1. Expel Support Center
  2. Connect your technology
  3. SIEM integrations

Azure Sentinel setup for Workbench

Sharon Burton
  • Updated

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!

This article provides prerequisites and onboarding steps for Azure Sentinel.

Before you start

Before getting started, make sure you have an Azure Active Directory (AD) admin on hand to grant permissions.

Step 1: Enable console access

Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech.

  1. Sign in to the Azure portal as a user who is assigned a limited administrator directory role or the Guest Inviter role.

  2. In the navigation pane, select Azure Active Directory.

    Azure_active_directory (2).png

  3. Under Manage, select Users.

  4. Select New guest user.

  5. On the New user page, select Invite user, fill out the email address (expel_analyst@expel.io), and optionally include a message.

  6. Under roles, add the Global Reader role.

  7. Select Invite to automatically send the invitation to the guest user.

  8. After you send the invitation, the user account is automatically added to the directory as a guest.

Step 2: Enable API Access for Workbench

To integrate Azure Sentinel with Workbench, we need to create secure credentials to the API. You have 2 options for enabling API access:

  • Option 1: Enabling the Expel Azure Integration Enterprise Application within Azure

  • Option 2: Creating a custom Azure Active Directory (AD) Application

In most cases, enabling the Enterprise Application (option 1) is the recommended approach. However, because Enterprise Application supports access for multiple Microsoft integrations (Azure, Sentinel, Azure Log Analytics, and so on), it can be the case that the permissions granted to the Enterprise Application are more than the minimum required for the Azure Sentinel integration alone.

The second option is for cases where the absolute minimum permissions are required. In either case, the table below lists the required items that should be obtained during this step:

Item we need

Description

Azure Directory

(Tenant) ID

A unique identifier for your Azure instance. Workbench needs this information to route our API requests to the right place.

Application (client) ID (Option 2 only)

A unique identifier for the application you create that grants Workbench the access it needs to your Azure instance.

Application (client) Secret (Option 2 only)

The API secret that allows Workbench to authenticate as the created application to your Azure instance.

Option 1: Enabling the Expel Azure Integration Enterprise Application within Azure

  1. As an Administrator, navigate to the Expel Admin Consent Page.

  2. Review and accept requested permissions.

  3. The Expel Azure Integration app should now appear under Enterprise Applications. Review properties and make sure that all permissions were properly granted.

Note the Directory (Tenant) ID when viewing the Expel Azure Integration application for use in later steps.

Option 2: Create custom Azure AD application

  1. As an Azure administrator, log in to the Azure Portal and open Azure Active Directory.

  2. Navigate to App registrations and create a new app by clicking + New registration.

  3. Fill in the application details. You can fill these in however you want, but we recommend the following:

    Expel_cloud_service.png

    • Name: Expel Cloud Service.

    • Supported account types: Accounts in this organizational directory only (first option).

  4. After you fill out the fields, click Register to create the new application.

  5. You should be navigated automatically to the Settings page for the Expel Cloud Service app you just created. If not, navigate to Azure Active Directory > App Registrations > View all applications (if you don’t see the new app) > Expel Cloud Service.

  6. Make a note of the Application (Client) ID and the Directory (Tenant) ID for use in later steps.

    clientID_tenantID.png

  7. Navigate to API permissions and click +Add a permission.

    add_a_permission.png

  8. Click APIs my organization uses, type Log Analytics and select Log Analytics API>Application Permissions.

    Azure Sentinel One_figure8.png

  9. Search for Data.Read, select the permission, and click Add permissions. You return to the API permissions page for the application.

  10. Click +Add a permission.

  11. Click APIs my organization uses, type Microsoft Graph and select Microsoft Graph>Application Permissions.

  12. Search for SecurityEvents.Read.All, select the permission, and click Add permissions.

  13. After permissions are assigned, click Grant admin consent, and Yes at the prompt.

    grant_admin_consent.png

  14. Navigate to Expel Cloud Service>Certificates & secrets to begin creating an API key (aka client secret). To create a new key, click + New client secret.

    new_client_secret.png

  15. Add a description for the secret (for example, ExpelAPI) and select Never for expiration. Click Add to create the secret.

