate.exe<\/td><\/tr><tr><td>msiexec.exe<\/td><\/tr><tr><td>schtasks.exe<\/td><\/tr><tr><td>sc.exe<\/td><\/tr><tr><td>cscript.exe<\/td><\/tr><tr><td>rundll32.exe<\/td><\/tr><tr><td>makecab.exe<\/td><\/tr><tr><td>route.exe<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Contagens de linhas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Total de linhas:<\/strong>\u00a010<\/li>\n\n\n\n<li><strong>Linhas exibidas:<\/strong>\u00a010<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Nome do produto<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Produto:<\/strong>\u00a0Sentinela<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"548\" height=\"491\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-1-8.png\" alt=\"\" class=\"wp-image-19390\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-1-8.png 548w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-1-8-480x430.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 548px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea pode baixar o seguinte no reposit\u00f3rio oficial do Github do Microsoft Security Copilot, obrigado&nbsp;<a href=\"https:\/\/techcommunity.microsoft.com\/users\/sean_wasonga\/394990\">Sean_Wasonga<\/a>&nbsp;por dar suporte ao pacote de implanta\u00e7\u00e3o automatizada.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Arquivo de c\u00f3digo do aplicativo l\u00f3gico do Azure do migrador KQL:\u00a0<a href=\"https:\/\/github.com\/Azure\/Security-Copilot\/pull\/155\" target=\"_blank\" rel=\"noreferrer noopener\">clique aqui<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">o Certifique-se de substituir o seguinte pelas informa\u00e7\u00f5es corretas do seu inquilino:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>&lt;ID da assinatura><\/li>\n\n\n\n<li>&lt;Nome do Grupo de Recursos><\/li>\n\n\n\n<li>Exemplos de consultas AQL \/ regras YARA:\u00a0<a href=\"https:\/\/github.com\/Azure\/Security-Copilot\/pull\/155\" target=\"_blank\" rel=\"noreferrer noopener\">Clique aqui<\/a><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"277\" height=\"500\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-2-7.png\" alt=\"\" class=\"wp-image-19391\" srcset=\"https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-2-7.png 277w, https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-2-7-166x300.png 166w, https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-2-7-7x12.png 7w\" sizes=\"(max-width: 277px) 100vw, 277px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"648\" height=\"493\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-3-5.png\" alt=\"\" class=\"wp-image-19392\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-3-5.png 648w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-3-5-480x365.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 648px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A equipe destacou a import\u00e2ncia de considerar as regras da YARA para uniformidade. Dado que faltava experi\u00eancia na gera\u00e7\u00e3o de regras YARA, o Security Copilot consultou novamente:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<strong>\/askGPT Can you explain what a YAYA rule is with an example<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Uma regra YARA \u00e9 um tipo de regra usada em seguran\u00e7a cibern\u00e9tica para identificar e classificar amostras de malware. YARA, que significa &#8220;Yet Another Recursive Acronym&#8221;, \u00e9 uma ferramenta destinada a ajudar os pesquisadores de malware a identificar e classificar malware. As regras YARA s\u00e3o escritas em uma sintaxe espec\u00edfica e s\u00e3o usadas para descrever padr\u00f5es que podem ser encontrados em arquivos ou processos.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exemplo de uma regra YARA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aqui est\u00e1 um exemplo simples de uma regra YARA que detecta um arquivo que cont\u00e9m a cadeia de caracteres &#8220;malicioso&#8221;:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exemplo de regraRegra<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">{<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;&nbsp;&nbsp; meta:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">description = &#8220;Esta regra detecta arquivos contendo a string &#8216;maliciosa'&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">autor = &#8220;Pesquisador de Seguran\u00e7a&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">data = &#8220;2024-12-09&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Strings:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">$malicious_string = &#8220;malicioso&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">condi\u00e7\u00e3o:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $malicious_string<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Portanto, temos uma compreens\u00e3o b\u00e1sica do que \u00e9 uma regra YARA e seu formato t\u00edpico. A etapa \u00e9 que podemos usar o Security Copilot para converter o YARA em uma regra KQL:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Usamos o seguinte prompt:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>As a YARA rule expert, can you take the above KQL query generated and create a KQL rule? rule Suspicious_Process_Execution { meta: description = &#8220;Detects execution of potentially suspicious processes&#8221; author = &#8220;Security Analyst&#8221; date = &#8220;2023-10-01&#8221; strings: $atbroker = \/(?i).*atbroker\\.exe.*\/ $bash = \/(?i).*bash\\.exe.*\/ $bitsadmin = \/(?i).*bitsadmin\\.exe.*\/ $certutil = \/(?i).*certutil\\.exe.*\/ $cmdkey = \/(?i).*cmdkey\\.exe.*\/ $cmstp = \/(?i).*cmstp\\.exe.*\/ $control = \/(?i).*control\\.exe.*\/ $csc = \/(?i).*csc\\.exe.*\/ $cscript = \/(?i).*cscript\\.exe.*\/ $dfsvc = \/(?i).*dfsvc\\.exe.*\/ $diskshadow = \/(?i).*diskshadow\\.exe.*\/ $dnscmd = \/(?i).*dnscmd\\.exe.*\/ $esentutl = \/(?i).*esentutl\\.exe.*\/ $eventvwr = \/(?i).*eventvwr\\.exe.*\/ $expand = \/(?i).*expand\\.exe.*\/ $extexport = \/(?i).*extexport\\.exe.*\/ $extrac32 = \/(?i).*extrac32\\.exe.*\/ $findstr = \/(?i).*findstr\\.exe.*\/ $forfiles = \/(?i).*forfiles\\.exe.*\/ $ftp = \/(?i).*ftp\\.exe.*\/ $gpscript = \/(?i).*gpscript\\.exe.*\/ $hh = \/(?i).*hh\\.exe.*\/ $ie4uinit = \/(?i).*ie4uinit\\.exe.*\/ $ieexec = \/(?i).*ieexec\\.exe.*\/ $infdefaultinstall = \/(?i).*infdefaultinstall\\.exe.*\/ $installutil = \/(?i).*installutil\\.exe.*\/ $makecab = \/(?i).*makecab\\.exe.*\/ $reg = \/(?i).*reg\\.exe.*\/ $print = \/(?i).*print\\.exe.*\/ $presentationhost = \/(?i).*presentationhost\\.exe.*\/ $pcwrun = \/(?i).*pcwrun\\.exe.*\/ $pcalua = \/(?i).*pcalua\\.exe.*\/ $odbcconf = \/(?i).*odbcconf\\.exe.*\/ $msiexec = \/(?i).*msiexec\\.exe.*\/ $mshta = \/(?i).*mshta\\.exe.*\/ $msdt = \/(?i).*msdt\\.exe.*\/ $msconfig = \/(?i).*msconfig\\.exe.*\/ $msbuild = \/(?i).*msbuild\\.exe.*\/ $mmc = \/(?i).*mmc\\.exe.*\/ $microsoft_workflow_compiler = \/(?i).*microsoft\\.workflow\\.compiler\\.exe.*\/ $mavinject = \/(?i).*mavinject\\.exe.*\/ $vsjitdebugger = \/(?i).*vsjitdebugger\\.exe.*\/ $tracker = \/(?i).*tracker\\.exe.*\/ $te = \/(?i).*te\\.exe.*\/ $sqltoolsps = \/(?i).*sqltoolsps\\.exe.*\/ $sqlps = \/(?i).*sqlps\\.exe.*\/ $sqldumper = \/(?i).*sqldumper\\.exe.*\/ $rcsi = \/(?i).*rcsi\\.exe.*\/ $msxsl = \/(?i).*msxsl\\.exe.*\/ $msdeploy = \/(?i).*msdeploy\\.exe.*\/ $mftrace = \/(?i).*mftrace\\.exe.*\/ $dxcap = \/(?i).*dxcap\\.exe.*\/ $dnx = \/(?i).*dnx\\.exe.*\/ $csi = \/(?i).*csi\\.exe.*\/ $cdb = \/(?i).*cdb\\.exe.*\/ $bginfo = \/(?i).*bginfo\\.exe.*\/ $appvlp = \/(?i).*appvlp\\.exe.*\/ $xwizard = \/(?i).*xwizard\\.exe.*\/ $wsreset = \/(?i).*wsreset\\.exe.*\/ $wscript = \/(?i).*wscript\\.exe.*\/ $wmic = \/(?i).*wmic\\.exe.*\/ $wab = \/(?i).*wab\\.exe.*\/ $verclsid = \/(?i).*verclsid\\.exe.*\/ $syncappvpublishingserver = \/(?i).*syncappvpublishingserver\\.exe.*\/ $scriptrunner = \/(?i).*scriptrunner\\.exe.*\/ $schtasks = \/(?i).*schtasks\\.exe.*\/ $sc = \/(?i).*sc\\.exe.*\/ $runscripthelper = \/(?i).*runscripthelper\\.exe.*\/ $runonce = \/(?i).*runonce\\.exe.*\/ $rundll32 = \/(?i).*rundll32\\.exe.*\/ $rpcping = \/(?i).*rpcping\\.exe.*\/ $replace = \/(?i).*replace\\.exe.*\/ $regsvr32 = \/(?i).*regsvr32\\.exe.*\/ $regsvcs = \/(?i).*regsvcs\\.exe.*\/ $register_cimprovider = \/(?i).*register-cimprovider\\.exe.*\/ $regedit = \/(?i).*regedit\\.exe.*\/ $regasm = \/(?i).*regasm\\.exe.*\/ condition: any of ($atbroker, $bash, $bitsadmin, $certutil, $cmdkey, $cmstp, $control, $csc, $cscript, $dfsvc, $diskshadow, $dnscmd, $esentutl, $eventvwr, $expand, $extexport, $extrac32, $findstr, $forfiles, $ftp, $gpscript, $hh, $ie4uinit, $ieexec, $infdefaultinstall, $installutil, $makecab, $reg, $print, $presentationhost, $pcwrun, $pcalua, $odbcconf, $msiexec, $mshta, $msdt, $msconfig, $msbuild, $mmc, $microsoft_workflow_compiler, $mavinject, $vsjitdebugger, $tracker, $te, $sqltoolsps, $sqlps, $sqldumper, $rcsi, $msxsl, $msdeploy, $mftrace, $dxcap, $dnx, $csi, $cdb, $bginfo, $appvlp, $xwizard, $wsreset, $wscript, $wmic, $wab, $verclsid, $syncappvpublishingserver, $scriptrunner, $schtasks, $sc, $runscripthelper, $runonce, $rundll32, $rpcping, $replace, $regsvr32, $regsvcs, $register_cimprovider, $regedit, $regasm) }<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Regra KQL baseada na regra YARA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>DeviceProcessEvents | where Timestamp &gt;= ago(3d) | where InitiatingProcessFileName matches regex @'(?i).