Reduce license costs with Application Inventory and Usage Report in Log Analytics
Microsoft Intune is a cloud-based endpoint management solution. It manages user access and simplifies app and device management across your many devices, including mobile devices, desktop computers, and virtual endpoints.
You can protect access and data on organization-owned and users personal devices. And, Intune has compliance and reporting features that support the Zero Trust security model.
Intune simplifies app management with a built-in app experience, including app deployment, updates, and removal. You can connect to and distribute apps from your private app stores, enable Microsoft 365 apps, deploy Win32 apps, create app protection policies, and manage access to apps and their data. For more information, go to Manage apps using Microsoft Intune.
Intune provides several Reports regarding e,g. App Distribution and Install Status but also Discovered Apps on all managed devices.
For most customers these reports provide enough information but in context of application inventory information are missing like e.g. application usage (software metering) or hosts and client devices used for application start. From business perspective this information are necessary to provide License Management and allow license decrease in case an Application is not used in the company.
Therefore most customers use 3rd party solution to get application usage information which increase license spent... but these information alternativaly can be provided additionally in LogAnalytics based on Applocker-Generated Event-IDs and shown and exported via Kusto Query Language (KQL).
Applocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis.
Table of content
In this post I will cover the following steps:
- Environment Setup
- Create Applocker Policy
- Create Configuration Profile in Intune
- Collect Event Log data with LogAnalytics Agent
- Use KQL for data query
1 - Environment Setup
Following prerequesites must be ensured to ensure agent based data collection. Customers using Microsoft Defender for Cloud may already use this kind of services as also needed for data analysis.
1.) For data collection a LogAnalytics environment is necessary:
2.) Enable Intune Diagnostics Data Forwarding to LogAnalytics
3.) Deploy Microsoft Monitoring Agent OR Azure Monitoring Agent to client devices. Both approaches are valid!
- Microsoft Monitoring Agent setup | Microsoft Learn - The Log Analytics agents (MMA.OMS) used to collect logs from virtual machines and servers will no longer be supported from August 31, 2024. Plan to migrate to Azure Monitor Agent before this date.
- Azure Monitor agent on Windows client devices
- Best approach would be to provide this agent as a .intunewin file via Preparation Tool and install via Intune
2 - Create Applocker Policy
AppLocker enforces rules by grouping enforcement for different types of files. AppLocker includes five different types of rules collections:
- Executable files: .exe and .com
- Windows Installer files: .msi, mst, and .msp
- Scripts: .ps1, .bat, .cmd, .vbs, and .js
- DLLs: .dll and .ocx
- Packaged apps and packaged app installers: .appx
Within this blog we will only focus on .EXE files!
For creation you need to log into the PC using an account with local administrative privileges. Next, open the local security policy by entering the gpedit.msc command at the Windows Run prompt. Once the Local Group Policy Editor opens, navigate through the console tree to Computer Configuration \ Windows Settings \ Security Settings \ Application Control Policies \ AppLocker.
If you expand the Windows AppLocker container, shown in the figure above, the console will reveal four sub-containers, each of which are related to a specific type of rule.
Within this step I recommend selecting the option to create default rules.
The default rules ensure that Windows is able to run. In the case of executable rules, for example, the default rules allow any executable file located in the Windows folder or the Program Files folder to run. Additionally, the default rules allow the BUILTIN\Administrator account to run all files.
In the next step these rules must be configured re enforcement level.
- You can configure the enforcement setting to Enforce rules or Audit only on the rule collection. Enforce rules, rules are enforced for the rule collection and all events are audited. Audit only, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log.
For this example please choose Audit only and final Apply.
Finally please make a right-click on Applocker and export the generated rule set.
This generates a file with similar content.
3 - Create Configuration Profile in Intune
In Microsoft Intune we need to create a configuration profile and push the created Applocker Configuration to all relevant windows devices.
Please use Device => Configuration Profiles => Create Profile and choose Windows 10 or later; Profile Typ = Templaces and please choose Custom.
Give the policy a new name and move on to Configuration Settings.
Use following settings:
- Name: EXE Rule Collection
- Description: Executable Rules
- OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/apprulset0001/EXE/Policy
- Data Type: String
- Value: The whole XML Element "<RuleCollection Type="Exe" EnforcementMode="AuditOnly">" out of your exported applocker-policy
Finally assign this Configuration Policy to Group of Windows Devices.
After finishing this step and successful assignment you can double check in Eventlog that event information are stored in section "Application and Service Protocols" => Microsoft => Windows => Applocker => EXE and DLL
4 - Collect Event Log data with LogAnalytics Agent
All Event related information for EXE and DLL are stored on each device and must be forwarded to central defined LogAnalytics space. For this step the Monitoring Agent (MMA or AMA) must be configured via LogAnalytics.
Please login to https://portal.azure.com and use "LogAnalytics" Service. Within your defined space choose "Legacy agents management" from the left side, Add Windows Event Log and choose "Microsoft-Windows-Applocker/EXE and DLL".
After final apply the relevant information will be forwarded to Log Analytics space.
5 - Use KQL for data query
After some time the data is provided to LogAnalytics and can be queried within "Logs" Section. This section opens a query section which provides results below and also enables you to export data.
Here some examples which of course can be adjusted by you.
EventThis query provides you ALL available Eventlog information in LogAnalytics.
Event
| where EventLog == "Microsoft-Windows-AppLocker/EXE and DLL" This query provides you ALL available Eventlog information related to your Applocker-Policy in LogAnalytics.
Event
| where EventLog == "Microsoft-Windows-AppLocker/EXE and DLL" and UserName !contains "NT" and EventID == 8002
| extend EvData=parse_xml(EventData)
| extend EventDetail = EvData.DataItem.UserData.RuleAndFileData
| extend parent_name=tostring(EventDetail.FilePath)
| project TimeGenerated, Computer, UserName, parent_name This query provides information regarding Timestamp, Computer name, Username and used Application which is extracted from an XML information. Event-ID is filtered to 8002 and Username ignores "NT" System Account Information.
Event
| where EventLog == "Microsoft-Windows-AppLocker/EXE and DLL" and UserName !contains "NT" and EventID == 8002
| extend EvData=parse_xml(EventData)
| extend EventDetail = EvData.DataItem.UserData.RuleAndFileData
| extend parent_name=extract(@"([^\\]*\.\w+)", 1, tostring(EventDetail.FilePath))
| project parent_name
| summarize Count=count() by parent_name
| sort by Count
This query is based on previous one but summarizes the started applications which gives more information related to software metering. Additionally used RegEx helped to extract the Filename only.
For more information related Event IDs please visit: Using Event Viewer with AppLocker (Windows) | Microsoft Learn
Comments
Post a Comment