Azure Sentinel SIEM Integration
2023.03.23
Overview
Oort’s platform can tie into existing Sentinel workflows often used by Security Teams. This document will walk you through the process of setting up the App Registration inside of Azure AD.
For more information, see this short overview video -
Azure Sentinel Integration - High-level Steps
This article follows the Microsoft Azure Sentinel tutorial - Send data to Azure Monitor Logs by using a REST API (Azure Portal).
The following items will be needed to complete the integration inside of the Oort Console:
The sections below go into more detail on each of the steps.
Azure Sentinel Configuration
Configure Azure application registration to authenticate against the API, follow the instructions. Note the Application (client) ID, Directory (tenant) ID and secret value for further setup.
Create data collection endpoint, follow the instructions. Note the Logs ingestion URI for further setup.
Add a custom log table, follow the instructions. Note the table name for further setup and be aware that there is
_CL
added automatically to the table name. We will need the full name with the_CL
suffix.Save content of this block in a local file or download the sample_data file linked below. NOTE - this step is done outside of the Azure console.
Click Browse for files and use the content of the file from the previous step for that purpose.
To collect information from data collection rule (DCR), follow the instructions. Note
immutableId
for further setup.
Azure Configuration Summary
After the setup above, you will have the following components in your Azure tenant. These objects will be used to setup a corresponding Sentinel SIEM integration in Oort:
App registration (client ID, client secret, tenant ID)
Logs Ingestion Endpoint URI from the data collection endpoint (DCE) to receive data over HTTP
Data collection rule (DCR) immutable Id
Custom table name in Log Analytics workspace (including the _CL suffix)
Oort Tenant Configuration for Sentinel
Within your Oort console, follow these steps to configure your Sentinel integration.
Name - for display purposes only
Description (optional)
Azure directory (tenant) ID
App (client) ID
App (client) secret
Logs Ingestion Endpoint URI - this is a property of the data collection endpoint (DCE) created above
Custom log table name
DCR Immutable ID - this is found in the JSON View of the DCR
Click Save
Viewing your Oort logs in Azure Sentinel
By default, your Oort tenant will send all new Check failures for all checks to your Azure Sentinel custom table once every 24 hours.
To calculate any new check failures since the last data collection and analysis, you may want to do the following:
To view your logs in Azure Sentinel, do the following -
Navigate to your Azure Sentinel instance that contains the configuration you created for this integration.
Select Logs in the left nav pane.
The Results will show the most recent check failures from your Oort tenant.
Last updated