*atbroker\\.exe.*|.*bash\\.exe.*|.*bitsadmin\\.exe.*|.*certutil\\.exe.*|.*cmdkey\\.exe.*|.*cmstp\\.exe.*|.*control\\.exe.*|.*csc\\.exe.*|.*cscript\\.exe.*|.*dfsvc\\.exe.*|.*diskshadow\\.exe.*|.*dnscmd\\.exe.*|.*esentutl\\.exe.*|.*eventvwr\\.exe.*|.*expand\\.exe.*|.*extexport\\.exe.*|.*extrac32\\.exe.*|.*findstr\\.exe.*|.*forfiles\\.exe.*|.*ftp\\.exe.*|.*gpscript\\.exe.*|.*hh\\.exe.*|.*ieuinit\\.exe.*|.*ieexec\\.exe.*|.*infdefaultinstall\\.exe.*|.*installutil\\.exe.*|.*makecab\\.exe.*|.*reg\\.exe.*|.*print\\.exe.*|.*presentationhost\\.exe.*|.*pcwrun\\.exe.*|.*pcalua\\.exe.*|.*odbcconf\\.exe.*|.*msiexec\\.exe.*|.*mshta\\.exe.*|.*msdt\\.exe.*|.*msconfig\\.exe.*|.*msbuild\\.exe.*|.*mmc\\.exe.*|.*microsoft.workflow.compiler\\.exe.*|.*mavinject\\.exe.*|.*vsjitdebugger\\.exe.*|.*tracker\\.exe.*|.*te\\.exe.*|.*sqltoolsps\\.exe.*|.*sqlps\\.exe.*|.*sqldumper\\.exe.*|.*rcsi\\.exe.*|.*msxsl\\.exe.*|.*msdeploy\\.exe.*|.*mftrace\\.exe.*|.*dxcap\\.exe.*|.*dnx\\.exe.*|.*csi\\.exe.*|.*cdb\\.exe.*|.*bginfo\\.exe.*|.*appvlp\\.exe.*|.*xwizard\\.exe.*|.*wsreset\\.exe.*|.*wscript\\.exe.*|.*wmic\\.exe.*|.*wab\\.exe.*|.*verclsid\\.exe.*|.*syncappvpublishingserver\\.exe.*|.*scriptrunner\\.exe.*|.*schtasks\\.exe.*|.*sc\\.exe.*|.*runscripthelper\\.exe.*|.*runonce\\.exe.*|.*rundll32\\.exe.*|.*rpcping\\.exe.*|.*replace\\.exe.*|.*regsvr32\\.exe.*|.*regsvcs\\.exe.*|.*register-cimprovider\\.exe.*|.*regedit\\.exe.*|.*regasm\\.exe.*&#8217; | summarize by InitiatingProcessFileName<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Agora existe um m\u00e9todo para converter com efici\u00eancia uma regra de detec\u00e7\u00e3o de um SIEM herdado em um compat\u00edvel com o Microsoft Sentinel. A pr\u00f3xima etapa \u00e9 entender como um usu\u00e1rio pode implementar isso no Sentinel. \u00c9 importante considerar que o usu\u00e1rio pode precisar se familiarizar com o novo SIEM ou contratar um empreiteiro. Como um empreiteiro n\u00e3o estava dispon\u00edvel, dadas as circunst\u00e2ncias, decidimos perguntar ao Security Copilot:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea pode criar um documento de controle de altera\u00e7\u00f5es que mostre as etapas necess\u00e1rias para criar a regra de detec\u00e7\u00e3o para a consulta KQL gerada acima no sentinel. Inclua tamb\u00e9m o n\u00edvel de acesso necess\u00e1rio para fazer essa altera\u00e7\u00e3o. Certifique-se de que a revers\u00e3o esteja inclu\u00edda.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Documento de controle de altera\u00e7\u00f5es: Criando uma regra de detec\u00e7\u00e3o no Microsoft Sentinel<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Detalhes da solicita\u00e7\u00e3o de altera\u00e7\u00e3o<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ID da solicita\u00e7\u00e3o de altera\u00e7\u00e3o:\u00a0[A ser atribu\u00eddo]<\/li>\n\n\n\n<li>Alterar t\u00edtulo:\u00a0Criar regra de detec\u00e7\u00e3o para execu\u00e7\u00e3o de processo suspeito<\/li>\n\n\n\n<li>Alterar descri\u00e7\u00e3o:\u00a0Implemente uma regra de detec\u00e7\u00e3o no Microsoft Sentinel com base na consulta KQL fornecida para monitorar execu\u00e7\u00f5es de processos suspeitos.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Etapas para implementar a mudan\u00e7a<\/h2>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Fa\u00e7a logon no Portal do Azure:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Navegue at\u00e9 o portal do Azure (<a href=\"https:\/\/portal.azure.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/portal.azure.com<\/a>).<\/li>\n\n\n\n<li>Verifique se voc\u00ea tem as permiss\u00f5es necess\u00e1rias para acessar o Microsoft Sentinel.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Acesse o Microsoft Sentinel:<\/strong>\n<ul class=\"wp-block-list\">\n<li>No portal do Azure, pesquise &#8220;Microsoft Sentinel&#8221; e selecione o workspace apropriado.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Crie uma nova regra do Analytics:<\/strong>\n<ul class=\"wp-block-list\">\n<li>V\u00e1 para a se\u00e7\u00e3o &#8220;An\u00e1lise&#8221; no workspace do Microsoft Sentinel.<\/li>\n\n\n\n<li>Clique em &#8220;Criar&#8221; e selecione &#8220;Regra de consulta agendada&#8221;.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Definir detalhes da regra:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Nome:\u00a0Detec\u00e7\u00e3o de execu\u00e7\u00e3o de processo suspeito<\/li>\n\n\n\n<li>Descri\u00e7\u00e3o:\u00a0Detecta a execu\u00e7\u00e3o de processos potencialmente suspeitos com base na consulta KQL fornecida.