Enabling User Management with Active Directory Federation Services and Azure Entra ID

Anomali provides the capability to integrate with Microsoft Active Directory Federation Services (ADFS) and Azure Entra ID (formerly Azure Active Directory), thus enabling single sign-on (SSO) and ThreatStream user administration from Microsoft Active Directory (AD) or Azure Entra ID .

Notes:

  • After you configure SSO and use an IdP for user management, user accounts are automatically created on the Anomali platform when users authenticate to the Anomali platform from your IdP for the first time.

Requirements

  • The integration supports the following platforms:

    • Windows Server 2019 with an AD on Server 2019

    • Windows Server 2016 with an AD on Server 2016

      Note: Windows Server platforms must have an active ADFS service configured. Windows Server 2012 is not supported.

    • Azure Entra ID with an Azure Entra ID environment
  • You must have an active SAML 2.0 configuration on the Anomali platform. Contact Anomali Support for assistance.

Configuring Integration with ADFS and Azure Entra ID

Configuring the integration is a process, which consists of several steps. See the table below to learn about the steps required for the integration of the Anomali platform with ADFS and Azure Entra ID.

Microsoft AD Azure AD
1. Configuring the Integration on Microsoft AD 1. Configuring the Integration on Azure Entra ID
2. Creating Transform Claim Rules in ADFS 2. Enabling the Integration on the Anomali Platform
3. Enabling the Integration on the Anomali Platform  

Configuring the Integration on Microsoft AD

Note: These instructions pertain to Microsoft AD only. If you use Azure Entra ID, see Configuring the Integration on Azure Entra ID .

Configuring the integration on Microsoft AD involves creating groups that later will be mapped to specific roles on the Anomali platform.

To create groups in Microsoft AD:

  1. Right-click in the AD window and select New > Group.

  2. Enter a Group name for the new group.

  3. Under Group Scope, select Global.
  4. Under Group Type, select Security.
  5. Click OK. The group is created.

Repeat this process for every security group you need to create.

When configuration on Microsoft AD is complete, proceed to Creating Transform Claim Rules in ADFS to continue configuring the integration.

Creating Transform Claim Rules in ADFS

To export groups from Microsoft AD to the Anomali platform, you must configure a Transform Claim Rule for each group you created in Microsoft AD.

Note: This section pertains to Microsoft AD users only. No configuration in ADFS is required for Azure Entra ID users.

To create transform claim rules in ADFS:

  1. From ADFS, open the Relying Party Trusts directory.

  2. Right-click the Relying Party Trust associated with ThreatStream and select Edit Claim Issuance Policy.

  3. If the following rules of the Send LDAP Attributes as Claims template type are configured on your system, proceed to step 4:

    • Get LDAP attributes as claims

    • Email to Name ID

      Otherwise, click the link below and follow the instructions provided.

    To create the Get LDAP attributes as claims rule:

    1. Click Add Rule, on the Edit Claim Issuance Policy page.

      The Add Transform Claim Rule Wizard opens.

    2. On the Select Rule Template page, under Claim rule template, select Send LDAP Attributes as Claims, and click Next.

    3. On the Configure Rule page, enter Get LDAP attributes as claims in the Claim rule name field.

    4. Select or type E-Mail Addresses  in the LDAP Attribute column.

    5. Select or type E-Mail Address in the Outgoing Claim Type column.

    6. Click Finish.

    7. In the Edit Claim Rules dialog box, click OK to save the rule.

    To create the Email to Name ID rule:

    1. In the Edit Claim Issuance Policy dialog box, click Add Rule to start the rule wizard. The Add Transform Claim Rule Wizard opens.

    2. On the Select Rule Template page, under Claim rule template, select Transform an Incoming Claim and click Next.

    3. On the Configure Rule page, under Claim rule name, enter Email to Name ID.

      In Incoming claim type, select E-Mail Address.
      In Outgoing claim type, select Name ID, and then select one of the following options, which depends on the requirements of your organization:

      • Pass through all claim values

      • Replace an incoming claim value with a different outgoing claim value

      • Replace incoming e-mail suffix claims with a new e-mail suffix

    4. Click Finish.

    5. On the Edit Claim Rules page, click OK to save the rule.

  4. On the Edit Claim Issuance Policy page, click Add Rule to create a rule for an AD group.

  5. Select Send Group Membership as a Claim from the Claim rule template drop-down list.

  6. In the corresponding field, enter a claim rule name for the rule. Anomali recommends using the name of the AD group for which you are creating the rule.

  7. Under User's group, click Browse and select the prior created AD group for which you are creating the rule.
  8. Under Outgoing claim value, enter the exact value of the AD group name for which you are creating the rule.
  9. Click Finish.

Repeat this process described for the Send Group Membership as a Claim template for each group you created in AD. After adding rules for each group, proceed to Enabling the Integration on the Anomali Platform to complete configuration within the Anomali platform.

Configuring the Integration on Azure Entra ID

If you use Azure Entra ID (formerly Azure Active Directory), you can use the instructions in this section to complete the Azure Entra ID configuration steps. The Anomali platform supports the mapping of roles to Azure Entra ID groups. You can use these groups in your Azure environment to manage user access within the Anomali platform.

