Microsoft Defender Voor Endpoint: Threat Analytics En Inlichtingenkoppeling

<# .SYNOPSIS Microsoft Defender voor Endpoint: Threat Analytics en Inlichtingenkoppeling .DESCRIPTION Controleert de beschikbaarheid, gezondheid en opvolging van Threat Analytics rapporten in Microsoft 365 Defender, haalt campagnegegevens op via Microsoft Graph Security API (beta) en bouwt monitoringdossiers die direct deelbaar zijn met bestuur, SOC en toezichthouders conform de Nederlandse Baseline voor Veilige Cloud. .NOTES Filename: threat-analytics.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-01-10 Last Modified: 2025-11-27 Version: 2.0 Gerelateerd artikel: content/m365/defender-endpoint/threat-analytics.json .LINK https://github.com/[org]/m365-tenant-best-practise .EXAMPLE .\threat-analytics.ps1 -Monitoring Voert de monitoringcontrole uit, toont status van Graph-connectiviteit en beschikbare campagnes. .EXAMPLE .\threat-analytics.ps1 -Remediation Genereert organisatorische en technische stappen voor het activeren en opvolgen van Threat Analytics rapporten. #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph, Microsoft.Graph.Security [CmdletBinding()] param( [Parameter()] [switch]$Monitoring, [Parameter()] [switch]$Remediation, [Parameter()] [switch]$WhatIf, [Parameter()] [string]$ExportPath ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' $script:GraphReady = $false $script:SeverityTemplate = [ordered]@{ critical = 0 high = 0 medium = 0 low = 0 informational = 0 unknown = 0 } $script:NoteExtension = ".note.txt" function Connect-RequiredServices { <# .SYNOPSIS Maakt verbinding met Microsoft Graph Security API (beta) #> [CmdletBinding()] param() Write-Verbose "Controleren van Microsoft.Graph modules..." $graphModule = Get-Module -ListAvailable -Name Microsoft.Graph if (-not $graphModule) { Write-Warning "Microsoft.Graph module niet gevonden. Installeer deze via Install-Module Microsoft.Graph -Scope CurrentUser." return } if (-not (Get-Command -Name Connect-MgGraph -ErrorAction SilentlyContinue)) { Write-Warning "Connect-MgGraph cmdlet niet beschikbaar. Update Microsoft.Graph modules." return } try { $context = Get-MgContext -ErrorAction SilentlyContinue if (-not $context) { Write-Host "Verbinding maken met Microsoft Graph..." -ForegroundColor Yellow Connect-MgGraph -Scopes "SecurityEvents.Read.All", "ThreatHunting.Read.All", "ThreatHunting.ReadWrite.All" -ErrorAction Stop | Out-Null } $selectProfileCmd = Get-Command -Name Select-MgProfile -ErrorAction SilentlyContinue if ($selectProfileCmd) { Select-MgProfile -Name "beta" } else { Write-Warning "Select-MgProfile niet beschikbaar. Werk de Microsoft.Graph modules bij om beta-profielen te ondersteunen." } $script:GraphReady = $true Write-Verbose "Verbonden met Microsoft Graph Security API (beta of standaard profiel)" } catch { Write-Warning "Verbinding met Microsoft Graph mislukt: $_" $script:GraphReady = $false } } function Get-ThreatAnalyticsReports { <# .SYNOPSIS Haalt Threat Analytics campagnes op via Graph .OUTPUTS Array van Threat Analytics objecten #> [CmdletBinding()] param() if (-not $script:GraphReady) { Write-Verbose "Graph niet beschikbaar, geen campagnes opgehaald." return @() } try { $uri = "https://graph.microsoft.com/beta/security/threatAnalytics" Write-Verbose "Ophalen van Threat Analytics rapporten..." $response = Invoke-MgGraphRequest -Method GET -Uri $uri -ErrorAction Stop return @($response.value) } catch { Write-Warning "Kon Threat Analytics data niet ophalen: $_" return @() } } function New-ThreatAnalyticsSummary { <# .SYNOPSIS Maakt een samenvatting voor rapportage en kennisbank #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Reports ) $severity = [ordered]@{} $script:SeverityTemplate.GetEnumerator() | ForEach-Object { $severity[$_.Key] = $_.Value } $tacticCounts = @{} $oldestCritical = $null foreach ($report in $Reports) { $sev = ($report.severity | ForEach-Object { $_ }) -join "" if ([string]::IsNullOrWhiteSpace($sev)) { $sev = "unknown" } $sevKey = $sev.ToLowerInvariant() if ($severity.Contains($sevKey)) { $severity[$sevKey]++ } else { $severity[$sevKey] = 1 } if ($report.tactics) { foreach ($tactic in $report.tactics) { if ([string]::IsNullOrWhiteSpace($tactic)) { continue } if ($tacticCounts.ContainsKey($tactic)) { $tacticCounts[$tactic]++ } else { $tacticCounts[$tactic] = 1 } } } if ($sevKey -in @("critical","high") -and $report.lastUpdatedDateTime) { $candidate = [datetime]$report.lastUpdatedDateTime if (-not $oldestCritical -or $candidate -lt $oldestCritical) { $oldestCritical = $candidate } } } $tacticHighlights = $tacticCounts.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First 5 $oldestDays = $null if ($oldestCritical) { $oldestDays = (New-TimeSpan -Start $oldestCritical -End (Get-Date)).Days } return [pscustomobject]@{ SeverityBreakdown = $severity TacticHighlights = $tacticHighlights OldestHighDays = $oldestDays } } function Write-KnowledgeNote { <# .SYNOPSIS Schrijft een tekstueel dossier naast het JSON-resultaat #> [CmdletBinding()] param( [Parameter(Mandatory)] [string]$Path, [Parameter(Mandatory)] [pscustomobject]$Status ) try { $notePath = [System.IO.Path]::ChangeExtension($Path, $script:NoteExtension) $lines = @() $lines += "Threat Analytics overzicht - $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" $lines += "Graph verbonden : $($Status.GraphConnected)" $lines += "Rapporten : $($Status.ReportsRetrieved)" $lines += "Kritieke items : $($Status.CriticalReports)" if ($Status.OldestOpenCriticalDays) { $lines += "Oudste kritieke campagne: $($Status.OldestOpenCriticalDays) dagen actief" } if ($Status.SeverityBreakdown) { $lines += "Severities:" foreach ($pair in $Status.SeverityBreakdown.GetEnumerator()) { $lines += " - {0}: {1}" -f $pair.Key, $pair.Value } } if ($Status.TacticHighlights) { $lines += "Top tactieken:" foreach ($tactic in $Status.TacticHighlights) { $lines += " - {0}: {1}" -f $tactic.Key, $tactic.Value } } if ($Status.Issues.Count -gt 0) { $lines += "Issues:" $Status.Issues | ForEach-Object { $lines += " - $_" } } if ($Status.Recommendations.Count -gt 0) { $lines += "Aanbevelingen:" $Status.Recommendations | ForEach-Object { $lines += " - $_" } } $parent = Split-Path -Path $notePath -Parent if (-not (Test-Path -Path $parent)) { New-Item -ItemType Directory -Path $parent -Force | Out-Null } $lines | Out-File -FilePath $notePath -Encoding UTF8 Write-Verbose "Kennisnotitie opgeslagen naar $notePath" } catch { Write-Warning "Kon kennisnotitie niet schrijven: $_" } } function Send-ThreatAnalyticsNotification { <# .SYNOPSIS Verstuurt een webhook-notificatie wanneer drempels worden overschreden #> [CmdletBinding()] param( [Parameter(Mandatory)] [pscustomobject]$Status ) $webhook = $env:THREAT_ANALYTICS_WEBHOOK if ([string]::IsNullOrWhiteSpace($webhook)) { return } $body = @{ title = "Threat Analytics Monitoring" summary = "Rapporten: {0}, Kritiek: {1}" -f $Status.ReportsRetrieved, $Status.CriticalReports details = @{ graphConnected = $Status.GraphConnected oldestCriticalDays = $Status.OldestOpenCriticalDays issues = $Status.Issues recommendations = $Status.Recommendations } } try { Invoke-RestMethod -Method Post -Uri $webhook -Body ($body | ConvertTo-Json -Depth 6) -ContentType "application/json" | Out-Null