<\/li>\n\n\n\n<li>Severidade:\u00a0Alto<\/li>\n\n\n\n<li>T\u00e1ticas:\u00a0Execu\u00e7\u00e3o<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Definir l\u00f3gica de regra:<\/strong><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>DeviceProcessEvents | where TimeGenerated &gt;= ago(3d) | where InitiatingProcessFileName matches regex @'(?i).*atbroker\\.exe.*|.*bash\\.exe.*|.*bitsadmin\\.exe.*|.*certutil\\.exe.*|.*cmdkey\\.exe.*|.*cmstp\\.exe.*|.*control\\.exe.*|.*csc\\.exe.*|.*cscript\\.exe.*|.*dfsvc\\.exe.*|.*diskshadow\\.exe.*|.*dnscmd\\.exe.*|.*esentutl\\.exe.*|.*eventvwr\\.exe.*|.*expand\\.exe.*|.*extexport\\.exe.*|.*extrac32\\.exe.*|.*findstr\\.exe.*|.*forfiles\\.exe.*|.*ftp\\.exe.*|.*gpscript\\.exe.*|.*hh\\.exe.*|.*ie4uinit\\.exe.*|.*ieexec\\.exe.*|.*infdefaultinstall\\.exe.*|.*installutil\\.exe.*|.*makecab\\.exe.*|.*reg\\.exe.*|.*print\\.exe.*|.*presentationhost\\.exe.*|.*pcwrun\\.exe.*|.*pcalua\\.exe.*|.*odbcconf\\.exe.*|.*msiexec\\.exe.*|.*mshta\\.exe.*|.*msdt\\.exe.*|.*msconfig\\.exe.*|.*msbuild\\.exe.*|.*mmc\\.exe.*|.*microsoft.workflow.compiler\\.exe.*|.*mavinject\\.exe.*|.*vsjitdebugger\\.exe.*|.*tracker\\.exe.*|.*te\\.exe.*|.*sqltoolsps\\.exe.*|.*sqlps\\.exe.*|.*sqldumper\\.exe.*|.*rcsi\\.exe.*|.*msxsl\\.exe.*|.*msdeploy\\.exe.*|.*mftrace\\.exe.*|.*dxcap\\.exe.*|.*dnx\\.exe.*|.*csi\\.exe.*|.*cdb\\.exe.*|.*bginfo\\.exe.*|.*appvlp\\.exe.*|.*xwizard\\.exe.*|.*wsreset\\.exe.*|.*wscript\\.exe.*|.*wmic\\.exe.*|.*wab\\.exe.*|.*verclsid\\.exe.*|.*syncappvpublishingserver\\.exe.*|.*scriptrunner\\.exe.*|.*schtasks\\.exe.*|.*sc\\.exe.*|.*runscripthelper\\.exe.*|.*runonce\\.exe.*|.*rundll32\\.exe.*|.*rpcping\\.exe.*|.*replace\\.exe.*|.*regsvr32\\.exe.*|.*regsvcs\\.exe.*|.*register-cimprovider\\.exe.*|.*regedit\\.exe.*|.*regasm\\.exe.*&#8217; | summarize by InitiatingProcessFileName<\/strong><\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Frequ\u00eancia de consulta:\u00a05 minutos<\/li>\n\n\n\n<li>Per\u00edodo de consulta:\u00a03 dias<\/li>\n\n\n\n<li><strong>Definir detalhes do alerta:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Nome da regra de alerta:\u00a0Execu\u00e7\u00e3o de processo suspeito detectada<\/li>\n\n\n\n<li>Descri\u00e7\u00e3o:\u00a0Alerta quando uma execu\u00e7\u00e3o de processo suspeita \u00e9 detectada.<\/li>\n\n\n\n<li>Severidade:\u00a0Alto<\/li>\n\n\n\n<li>T\u00e1ticas:\u00a0Execu\u00e7\u00e3o<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configurar resposta automatizada (opcional):<\/strong>\n<ul class=\"wp-block-list\">\n<li>Adicione guias estrat\u00e9gicos ou respostas automatizadas, se necess\u00e1rio.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Revise e crie:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Revise a configura\u00e7\u00e3o da regra.<\/li>\n\n\n\n<li>Clique em &#8220;Criar&#8221; para salvar e ativar a regra.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>N\u00edvel de acesso necess\u00e1rio<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Papel:\u00a0Administrador de seguran\u00e7a ou colaborador do Sentinel<\/li>\n\n\n\n<li>Permiss\u00f5es:\n<ul class=\"wp-block-list\">\n<li>Acesso de leitura e grava\u00e7\u00e3o ao Microsoft Sentinel<\/li>\n\n\n\n<li>Capacidade de criar e gerenciar regras de an\u00e1lise<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Plano de revers\u00e3o<\/h2>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Fa\u00e7a logon no Portal do Azure:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Navegue at\u00e9 o portal do Azure (<a href=\"https:\/\/portal.azure.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/portal.azure.com<\/a>).<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Acesse o Microsoft Sentinel:<\/strong>\n<ul class=\"wp-block-list\">\n<li>No portal do Azure, pesquise &#8220;Microsoft Sentinel&#8221; e selecione o workspace apropriado.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Exclua a regra do Analytics:<\/strong>\n<ul class=\"wp-block-list\">\n<li>V\u00e1 para a se\u00e7\u00e3o &#8220;An\u00e1lise&#8221; no workspace do Microsoft Sentinel.<\/li>\n\n\n\n<li>Localize a regra &#8220;Detec\u00e7\u00e3o de Execu\u00e7\u00e3o de Processo Suspeito&#8221;.<\/li>\n\n\n\n<li>Selecione a regra e clique em &#8220;Excluir&#8221;.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Verificar exclus\u00e3o:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Verifique se a regra n\u00e3o est\u00e1 mais listada na se\u00e7\u00e3o &#8220;Analytics&#8221;.