Video - Integrating Sentinel with Third-Party SIEM Using Private Connections

Video - Integrating Sentinel with Third-Party SIEM Using Private Connections

Recently, I published on GitHub the JSON template of a Logic App designed for quickly integrating Sentinel with any third-party SIEM in a side-by-side configuration. Specifically, this Logic App can be launched manually or automatically as a Playbook in Sentinel. It sends to Event Hub the JSON representation of an incident retrieved from Sentinel, including all the details of the incident's alerts and related identities. This implementation configures the Logic App to run in the 'Consumption Plan,' which is typically the easiest and most cost-effective model for Logic Apps deployment. I documenteted the implementation and referenced the template in the following article: A simple Logic App to export Sentinel incidents in Event Hub.

A few days ago, I was asked to apply the same integration approach in a scenario where, for compliance with internal security policies, the Event Hub cannot expose public endpoints. So far, I haven't had time to extract another JSON template of this new implementation, but in this video, I show all the details of how I made the requested configuration in my lab environment. Not only did I configure the Event Hub to accept only connections on a Private Endpoint, but I also ensured that the Logic App and its backend Storage Account do not accept connections from the public Internet.

The video shows also a full demo of an incident - with its alerts and entities - sent from Sentinel to Splunk.

The video

You can watch the video from here:

Chapters:

  • 00:00 Intro
  • 00:48 Demo: sending an Incident from Sentinel to Splunk
  • 03:58 How to create the Logic App with Standard plan
  • 05:10 Logic App design, connections and Managed Identity
  • 12:52 Networking configuration on the Logic App and its back-end Storage Account
  • 22:32 Networking configuration and IAM role assignment on the Event Hub Namespace
  • 25:34 Diagnostic settings configuration on the Event Hub Namespace
  • 26:43 Configuration of the integration on Splunk
  • 28:13 Conclusion

I hope this content helps you better understand how to make a similar configuration.


Notes, references, corrections and updates related to the video

Here, I am listing - and will possibly add in the future - notes, corrections and updates that I understand to be required with respect to the content of the video.

  • Very important: In my lab, the day after I completed the initial setup, I reopened the Logic App and found an empty run history and errors throughout the editor. This was due to an Azure Policy assigned to my lab subscription that enforced the disablement of the connection to the Storage Account via Access Keys. As mentioned in the video, I could not find a way to avoid using an Access Key and switch to Managed Identity permissions instead. To my understanding, as of this writing (Nov. 10th, 2024), using Managed Identity is not currently supported by Logic Apps when connecting to their back-end Storage Account. To get the Logic App working in my lab for the demo, I had to manually revert the changes made automatically and periodically by the policy assignment. Of course, the policy assignment can be modified to accept exclusions, but in my lab environment, this is not really necessary.
  • Let me emphasize this point: as clarified in the video, when editing the flow of the Logic App, it is vital to select the "In-App" version of the "Send Event" action. Choosing the other, non-"In-App" version causes the traffic to go to the Event Hub from the Internet instead of the local VNet. The traffic from the Logic App to the Event Hub is then blocked with the error 401 "Ip has been prevented to connect to the endpoint". [Thank you Gianluigi Liguori for your precious help in understanding the cause of this issue and solving the problem!]
  • After recording the video, I noticed that when clicking on one of the executed instances of the Logic App in the history page, the page loads blank. I need to investigate the cause of this minor issue. [Update 2024.11.12: the issue was transient; it disappeared without any change]
  • [Update 2024.11.12] Important: in a customer environment, we noticed that the access of the Logic App to its backend Storage Account, configured to allow access only from specific VNets/subnets (enabled by the WEBSITE_CONTENTOVERVNET or vnetContentShareEnabled parameters) doesn't work when there is a Route Table associated with the Logic App's subnet (in my lab there was no Route Table associated). Please note that the backend Storage Account is created automatically as of type 'General Purpose v1' and, then, does not allow setting a Private Endpoint. Please also consider that the need to remove the Route Table from the Logic App's subnet is not an issue because the Logic App doesn't need to connect to the Internet; the Internet connection is explicitly excluded by unchecking "Outbound internet traffic" on the VNet Integration configuration page.
  • In the page of the Event Hub Namespace with the configuration of its Virtual Network Integration there is a warning that I didn't noticed. It contains the following sentence: "We noticed that you have custom routing app settings. Routing settings on this page will not reflect the effect of app settings. After configuring routing on this page, we recommend removing the app settings". I need to investigate if the evidence reported in the message has any concrete effect and can be avoided.
  • In my presentation I have not specified the opportunity to add Network Security Groups (NSGs) to the configuration, according to the principle of "defense in depth". It's worth to consider that possibility.
  • As quickly mentioned at the end of the video, in my lab, my VM running Splunk was plugged on the same VNet which also includes the Private Endpoint of the protected Event Hub Namespace. Because I had no NSGs on that VNet, the traffic from Splunk was able to reach directly that Private Endpoint. In a real scenario, you may need to make adequate security networking configurations - depending on the type of connections - to ensure that your 3rd party SIEM can query the Event Hub (typically from a S2S VPN or Express Route circuit).
  • Please refer to this page for the details on the WEBSITE_CONTENTOVERVNET and vnetContentShareEnabled configuration parameters: App settings reference for Azure Functions | Microsoft Learn.
  • A good reference for the configuration of the networking on the Logic App can be found here: Secure traffic between Standard workflows and virtual networks - Azure Logic Apps | Microsoft Learn.
  • The configuration regarding the networking of the Event Hub Namespace via Private Endpoint is here: Integrate Azure Event Hubs with Azure Private Link Service - Azure Event Hubs | Microsoft Learn.
  • If you don't know where to start for automating the execution of this Logic App every time an incident is created or updated — such as when alerts are added or removed by Sentinel's correlation engine, or when the status is changed due to activities by security analysts — you can refer to this public documentation: Create and use Microsoft Sentinel automation rules to manage response | Microsoft Learn.
  • The configuration of the "Splunk Add-on for Microsoft Cloud Services" is described here: Introduction - Splunk Add-on for Microsoft Cloud Services.
  • The function for the "Set Variable" action - concatenating the different parts of the URL of the incident in the Unified Security Operation Portal is the following one:

setProperty(variables('OriginalIncident')['object'],'unifiedIncidentUrl',concat('https://security.microsoft.com/incident2/',variables('OriginalIncident')['object']['properties']['providerIncidentId'],'/overview'))        

  • The JSON schema for parsing the JSON object retrieved by the Sentinel Incident trigger is the following one:

{
    "type": "object",
    "properties": {
        "headers": {
            "type": "object",
            "properties": {
                "Accept-Encoding": {
                    "type": "string"
                },
                "Host": {
                    "type": "string"
                },
                "Max-Forwards": {
                    "type": "string"
                },
                "Correlation-Context": {
                    "type": "string"
                },
                "traceparent": {
                    "type": "string"
                },
                "x-ms-client-tracking-id": {
                    "type": "string"
                },
                "x-ms-correlation-request-id": {
                    "type": "string"
                },
                "x-ms-forward-internal-correlation-id": {
                    "type": "string"
                },
                "X-ARR-LOG-ID": {
                    "type": "string"
                },
                "CLIENT-IP": {
                    "type": "string"
                },
                "DISGUISED-HOST": {
                    "type": "string"
                },
                "X-SITE-DEPLOYMENT-ID": {
                    "type": "string"
                },
                "WAS-DEFAULT-HOSTNAME": {
                    "type": "string"
                },
                "X-Forwarded-Proto": {
                    "type": "string"
                },
                "X-AppService-Proto": {
                    "type": "string"
                },
                "X-ARR-SSL": {
                    "type": "string"
                },
                "X-Forwarded-TlsVersion": {
                    "type": "string"
                },
                "X-Forwarded-For": {
                    "type": "string"
                },
                "X-Original-URL": {
                    "type": "string"
                },
                "X-WAWS-Unencoded-URL": {
                    "type": "string"
                },
                "Content-Length": {
                    "type": "string"
                },
                "Content-Type": {
                    "type": "string"
                }
            }
        },
        "body": {
            "type": "object",
            "properties": {
                "eventUniqueId": {
                    "type": "string"
                },
                "objectSchemaType": {
                    "type": "string"
                },
                "objectEventType": {
                    "type": "string"
                },
                "workspaceInfo": {
                    "type": "object",
                    "properties": {
                        "SubscriptionId": {
                            "type": "string"
                        },
                        "ResourceGroupName": {
                            "type": "string"
                        },
                        "WorkspaceName": {
                            "type": "string"
                        }
                    }
                },
                "workspaceId": {
                    "type": "string"
                },
                "object": {
                    "type": "object",
                    "properties": {
                        "id": {
                            "type": "string"
                        },
                        "name": {
                            "type": "string"
                        },
                        "etag": {
                            "type": "string"
                        },
                        "type": {
                            "type": "string"
                        },
                        "properties": {
                            "type": "object",
                            "properties": {
                                "title": {
                                    "type": "string"
                                },
                                "severity": {
                                    "type": "string"
                                },
                                "status": {
                                    "type": "string"
                                },
                                "owner": {
                                    "type": "object",
                                    "properties": {
                                        "objectId": {},
                                        "email": {},
                                        "assignedTo": {},
                                        "userPrincipalName": {}
                                    }
                                },
                                "labels": {
                                    "type": "array"
                                },
                                "firstActivityTimeUtc": {
                                    "type": "string"
                                },
                                "lastActivityTimeUtc": {
                                    "type": "string"
                                },
                                "lastModifiedTimeUtc": {
                                    "type": "string"
                                },
                                "createdTimeUtc": {
                                    "type": "string"
                                },
                                "incidentNumber": {
                                    "type": "integer"
                                },
                                "additionalData": {
                                    "type": "object",
                                    "properties": {
                                        "alertsCount": {
                                            "type": "integer"
                                        },
                                        "bookmarksCount": {
                                            "type": "integer"
                                        },
                                        "commentsCount": {
                                            "type": "integer"
                                        },
                                        "alertProductNames": {
                                            "type": "array",
                                            "items": {
                                                "type": "string"
                                            }
                                        },
                                        "tactics": {
                                            "type": "array",
                                            "items": {
                                                "type": "string"
                                            }
                                        },
                                        "techniques": {
                                            "type": "array",
                                            "items": {
                                                "type": "string"
                                            }
                                        }
                                    }
                                },
                                "relatedAnalyticRuleIds": {
                                    "type": "array",
                                    "items": {
                                        "type": "string"
                                    }
                                },
                                "incidentUrl": {
                                    "type": "string"
                                },
                                "providerName": {
                                    "type": "string"
                                },
                                "providerIncidentId": {
                                    "type": "string"
                                },
                                "alerts": {
                                    "type": "array",
                                    "items": {
                                        "type": "object",
                                        "properties": {
