Feedback:

Microsoft Azure Sentinel

Anomali Security Analytics can ingest event log data from Microsoft Azure Sentinel. The following article explains the steps you must complete to ingest Azure Sentinel logs into Anomali.

Onboarding steps

Step 1: Register with Azure Sentinel to Access the Log Analytics Workspace

Create a dedicated Microsoft Entra ID app for the integration. Refer to Microsoft documentation for complete details.

To create the app and configure necessary permissions:

  1. On the Azure portal, go to Microsoft Entra ID > App Registrations.

  2. Click New Registration.

  3. Register an application:

    1. Specify a user-facing display name. For example, Azure Sentinel Integration with Anomali.

    2. Select Accounts in this organizational directory as the account type.

    3. Leave Redirect URI blank.

    4. Click Register.

  4. Once the app is registered, select it to display its details.

  5. Copy the Application (client) ID and Directory (tenant) ID. You will need these IDs later.

Step 2: Configure API permissions

  1. Configure API permissions:

    1. In the left menu, go to API permissions and click Add a permission.

    2. Search for and select Log Analytics API.

    3. Select Application permissions, select the Data.Read check box, and click Add permissions.

    4. In the Configured permissions table, click Grant admin consent for your organization and click Yes in the dialog box.

Step 3: Set Client Secret

  1. Set up a client secret for the app.

    1. In the left menu, go to Certificates and secrets and click New client secret.

    2. Specify a description, select an expiration, and click Add. The secret is added to the Client secrets table.

    3. Copy the client secret to a secure location. You will need to provide it to Anomali later.

Step 4: Grant permissions

  1. Grant the application you registered earlier (Azure Sentinel Integration with Anomali) access to the Log Analytics workspace that contains the Sentinel logs on Azure:

    1. Go to the Log Analytics workspace that contains the Sentinel logs. In our example, it is staging-security-ws.

    2. Copy the Workspace ID. You will need to provide this ID to Anomali later.

    3. Click Access Control (IAM) > Add > Add role assignment.

      1. Select Log Analytics Reader from the Role list.

      2. Enter the name of your application in the Assign access to > Select field. Once the name is visible in the list, select it.

      3. Click Save.

Step 5: Add Azure Sentinel as new log source

To add Azure Sentinel as a new log source on the Anomali platform:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the log source.

  5. Select Azure Sentinel as the source type.

  6. Select API as the ingestion method.

  7. Select API as the ingest method.

  8. Provide the Basic Configuration details:

    1. Client Secret App client secret associated with the Application ID above.

    2. (Optional) Azure Sentinel Queries: Provide the Azure Sentinel queries.

    3. (Optional) Azure Sentinel Tenant ID: Enter the tenant ID assigned to your organization.

    4. (Optional) Azure Sentinel Client ID: Enter the application ID of the Azure AD app that can access your Log Analytics workspace.

    5. (Optional) Azure Sentinel Workspace ID: Enter the Workspace ID of the Log Analytics workspace.

  9. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.

    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  10. Click Save to add the log source.

Step 6: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 7: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 8: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.