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Documente a revers\u00e3o:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Atualize o documento de controle de altera\u00e7\u00f5es para refletir a a\u00e7\u00e3o de revers\u00e3o.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Aprova\u00e7\u00e3o<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Aprovador de altera\u00e7\u00f5es:\u00a0[A ser atribu\u00eddo]<\/li>\n\n\n\n<li>Data de aprova\u00e7\u00e3o:\u00a0[A ser atribu\u00eddo]<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Data de implementa\u00e7\u00e3o<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data agendada:\u00a0[A ser atribu\u00eddo]<\/li>\n\n\n\n<li>Tempo de implementa\u00e7\u00e3o:\u00a0[A ser atribu\u00eddo]<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Data de revers\u00e3o<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data agendada:\u00a0[A ser atribu\u00eddo]<\/li>\n\n\n\n<li>Tempo de revers\u00e3o:\u00a0[A ser atribu\u00eddo]<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Como voc\u00ea pode ver com os m\u00e9todos acima, agora existe a op\u00e7\u00e3o de criar um livro de prompt que pode ser executado manualmente para converter com efici\u00eancia AQL em KQL ou YARA.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"776\" height=\"499\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-4-4.png\" alt=\"\" class=\"wp-image-19393\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-4-4.png 776w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-4-4-480x309.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 776px, 100vw\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"629\" height=\"493\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-5-3.png\" alt=\"\" class=\"wp-image-19394\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-5-3.png 629w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-5-3-480x376.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 629px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;Exportamos as consultas AQL e as importamos diretamente para as listas de observa\u00e7\u00e3o no Sentinel:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"906\" height=\"497\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-6-3.png\" alt=\"\" class=\"wp-image-19395\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-6-3.png 906w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-6-3-480x263.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 906px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Clicar em exibir logs mostra AQLPayLoad armazenado na tabela _GetWatchlist(&#8216;AQL2KQL&#8217;):<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"270\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-7-3-1024x270.png\" alt=\"\" class=\"wp-image-19396\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-7-3-1024x270.png 1024w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-7-3-980x258.png 980w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-7-3-480x126.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) 1024px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Como temos essa lista de observa\u00e7\u00e3o agora importada, ela simplesmente n\u00e3o funcionar\u00e1, pois a sintaxe do AQL n\u00e3o \u00e9 compreendida pelo Sentinel:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Agora temos a op\u00e7\u00e3o de fazer com que o Copilot realize a convers\u00e3o por meio de um aplicativo l\u00f3gico, portanto, em teoria, s\u00f3 precisamos carregar a lista de observa\u00e7\u00e3o e deixar o aplicativo l\u00f3gico conversar.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"554\" height=\"498\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-8-2.png\" alt=\"\" class=\"wp-image-19397\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-8-2.png 554w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-8-2-480x431.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 554px, 100vw\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"277\" height=\"492\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-9-3.png\" alt=\"\" class=\"wp-image-19398\" srcset=\"https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-9-3.png 277w, https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-9-3-169x300.png 169w, https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-9-3-7x12.png 7w\" sizes=\"(max-width: 277px) 100vw, 277px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"683\" height=\"496\" src=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-10-1.png\" alt=\"\" class=\"wp-image-19399\" srcset=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-10-1.png 683w, http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/imagem-10-1-480x349.