                                            "id": {
                                                "type": "string"
                                            },
                                            "name": {
                                                "type": "string"
                                            },
                                            "type": {
                                                "type": "string"
                                            },
                                            "kind": {
                                                "type": "string"
                                            },
                                            "properties": {
                                                "type": "object",
                                                "properties": {
                                                    "systemAlertId": {
                                                        "type": "string"
                                                    },
                                                    "tactics": {
                                                        "type": "array",
                                                        "items": {
                                                            "type": "string"
                                                        }
                                                    },
                                                    "alertDisplayName": {
                                                        "type": "string"
                                                    },
                                                    "description": {
                                                        "type": "string"
                                                    },
                                                    "confidenceLevel": {
                                                        "type": "string"
                                                    },
                                                    "severity": {
                                                        "type": "string"
                                                    },
                                                    "vendorName": {
                                                        "type": "string"
                                                    },
                                                    "productName": {
                                                        "type": "string"
                                                    },
                                                    "productComponentName": {
                                                        "type": "string"
                                                    },
                                                    "alertType": {
                                                        "type": "string"
                                                    },
                                                    "processingEndTime": {
                                                        "type": "string"
                                                    },
                                                    "status": {
                                                        "type": "string"
                                                    },
                                                    "endTimeUtc": {
                                                        "type": "string"
                                                    },
                                                    "startTimeUtc": {
                                                        "type": "string"
                                                    },
                                                    "timeGenerated": {
                                                        "type": "string"
                                                    },
                                                    "providerAlertId": {
                                                        "type": "string"
                                                    },
                                                    "resourceIdentifiers": {
                                                        "type": "array",
                                                        "items": {
                                                            "type": "object",
                                                            "properties": {
                                                                "type": {
                                                                    "type": "string"
                                                                },
                                                                "workspaceId": {
                                                                    "type": "string"
                                                                }
                                                            },
                                                            "required": [
                                                                "type",
                                                                "workspaceId"
                                                            ]
                                                        }
                                                    },
                                                    "additionalData": {
                                                        "type": "object",
                                                        "properties": {
                                                            "ProcessedBySentinel": {
                                                                "type": "string"
                                                            },
                                                            "Alert generation status": {
                                                                "type": "string"
                                                            },
                                                            "Query Period": {
                                                                "type": "string"
                                                            },
                                                            "Trigger Operator": {
                                                                "type": "string"
                                                            },
                                                            "Trigger Threshold": {
                                                                "type": "string"
                                                            },
                                                            "Correlation Id": {
                                                                "type": "string"
                                                            },
                                                            "Analytics Template Id": {
                                                                "type": "string"
                                                            },
                                                            "Search Query Results Overall Count": {
                                                                "type": "string"
                                                            },
                                                            "Data Sources": {
                                                                "type": "string"
                                                            },
                                                            "Query": {
                                                                "type": "string"
                                                            },
                                                            "Query Start Time UTC": {
                                                                "type": "string"
                                                            },
                                                            "Query End Time UTC": {
                                                                "type": "string"
                                                            },
