Skip to main content
 

This article provides prerequisites and onboarding steps for Azure Cloud (direct).

Wizard vs. Manual Onboarding

We’ve made onboarding easier! You can use our Azure Wizard, which employs Azure templates, to programmatically connect your Azure instance. 

You can easily deploy RBAC subscription roles in Azure, allowing you to decide whether Expel should monitor one or more subscriptions. Expel can also connect to existing log storage accounts, or create new ones on your behalf.

Creating and maintaining additional storage logs can result in additional fees from Microsoft Azure. If you enable storage logging, it's applied to all storage accounts deployed in your subscription. 

If you choose to connect manually, continue with this guide.

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!

  1. Have an Azure Active Directory (AD) admin on hand to grant permissions.

  2. Install Office 365 to monitor AD activity logs.

  3. Enabling Azure Defender is strongly recommended by Expel to monitor Azure infrastructure. Azure Defender can be enabled on a per resource basis or for resource groups. The following Azure Defender services are currently supported by Expel:

    • Azure Storage

    • Azure KeyVault

    • Azure Resource Manager

    • Azure App Service

    • Azure SQL Service

    • Azure Cosmos DB Service

Step 1: Enable console access

  1. Sign into the Azure portal as a user who is assigned a limited administrator directory role or the Guest Inviter role.

  2. In the navigation pane, click Azure Active Directory.

    Azure_active_directory (2).png
  3. Under Manage, select Users.

  4. Select New guest user.

  5. On the New user page, click Invite user, fill out the email address (expel_analyst@expel.io), and optionally include a message.

  6. Under roles, add the role Global Reader role.

  7. Click Invite to automatically send the invitation to the guest user.

  8. After you send the invitation, the user account is automatically added to the directory as a guest.

Step 2: Enable Azure Application access

To integrate the technology with Expel, we need to create secure credentials to the API. You have 2 options for enabling API access:

  • Option 1: Enable the Expel Azure Integration Enterprise Application within Azure.

  • Option 2: Create a custom Azure Active Directory (AD) Application.

Usually, enabling the Enterprise Application is the recommended approach. However, because Enterprise Application supports access for multiple Microsoft integrations (Sentinel, Azure Log Analytics, and so on), it may be the case that the permissions granted to the Enterprise Application are more than the minimum required for the Azure integration specifically.

The second option is offered for cases where the absolute minimum permissions are required. In either case, the table below lists the required items to be obtained during this step:

Item we need

Description

Directory (tenant) ID

Unique identifier for your Azure AD instance. Expel needs this information to route our API requests to the right place.

Application (client) ID (Option 2 only)

Unique identifier for the application you create that grants Expel the access it needs to your Azure instance.

Application (client) Secret (Option 2 only)

API secret that allows Expel to authenticate as the created application to your Azure instance.

Option 1: Enable Azure Enterprise Application

  1. As an Administrator, navigate to the Expel Admin Consent Page.

  2. Review and accept requested permissions.

  3. The Expel Azure Integration app now appears under Enterprise Applications. Review properties and make sure that all permissions are properly granted.

Option 2: Create Custom Azure AD Application

  1. As an Azure administrator, log in to the Azure Portal.

  2. Navigate to Azure Active Directory > App registrations and click +New registration.

  3. Fill in the application details. You can fill these in however you want, but we recommend the following:

    Expel_cloud_service (2).png
    • Name: Expel Cloud Service.

    • Supported account types: Accounts in this organizational directory only (first option).

  4. After you fill out the fields, click Register to create the new application.

  5. You should be navigated automatically to the settings page for the Expel Cloud Service app you just created. If not, navigate to Azure Active Directory > App Registrations > View all applications (if you don’t see the new app) > Expel Cloud Service.

  6. Make a note of the Application (client) ID and the Directory (tenant) ID for use in later steps.

    clientID_tenantID.png
  7. Open API permissions. Click + Add a permission.

    add_a_permission.png
  8. Click APIs my organization uses, type Log Analytics and select Log Analytics API > Application Permissions.

    log_analytics.png
  9. Search for Data.Read, select the permission and click Add permissions. The API permissions page for the application appears.

  10. Click +Add a permission.

  11. Click on APIs my organization uses, type Microsoft Graph and select Microsoft Graph > Application Permissions.

  12. Search for SecurityEvents.Read.All, select the permission, and click Add permissions.

  13. After permissions are assigned, click Grant admin consent and Yes.

    grant_admin_consent.png
  14. Navigate to Expel Cloud Service > Certificates & secrets to begin creating an API key (aka client secret). To create a new key, click +New client secret.

    new_client_secret.png
  15. Add a description for the secret (for example: ExpelAPI) and select Never for expiration. Click Add to create the secret.

  16. You see a new secret (API Key) appear under Client secrets. Copy the value and save it for later. It may disappear when you navigate away from this screen.

    secret_value.png

Step 3: Enable roles within Azure subscriptions

Some event sources within Azure require Role-Based Access (RBAC) roles to be granted to the Azure AD Application within each Azure subscription. One of these RBAC roles granted to our Azure AD Application should also be granted to the Expel user created in Step 1 to allow Expel to investigate further into any alerts.