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 683px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Conclus\u00e3o e considera\u00e7\u00e3o<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Portanto, explorar como o conector do Aplicativo L\u00f3gico do Azure do Security Copilot e os Promptbooks revolucionam a integra\u00e7\u00e3o de solu\u00e7\u00f5es de seguran\u00e7a orientadas por IA nos fluxos de trabalho atuais. Essa ferramenta n\u00e3o apenas fornece maior personaliza\u00e7\u00e3o e integra\u00e7\u00e3o de sistema mais suave, mas tamb\u00e9m acesso a uma gama mais ampla de integra\u00e7\u00e3o de ferramentas de seguran\u00e7a l\u00f3gica do Azure prontas. Incentivamos voc\u00ea a experimentar a efici\u00eancia do conector do Aplicativo L\u00f3gico do Azure do Security Copilot para aprimorar suas opera\u00e7\u00f5es de seguran\u00e7a.<\/li>\n\n\n\n<li>Ao investigar e entender o AQL \/ YARA, n\u00e3o sa\u00edmos da plataforma copiloto<\/li>\n\n\n\n<li>Voc\u00ea pode personalizar o Aplicativo L\u00f3gico criando automaticamente as regras de an\u00e1lise do Microsoft Sentinel por meio da API<\/li>\n\n\n\n<li>Se os Aplicativos L\u00f3gicos n\u00e3o forem adequados, considere adicionar uma etapa para criar a documenta\u00e7\u00e3o de controle no promptbook.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fonte:<\/strong> <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/securitycopilotblog\/kql-migrator-powered-by-microsoft-security-copilot\/4358554\">Blog Tech Community<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Agende uma reuni\u00e3o e transforme seu neg\u00f3cio com o Azure Microsoft<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A migra\u00e7\u00e3o de SIEM \u00e9 um processo estrat\u00e9gico que exige planejamento e ferramentas adequadas. Com a tecnologia do Microsoft Security Copilot, simplificamos esse caminho, garantindo efici\u00eancia e seguran\u00e7a na transi\u00e7\u00e3o para o Microsoft Sentinel. Nossa equipe est\u00e1 pronta para ajudar voc\u00ea a traduzir suas regras de detec\u00e7\u00e3o de forma eficaz e a aproveitar todo o potencial do KQL.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Entre em contato conosco e descubra como nossa expertise pode transformar suas opera\u00e7\u00f5es de seguran\u00e7a. Clique aqui e agende uma reuni\u00e3o para explorar solu\u00e7\u00f5es sob medida para as suas necessidades empresariais.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Preencha o formul\u00e1rio e nosso time de especialistas entrar\u00e1 em contato.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">E n\u00e3o se esque\u00e7a de nos seguir em nossas <a href=\"https:\/\/www.linkedin.com\/company\/dataex\/?viewAsMember=true\">redes sociais<\/a> e acessar o <a href=\"https:\/\/darkorchid-wallaby-287256.hostingersite.com\/blog\/\">blog Data Universe<\/a> diariamente.<\/p>\n","protected":false},"excerpt":{"rendered":"<p><span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\">Tempo de leitura:<\/span> <span class=\"rt-time\"> 13<\/span> <span class=\"rt-label rt-postfix\">minutos<\/span><\/span>As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador que requer planejamento meticuloso e uma compreens\u00e3o completa da configura\u00e7\u00e3o existente no SIEM herdado e do que precisa ser migrado para o SIEM moderno. Nosso principal ponto de discuss\u00e3o foi como podemos ajudar as organiza\u00e7\u00f5es a traduzir com efici\u00eancia as regras de detec\u00e7\u00e3o de linguagens baseadas [&hellip;]<\/p>\n","protected":false},"author":17,"featured_media":19400,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"1080","_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[15],"tags":[28,11,63,65,47],"class_list":["post-19388","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics","tag-analytics","tag-azure","tag-data-engineer","tag-data-science","tag-dataex"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>KQL Migrator com tecnologia Microsoft Security Copilot - DataEX<\/title>\n<meta name=\"description\" content=\"As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador, para saber mais sobre esse processo leia nosso artigo completo agora!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"KQL Migrator com tecnologia Microsoft Security Copilot - DataEX\" \/>\n<meta property=\"og:description\" content=\"As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador, para saber mais sobre esse processo leia nosso artigo completo agora!