Write-Verbose "Webhook-notificatie verzonden." } catch { Write-Warning "Webhook-notificatie mislukt: $_" } } function Test-ThreatAnalyticsConfiguration { <# .SYNOPSIS Valideert Threat Analytics beschikbaarheid en opvolging .OUTPUTS PSCustomObject met statusinformatie #> [CmdletBinding()] param() $result = [ordered]@{ IsCompliant = $false GraphConnected = $script:GraphReady ReportsRetrieved = 0 CriticalReports = 0 OldestOpenCriticalDays = $null SeverityBreakdown = $null TacticHighlights = $null Issues = @() Recommendations = @() Timestamp = (Get-Date).ToString("s") } if (-not $script:GraphReady) { $result.Issues += "Geen Graph-verbinding. Start Connect-RequiredServices opnieuw of controleer PIM-rollen." return [pscustomobject]$result } $reports = Get-ThreatAnalyticsReports $result.ReportsRetrieved = $reports.Count if ($reports.Count -eq 0) { $result.Issues += "Geen Threat Analytics rapporten gevonden. Controleer licenties (M365 E5 of Defender for Endpoint Plan 2) en onboardingstatus." } else { $critical = $reports | Where-Object { $_.severity -eq "critical" -or $_.severity -eq "high" } $result.CriticalReports = $critical.Count $summary = New-ThreatAnalyticsSummary -Reports $reports $result.SeverityBreakdown = $summary.SeverityBreakdown $result.TacticHighlights = $summary.TacticHighlights $result.OldestOpenCriticalDays = $summary.OldestHighDays if ($critical.Count -gt 0) { if ($result.OldestOpenCriticalDays -gt 14) { $result.Issues += "Er staan kritieke campagnes langer dan 14 dagen open. Versnel remediatie en rapporteer aan de CISO." } } else { $result.Recommendations += "Geen kritieke campagnes. Blijf dagelijkse monitoring uitvoeren en documenteer reviewmomenten." } $result.Recommendations += "Publiceer Threat Analytics bevindingen in het wekelijkse cyberoverleg." $result.Recommendations += "Koppel exposure-scores aan ITSM-tickets met duidelijke eigenaarschap." } if ($result.Issues.Count -eq 0 -and $reports.Count -gt 0) { $result.IsCompliant = $true } return [pscustomobject]$result } function Export-ThreatAnalyticsStatus { <# .SYNOPSIS Exporteert resultaten naar JSON bestand #> [CmdletBinding()] param( [Parameter(Mandatory)] [string]$Path, [Parameter(Mandatory)] [pscustomobject]$Data ) try { $directory = Split-Path -Path $Path -Parent if (-not (Test-Path -Path $directory)) { New-Item -ItemType Directory -Path $directory -Force | Out-Null } $Data | ConvertTo-Json -Depth 5 | Out-File -FilePath $Path -Encoding UTF8 Write-KnowledgeNote -Path $Path -Status $Data Write-Host "Status geëxporteerd naar $Path" -ForegroundColor Green } catch { Write-Warning "Kon status niet exporteren: $_" } } function Invoke-Monitoring { <# .SYNOPSIS Voert de monitoringflow uit #> [CmdletBinding()] param() Write-Host "`nMonitoring: Threat Analytics" -ForegroundColor Cyan Write-Host "================================" -ForegroundColor Cyan $status = Test-ThreatAnalyticsConfiguration if (-not $status.GraphConnected) { Write-Host " ⚠️ Microsoft Graph niet verbonden" -ForegroundColor Yellow } Write-Host " Rapporten opgehaald : $($status.ReportsRetrieved)" -ForegroundColor White Write-Host " Kritieke campagnes : $($status.CriticalReports)" -ForegroundColor White if ($status.OldestOpenCriticalDays) { Write-Host " Oudste kritieke campagne staat $($status.OldestOpenCriticalDays) dagen open." -ForegroundColor Yellow } if ($status.SeverityBreakdown) { Write-Host "`nSeverities (laatste run):" -ForegroundColor Cyan foreach ($pair in $status.SeverityBreakdown.GetEnumerator()) { Write-Host (" - {0,-12}: {1}" -f $pair.Key, $pair.Value) -ForegroundColor White } } if ($status.TacticHighlights) { Write-Host "`nTop MITRE ATT&CK tactieken:" -ForegroundColor Cyan foreach ($tactic in $status.TacticHighlights) { Write-Host (" - {0}: {1}" -f $tactic.Key, $tactic.Value) -ForegroundColor White } } if ($status.IsCompliant) { Write-Host "`n✅ Threat Analytics basiscontrole geslaagd" -ForegroundColor Green } else { Write-Host "`n⚠️ Threat Analytics vereist aandacht" -ForegroundColor Yellow } if ($status.Issues.Count -gt 0) { Write-Host "`nGeconstateerde issues:" -ForegroundColor Red $status.Issues | ForEach-Object { Write-Host " - $_" -ForegroundColor Red } } if ($status.Recommendations.Count -gt 0) { Write-Host "`nAanbevelingen:" -ForegroundColor Cyan $status.Recommendations | ForEach-Object { Write-Host " - $_" -ForegroundColor White } } if ($ExportPath) { Export-ThreatAnalyticsStatus -Path $ExportPath -Data $status } Send-ThreatAnalyticsNotification -Status $status return $status } function Invoke-Remediation { <# .SYNOPSIS Geeft remediatie-instructies voor Threat Analytics #> [CmdletBinding()] param() Write-Host "`nRemediatiegids: Threat Analytics" -ForegroundColor Cyan Write-Host "================================" -ForegroundColor Cyan if ($WhatIf) { Write-Host " [WhatIf] Remediatie-instructies worden enkel weergegeven (geen acties uitgevoerd)." -ForegroundColor Yellow } Write-Host "`nStap 1 – Licentie en onboarding" -ForegroundColor White Write-Host " Controleer of alle relevante apparaten Microsoft Defender voor Endpoint Plan 2 of M365 E5 gebruiken." -ForegroundColor Gray Write-Host " Valideer onboardingstatus in security.microsoft.com → Settings → Endpoints → Device management." -ForegroundColor Gray Write-Host "`nStap 2 – Rollen en toegang" -ForegroundColor White Write-Host " Stel aangepaste rollen in voor CISO, SOC en auditors met minimaal ThreatAnalytics.Read.All rechten." -ForegroundColor Gray Write-Host " Gebruik Privileged Identity Management voor tijdelijke onderzoeksrechten." -ForegroundColor Gray Write-Host "`nStap 3 – Procesintegratie" -ForegroundColor White Write-Host " Leg vast dat elk nieuw rapport binnen 24 uur wordt beoordeeld en dat exposure-items een eigenaar hebben." -ForegroundColor Gray Write-Host " Koppel het rapportnummer aan ITSM-changes en incidenten zodat audittrail volledig is." -ForegroundColor Gray Write-Host "`nStap 4 – Automatisering" -ForegroundColor White Write-Host " Plan het script .\\threat-analytics.ps1 -Monitoring in Windows Task Scheduler of Azure Automation." -ForegroundColor Gray Write-Host " Exporteer resultaten naar een beveiligde opslaglocatie en stuur een melding naar het cyberoverleg." -ForegroundColor Gray Write-Host "`nStap 5 – Communicatie en compliance" -ForegroundColor White Write-Host " Rapporteer kritieke campagnes direct aan het bestuur en aan ketenpartners indien relevant." -ForegroundColor Gray Write-Host " Archiveer alle rapporten minimaal zeven jaar voor NIS2 en AVG auditverplichtingen." -ForegroundColor Gray Write-Host "`n✅ Remediatie-instructies voltooid" -ForegroundColor Green } try { Write-Host "`n================================" -ForegroundColor Cyan Write-Host "Threat Analytics – Nederlandse Baseline" -ForegroundColor Cyan Write-Host "================================`n" -ForegroundColor Cyan Connect-RequiredServices if ($Monitoring) { Invoke-Monitoring | Out-Null } elseif ($Remediation) { Invoke-Remediation } else { $status = Invoke-Monitoring if (-not $status.IsCompliant) { Write-Host "`nTip: run .\threat-analytics.ps1 -Remediation voor detailstappen." -ForegroundColor Yellow } } } catch { Write-Error "Scriptfout: $_" throw } finally { Write-Host "`n================================`n" -ForegroundColor Cyan }