This section walks through granting the Azure Log Analytics Reader role to both the Azure AD Application from Step 2 and the Expel user from Step 1. For more information on these roles, see the following:

  1. Navigate to Subscriptions in the main Azure service menu by searching Subscriptions.

    Screen Shot 2021-03-05 at 12.34.34 PM.png
  2. Select the subscription(s) Expel will monitor. This step is a requirement or Expel cannot poll any logs. Repeat the steps below for each subscription.

    azure_figure 9.png
  3. Add the below roles by clicking Access Control (IAM) > +Add > Add role assignment, assigning access to Azure AD user, group or application, and selecting the Expel Azure Integration enterprise app or Expel Cloud Service app that was created earlier.

  4. Repeat the above step and assign Log Analytic Reader role to Azure AD user:expel_analyst@expel.io.

Step 4: Enable Azure Resource Logs

The Expel Azure Integration monitors alerts and logs across a variety of Azure resources. Some of these alerts and logs are accessible by default, but some must be enabled for Expel to monitor that particular resource.

The following Azure resources require user configuration to be monitored. Note that not all Azure deployments use these resources and enabling logging within the resources only widens the Expel default monitoring capabilities for Azure.

Create a Resource Log Storage Account

The Expel integration collects resource logs from an Azure Storage Account. This section outlines how to create that storage account and provide access to Expel.

  1. Create a V2 Storage account.

  2. Add the below role by clicking Access Control (IAM) > +Add > Add role assignment, assigning access to Azure AD user, group or application, and selecting the Expel Azure Integration enterprise app or Expel Cloud Service app that was created earlier

    • Storage Blob Data Reader

      new_image_4.png
      new_image_5.png
  3. Storage accounts can have Network Access Control Lists (ACLs) set that limit which IP addresses can access those accounts. Expel has 6 egress IP addresses that can be allowed. All requests to storage accounts come from 1 of 6 IP addresses. We’ve designed this so it can scale significantly without us having to add new IP addresses to the list.

  4. Azure also provides a way to allow for logs to be read from these types of accounts without having to enable access or change existing Network ACLs. Navigate to Networking from the menu and click Firewalls and virtual networks.networking.png

  5. If Allow access from is set to Selected networks, select the Allow read access to storage logging from any network to allow access to logs. Note: The access to these logs is still managed through RBAC roles.

    allow_access.png

Enable Azure Storage Logs

Azure Storage logs give Expel context around Azure user activity to help us to determine whether that activity is malicious. If you’re unsure of whether to enable logging for storage accounts, work with your engagement manager to help determine what approach is best for you.

  1. Navigate to the Storage Account view within the Azure portal. The following steps must be done for each Storage Account.

  2. Select Diagnostic settings menu.

    mceclip0.png
  3. For each storage type: Blob, File, Queue, and Table, click Add diagnostic setting.

  4. For the log category, select StorageRead, StorageWrite, StorageDelete, and archive to the storage account created in previous steps.

    new_image_3.png
  5. Repeat steps 2-5 for each storage account that Expel must monitor.

Enable Azure Storage Logs - Classic

If you are using Classic deployment, use the following steps to enable Classic storage account logging.

  1. Navigate to the Storage Account view within the Azure portal. The following steps must be done for each Classic Storage Account:

  2. Select Diagnostics settings (classic) menu.

    Step5.png
  3. Turn Status to On if not already set. Ensure each operation is selected under Logging section for each tab: Blob, File, Queue, and Table properties.

    Step53.png
  4. Assign the Expel Enterprise Application or Custom Azure Active Directory (AD) Application to the Storage Blob Data Reader role for each Classic Storage Account that is going to be monitored. Access Control (IAM) > +Add > Add role assignment. See beginning of Step 4 for details.

    to the Storage Blob Data Reader role for each Classic Storage Account that is going to be monitored. Access Control (IAM) > +Add > Add role assignment, see beginning of Step 4 for details.

Step 5: Configure Azure in Workbench

  1. In a new browser tab, log into https://workbench.expel.io/settings/security-devices?setupIntegration=azure.

  2. Complete all fields using the credentials and information you collected in Option 1 or Option 2.

    Screen Shot 2021-03-05 at 12.38.23 PM.png

    Field Name

    What to put in it

    SIEM

    Select Expel Cloud Service.

    Name

    The name you assign the security device.

    Location

    Microsoft Cloud.

    Directory (tenant) ID

    Azure AD Directory/Tenant ID.

    Application (client) ID (Option 2 only)

    The Azure Application (Client) ID that we saved in Option 2.

    Application (client) Secret (Option 2 only)

    The Client Secret that we saved in Option 2.

    Use storage account contributor role (Y/N)

    Leave this blank - this field is only used to support legacy onboarding.