\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/\" \/>\n<meta property=\"og:site_name\" content=\"DataEX\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DataExbr\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-12-26T10:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/Imagens-blog-17-1024x512.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Flavia Pereira\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Flavia Pereira\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/\"},\"author\":{\"name\":\"Flavia Pereira\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#\\\/schema\\\/person\\\/27c685e91452d74a9064fbe76ceefbc9\"},\"headline\":\"KQL Migrator com tecnologia Microsoft Security Copilot\",\"datePublished\":\"2024-12-26T10:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/\"},\"wordCount\":3532,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/dataex.com.br\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Imagens-blog-17.png\",\"keywords\":[\"Analytics\",\"Azure\",\"Data Engineer\",\"Data Science\",\"DataEX\"],\"articleSection\":[\"Analytics\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/\",\"url\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/\",\"name\":\"KQL Migrator com tecnologia Microsoft Security Copilot - DataEX\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/dataex.com.br\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Imagens-blog-17.png\",\"datePublished\":\"2024-12-26T10:00:00+00:00\",\"description\":\"As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador, para saber mais sobre esse processo leia nosso artigo completo agora!\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#primaryimage\",\"url\":\"https:\\\/\\\/dataex.com.br\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Imagens-blog-17.png\",\"contentUrl\":\"https:\\\/\\\/dataex.com.br\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Imagens-blog-17.png\",\"width\":6912,\"height\":3456},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/kql-migrator-com-tecnologia-microsoft-security-copilot\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"In\u00edcio\",\"item\":\"https:\\\/\\\/darkorchid-wallaby-287256.hostingersite.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"KQL Migrator com tecnologia Microsoft Security Copilot\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/\",\"name\":\"DataEX\",\"description\":\"Solu\u00e7\u00f5es Data &amp; AI - Make Smarter Decisions Faster\",\"publisher\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#organization\",\"name\":\"DataEX\",\"url\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"http:\\\/\\\/dataex.com.br\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/500x195-Logotipo-Transparente-DataEX-Horizontal-Laranja-e-Cinza.png\",\"contentUrl\":\"http:\\\/\\\/dataex.com.br\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/500x195-Logotipo-Transparente-DataEX-Horizontal-Laranja-e-Cinza.png\",\"width\":500,\"height\":195,\"caption\":\"DataEX\"},\"image\":{\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DataExbr\\\/\",\"https:\\\/\\\/www.instagram.com\\\/dataexbr\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/dataex\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/#\\\/schema\\\/person\\\/27c685e91452d74a9064fbe76ceefbc9\",\"name\":\"Flavia Pereira\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d55e08a7f49c5f7f6e82174235a2fdff6790facf7895b70160481416b10946a3?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d55e08a7f49c5f7f6e82174235a2fdff6790facf7895b70160481416b10946a3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d55e08a7f49c5f7f6e82174235a2fdff6790facf7895b70160481416b10946a3?s=96&d=mm&r=g\",\"caption\":\"Flavia Pereira\"},\"url\":\"https:\\\/\\\/dataex.com.br\\\/en\\\/author\\\/flavia-pereira\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"KQL Migrator com tecnologia Microsoft Security Copilot - DataEX","description":"As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador, para saber mais sobre esse processo leia nosso artigo completo agora!