  16. You see a new client secret (API Key) appear under Client secrets. Copy the value and ID and save it for later. It disappears after you navigate away from this screen.

    secret_value.png

Step 3: Enable Azure Log Analytics access

Azure Sentinel can be run on top of multiple Azure Log Analytics workspaces. These workspaces are used as data stores for the Azure Sentinel service. Querying these Azure Log Analytics workspaces allows Expel to enrich Azure Sentinel alerts with the Azure Log Analytics context that originally generated that alert.

To view all Azure Log Analytics workspaces associated with Azure Sentinel, navigate to the Azure Sentinel blade within the Azure Portal.

Azure Sentinel One_figure13.png

The Azure Log Analytics Reader role must be given to the Azure AD Application created in Step 2 for each of the Azure Sentinel-enabled Azure Log Analytics workspaces that should be monitored. Access can be granted in 2 ways or through some combination.

  • Option 1: Per individual Azure Log Analytics workspace.

  • Option 2: For all workspaces within an Azure subscription.

Tip

The Expel Azure Sentinel integration only monitors Azure Sentinel running on top of Log Analytic workspaces that it's allowed to read from. If Azure Sentinel is running on top of a Azure Log Analytics workspace that are not granted permissions through the following steps, it isn't monitored.

Option 1: Enable Azure Log Analytics Access per Workspace

The following steps outline how to enable Azure Log Analytics Reader role per a single Azure Log Analytics workspace. These steps must be repeated for each monitored Azure Log Analytics workspace:

  1. As an Azure administrator, log in to the Azure Portal.

  2. In the navigation pane, select Azure Log Analytics workspaces.

  3. Click the name of the workspace whose role assignments you want to change.

  4. Click Access Control (IAM) > + Add > Add role assignment.

    add_role_assignment_workspace.png

  5. In the Add role assignment pane set the following fields:

    • Role: Azure Log Analytics Reader.

    • Assign access to: Azure Ad user, group or application.

    • Select: Search and click the Azure AD App created in Step 2.

  6. Click Save.

    Repeat these steps for all workspaces to be monitored.

Option 2: Enable Azure Log Analytics Access per Subscription

The following steps outline how to enable Azure Log Analytics Reader role per an Azure Subscription. These steps must be repeated for each monitored Azure Subscription.

  1. As an Azure administrator, log in to the Azure Portal.

  2. In the navigation pane, select Subscriptions.

  3. Click the subscription whose role assignments you want to change.

  4. Click Access Control (IAM) > + Add > Add role assignment.

    add_role_assignment_subcription.png

  5. In the Add role assignment pane set the following fields:

    • Role: Azure Log Analytics Reader.

    • Assign access to: Azure Ad user, group or application.

    • Select :Search and click the Azure AD App created in Step 2.

  6. Click Save.

    All Azure Log Analytics workspaces within this subscription can be monitored.

    Repeat these steps for any other subscriptions to be monitored.

Step 4: Configure Azure Sentinel in Workbench

Now that we have the correct access configured and noted the credentials, we can integrate your tech with Workbench.

  1. In a new browser tab, login to https://workbench.expel.io/settings/security-devices?setupIntegration=azure_sentinel.

  2. Complete all fields using the credentials and information you collected in Step 2 and Step 3.

    Field name

    What to put in it

    Name

    What you want to name the security device.

    Location

    Microsoft Cloud

    Directory (Tenant) ID

    Azure AD Tenant/Directory ID

    Application (Client) ID (Option 2 only)

    The Azure Application (Client) ID that we saved in Step 2, Option 2.

    Application (Client) Secret (Option 2 only)

    The Client (Application) Secret that we saved in Step 2, Option 2.

    Workspace IDs

    (Optional)

    This optional field accepts a comma-separated list of Azure Log Analytics workspace IDs. By default, the integration monitors any workspaces which have permissions assigned in Step 3. This field can be used to define a subset of those workspaces that should be monitored. This can be useful when assigning permissions at the Azure subscription level, but you want to only monitor some Azure Sentinel workspaces within that subscription.

    To get the Azure Log Analytics workspace ID associated with an Azure Sentinel workspace:

    1. Navigate to the Azure Sentinel blade within the Azure Portal.

    2. Click the Azure Sentinel workspace.

    3. Click Settings > Workspace Settings and the Workspace ID is listed at the top of the Overview.

  3. Click Save.

To check if alerts are coming through, navigate to Alerts on the console page. Click the icon in the upper right to switch to grid view, then check the list for device alerts.

  • Was this article helpful?

  • 0 out of 0 found this helpful

Related articles