                                                            "Analytic Rule Ids": {
                                                                "type": "string"
                                                            },
                                                            "Event Grouping": {
                                                                "type": "string"
                                                            },
                                                            "Analytic Rule Name": {
                                                                "type": "string"
                                                            }
                                                        }
                                                    },
                                                    "friendlyName": {
                                                        "type": "string"
                                                    }
                                                }
                                            }
                                        },
                                        "required": [
                                            "id",
                                            "name",
                                            "type",
                                            "kind",
                                            "properties"
                                        ]
                                    }
                                },
                                "bookmarks": {
                                    "type": "array"
                                },
                                "relatedEntities": {
                                    "type": "array",
                                    "items": {
                                        "type": "object",
                                        "properties": {
                                            "id": {
                                                "type": "string"
                                            },
                                            "name": {
                                                "type": "string"
                                            },
                                            "type": {
                                                "type": "string"
                                            },
                                            "kind": {
                                                "type": "string"
                                            },
                                            "properties": {
                                                "type": "object",
                                                "properties": {
                                                    "accountName": {
                                                        "type": "string"
                                                    },
                                                    "upnSuffix": {
                                                        "type": "string"
                                                    },
                                                    "aadTenantId": {
                                                        "type": "string"
                                                    },
                                                    "aadUserId": {
                                                        "type": "string"
                                                    },
                                                    "isDomainJoined": {
                                                        "type": "boolean"
                                                    },
                                                    "displayName": {
                                                        "type": "string"
                                                    },
                                                    "additionalData": {
                                                        "type": "object",
                                                        "properties": {
                                                            "Sources": {
                                                                "type": "string"
                                                            },
                                                            "GivenName": {
                                                                "type": "string"
                                                            },
                                                            "IsDeleted": {
                                                                "type": "string"
                                                            },
                                                            "IsEnabled": {
                                                                "type": "string"
                                                            },
                                                            "Surname": {
                                                                "type": "string"
                                                            },
                                                            "TransitiveDirectoryRoles": {
                                                                "type": "string"
                                                            },
                                                            "UserType": {
                                                                "type": "string"
                                                            },
                                                            "UpnName": {
                                                                "type": "string"
                                                            },
                                                            "SyncFromAad": {
                                                                "type": "string"
                                                            },
                                                            "Country": {
                                                                "type": "string"
                                                            },
                                                            "MailAddress": {
                                                                "type": "string"
                                                            },
                                                            "PhoneNumber": {
                                                                "type": "string"
                                                            },
                                                            "AdditionalMailAddresses": {
                                                                "type": "string"
                                                            }
                                                        }
                                                    },
                                                    "friendlyName": {
                                                        "type": "string"
                                                    }
                                                }
                                            }
                                        },
                                        "required": [
                                            "id",
                                            "name",
                                            "type",
                                            "kind",
                                            "properties"
                                        ]
                                    }
                                },
                                "comments": {
                                    "type": "array"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}        
Nitin Sharma

Cyber Security Architect | Security Enthusiast & Advisor| Mentor| International Customer Success(iCSU) Microsoft, EMEA

4 个月

Very useful! Thanks for sharing.

Antonio Formato

Security and Compliance Technical Specialist presso Microsoft

4 个月

Thanks for sharing

Shyambabu Seegu

Cloud Consultant@EPAM

4 个月

Very informative

要查看或添加评论,请登录

Stefano Pescosolido的更多文章

社区洞察

其他会员也浏览了