Note: These instructions pertain to Azure Entra ID only. If you use Microsoft AD, see Configuring the Integration on Microsoft AD.

To configure the integration on Azure Entra ID:

  1. Create a non-gallery Enterprise Application for ThreatStream.

    1. Log in to the Azure portal.
    2. Within Entra ID, navigate to Manage > Enterprise applications.
    3. Click New application.
    4. Click Create your own application.

    5. In the Input name field, enter a name for the application .

      Recommended value: ThreatStream

    6. Select Integrate any other application you don't find in the gallery (Non-gallery).

    7. Set Assignment required? to No.

    8. Click Create. The application is created. You are directed to the Overview screen of the application.

  2. Enable SAML for the application.

    1. From the Manage page of the ThreatStream application, click Single sign-on.
    2. Under Select a single sign on method, click SAML.
    3. In the Basic SAML Configuration box, click Edit.

    4. Under Identifier (Entity ID), enter an ID for the SAML configuration.

      Anomali recommends using the ThreatStream API URL: https://optic.threatstream.com

    5. Enter the following Reply URL:

      https://optic.threatstream.com/api/v1/saml2/<IdP-name>/acs/

      where <IdP-name> is the name of your identity provider (IdP). See Configuring Single Sign On (SSO) for more information.

    6. Click Save.

  3. Add a Claim for the SAML configuration.

    1. In the User Attributes & Claims box, click Edit.
    2. Click Add new claim.

    3. Enter a Name for the claim.

      Required value: emailaddress

    4. Enter the following Namespace value:

      http://schemas.xmlsoap.org/ws/2005/05/identity/claims

    5. For Source, select Attribute.
    6. For Attribute, select user.mail.
    7. Click Save.

  4. Add a Group Claim for the SAML configuration.

    1. On the User Attributes & Claims page, click Add a group claim.
    2. Under Which groups associated with the user should be returned in the claim?, select Security Group.
    3. For Source attribute, select Group ID.
    4. Select Customize the name of the group claim.
    5. Select Emit groups as role claims.
    6. Click Save.
    Anomali recommends adding a filter to the claim to only send ThreatStream groups. Alternatively, ensure that the ThreatStream groups are not dropped from the claim due to exceeding the maximum number of groups in a claim.

  5. Collect your SAML Signing Certificate, Login URL, and Azure AD identifier. You will use this information when configuring your identity provider in ThreatStream. To locate this information:

    1. From the SAML-based Sign-on screen for the application, locate the SAML Signing Certificate box. Next to Certificate (base 64), click Download.
    2. Locate the Set up <application name> box. Note the Login URL (also known as SAML Single Sign-On Service URL) and Azure AD Identifier (also known as SAML Entity ID) values.

  6. Create a group in Azure AD corresponding to a role in ThreatStream, as well as one additional group that grants users access to ThreatStream.

    To add groups in Azure Entra ID:

    1. From the Azure Entra ID Overview page, click Groups under Manage in the left menu.
    2. Click New Group.
    3. Under Group type, select Security.
    4. Under Group name, enter the name of the permission.

    5. Click Create. The group is created.

      Note: The newly created security groups must be assigned to the proper Enterprise application (ThreatStream) to be visible when the application calls for the permissions.

      Repeat this process for each group you want to create.

  7. Note the Object ID values for each role you created. You will use these IDs to finish configuring the integration within the Anomali platform in a later step.

When configuration on Azure Entra ID is complete, proceed to Enabling the Integration on the Anomali Platform to complete configuration within the Anomali platform.

Enabling the Integration on the Anomali Platform

To finish configuring the integration, you must configure a Break Glass account and map the groups created in Microsoft AD or Azure Entra ID  to their corresponding Anomali roles.

Note: You must use an account with the Organization Administrator role to complete the steps in this section.

To enable the integration on the Anomali platform:

  1. In the bottom-left corner of the side navigation panel, click Settings () > User & Role Management.

  2. Click the SSO tab.

  3. From the Break Glass Account drop-down list, select a user account that will serve as the Break Glass Account.

    Notes: 

    • Only account of organization administrators are available in the drop-down list.

    • The Break Glass Account should be an independent, local account on the Anomali platform. Another account with the same configuration must not exist in the SSO IdP. Doing so will cause login failures. See Managing Users to learn how to create a local account on the Anomali platform.

  4. (Recommended) Enable the Use SSO exclusively if you want to prevent users from logging in through the Anomali platform login page.
  5. Add an identity provider, as described in Configuring an Identity Provider for SSO.

  6. After the identity provider is configured, specify ADFS or Azure AD under Permission management.

  7. If you selected ADFS, you must assign roles to every group you created on Microsoft AD.

    If you selected Azure AD, you must assign roles to every group you created on Azure Entra ID.

    To assign Anomali roles to IdP groups:

    1. Click New.

    2. In the SSO Role Mapping dialog box, enter an IdP group name.

    3. Select roles for this group.

    4. Click Save.

      The SSO role mapping is create successfully.

Repeat this process for each IdP group.

Configuration is complete and your integration is now active.