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/","og_locale":"en_US","og_type":"article","og_title":"KQL Migrator com tecnologia Microsoft Security Copilot - DataEX","og_description":"As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador, para saber mais sobre esse processo leia nosso artigo completo agora!","og_url":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/","og_site_name":"DataEX","article_publisher":"https:\/\/www.facebook.com\/DataExbr\/","article_published_time":"2024-12-26T10:00:00+00:00","og_image":[{"width":1024,"height":512,"url":"http:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/Imagens-blog-17-1024x512.png","type":"image\/png"}],"author":"Flavia Pereira","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Flavia Pereira","Est. reading time":"16 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#article","isPartOf":{"@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/"},"author":{"name":"Flavia Pereira","@id":"https:\/\/dataex.com.br\/en\/#\/schema\/person\/27c685e91452d74a9064fbe76ceefbc9"},"headline":"KQL Migrator com tecnologia Microsoft Security Copilot","datePublished":"2024-12-26T10:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/"},"wordCount":3532,"commentCount":0,"publisher":{"@id":"https:\/\/dataex.com.br\/en\/#organization"},"image":{"@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#primaryimage"},"thumbnailUrl":"https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/Imagens-blog-17.png","keywords":["Analytics","Azure","Data Engineer","Data Science","DataEX"],"articleSection":["Analytics"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/","url":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/","name":"KQL Migrator com tecnologia Microsoft Security Copilot - DataEX","isPartOf":{"@id":"https:\/\/dataex.com.br\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#primaryimage"},"image":{"@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#primaryimage"},"thumbnailUrl":"https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/Imagens-blog-17.png","datePublished":"2024-12-26T10:00:00+00:00","description":"As migra\u00e7\u00f5es de SIEM s\u00e3o sempre um processo desafiador, para saber mais sobre esse processo leia nosso artigo completo agora!","breadcrumb":{"@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#primaryimage","url":"https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/Imagens-blog-17.png","contentUrl":"https:\/\/dataex.com.br\/wp-content\/uploads\/2024\/12\/Imagens-blog-17.png","width":6912,"height":3456},{"@type":"BreadcrumbList","@id":"https:\/\/dataex.com.br\/en\/kql-migrator-com-tecnologia-microsoft-security-copilot\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"In\u00edcio","item":"https:\/\/darkorchid-wallaby-287256.hostingersite.com\/"},{"@type":"ListItem","position":2,"name":"KQL Migrator com tecnologia Microsoft Security Copilot"}]},{"@type":"WebSite","@id":"https:\/\/dataex.com.br\/en\/#website","url":"https:\/\/dataex.com.br\/en\/","name":"DataEX","description":"Solu\u00e7\u00f5es Data &amp; AI - Make Smarter Decisions Faster","publisher":{"@id":"https:\/\/dataex.com.br\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dataex.com.br\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/dataex.com.br\/en\/#organization","name":"DataEX","url":"https:\/\/dataex.com.br\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dataex.com.br\/en\/#\/schema\/logo\/image\/","url":"http:\/\/dataex.com.br\/wp-content\/uploads\/2022\/04\/500x195-Logotipo-Transparente-DataEX-Horizontal-Laranja-e-Cinza.png","contentUrl":"http:\/\/dataex.com.br\/wp-content\/uploads\/2022\/04\/500x195-Logotipo-Transparente-DataEX-Horizontal-Laranja-e-Cinza.png","width":500,"height":195,"caption":"DataEX"},"image":{"@id":"https:\/\/dataex.com.br\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DataExbr\/","https:\/\/www.instagram.com\/dataexbr\/","https:\/\/www.linkedin.com\/company\/dataex\/"]},{"@type":"Person","@id":"https:\/\/dataex.com.br\/en\/#\/schema\/person\/27c685e91452d74a9064fbe76ceefbc9","name":"Flavia Pereira","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d55e08a7f49c5f7f6e82174235a2fdff6790facf7895b70160481416b10946a3?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d55e08a7f49c5f7f6e82174235a2fdff6790facf7895b70160481416b10946a3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d55e08a7f49c5f7f6e82174235a2fdff6790facf7895b70160481416b10946a3?s=96&d=mm&r=g","caption":"Flavia Pereira"},"url":"https:\/\/dataex.com.br\/en\/author\/flavia-pereira\/"}]}},"_links":{"self":[{"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/posts\/19388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/comments?post=19388"}],"version-history":[{"count":0,"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/posts\/19388\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/media\/19400"}],"wp:attachment":[{"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/media?parent=19388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/categories?post=19388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dataex.com.br\/en\/wp-json\/wp\/v2\/tags?post=19388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}