Cloud Integrations
      Back to home
      1. Help Center
      2. Cloud Integrations

      Microsoft Sentinel

      Ingest Alert, Incident, and Event data from Microsoft Sentinel on the AgileBlue Security Operations Platform. This integration collects data via the REST API and Event Hubs.

      Overview

      AgileBlue's integration with Microsoft Sentinel allows for ingestion of Alert and Incident data via the Microsoft Sentinel REST API. Event data is ingested from the Microsoft Azure Event Hub, allowing for wider visibility into related activity.

      API Configuration

      Follow the steps below to set up a Microsoft Azure application which will collect Alert and Incident data from Microsoft Sentinel via the REST API.

      Configure Your Azure Application

      1. Log in to the Azure Portal using your Global Administrator credentials. (E.g. an account that is marked as Global Administrator.)
      2. Navigate to the Microsoft Entra ID under Azure services
      3. Select App Registrations in the left-hand menu
      4. Click New registration
        1. Name: AgileBlue Microsoft Sentinel
        2. Supported account types: Accounts in this organizational directory only (Your tenant only - Single tenant)
        3. Redirect URI: No value/not needed
      5. Select Register

      Add Required Permissions

      1. Within the application created in the previous step, select View API permissions
      2. Click Add a permission
      3. Add the following Microsoft Graph permissions
        1. SecurityAlert.Read.All (Application & Delegated)
        2. User.Read (Delegated)
      4. After permissions have been selected, click Add permissions
      5. Select Grant admin consent for [your tenant name]

      Create Client Secret Key & Collect Account Details

      1. Select Certificates & secrets from the left-hand menu
      2. Once the page loads, click New client secret
      3. On the pop out that appears, provide a Description of AgileBlue Microsoft Sentinel Collection Service and select your desired timeframe for expiration
        1. Please note this expiration date of the secret value
      4. Click Add

        CAUTION! Depending on your version of Azure/Office365 and/or your security configurations, you may only have ONE CHANCE to grab this value. Be sure to copy this value and store it somewhere safe immediately.

      5. Copy the Secret Value to a secure location
        1. NOTE: The Secret Value is different than the Secret ID. The required value may have numbers, letters, and special characters. The Secret ID will only include numbers, letters, and hyphens. Please ensure the Secret Value is collected, not the Secret ID.
      6. Navigate back to the Overview page and copy the following values:

        1. Application (client) ID

        2. Directory (tenant) ID

      Gather Additional Required Information

      1. Navigate to Microsoft Sentinel and select the desired workspace on your list
      2. Take note of the following information, which will need to be provided to AgileBlue:
        1. Workspace Name
        2. Subscription ID
        3. Resource Group

      Event Hub Configuration

      Follow the steps below to set up an Event Hub which will collect Event data from Microsoft Sentinel and stream this information back to AgileBlue.

      Create a Resource Group

      1. Log into your Azure Portal
      2. Select Resource Group from the menu then click + Create
      3. Designate the Subscription in which the resource group should be created
      4. Assign a unique name to the group (Ex. AgileBlue-Resource-Group)
      5. Select the Region
      6. Click Review + Create

      Create an Event Hubs Namespace

      1. Navigate to All Services in the left-hand menu and click Event Hubs under Analytics
      2. Click + Create in the top left-hand corner
      3. Select the subscription where your Sentinel environment is deployed
      4. Choose the Resource Group created in the prior section
      5. Input name for the Event Hubs Namespace
      6. Select a Location
      7. Select a pricing tier, likely Standard for this integration
      8. Click Review + Create
      9. Review the settings then click Create and wait for the deployment to complete
      10. Once on the Deployment page, click Go to resource
      11. Verify that you see the Event Hubs namespace page with the name provided earlier in this section

      Create an Event Hub

      1. While on the Event Hubs namespace Overview page, click +Event Hub
      2. Give a name for the event hub (all lower case, no special characters other than -)
      3. Leave all other settings as default unless otherwise required
      4. Click Review + create
      5. On the following page, select Create if all settings look accurate
      6. Once the Event Hub is created, you will see it under the list of Event Hubs in the Event Hubs Namespace

      Enable Log Analytics Export

      1. Navigate to the Log Analytics Workspaces
      2. Choose the Workspace associated with your Azure Sentinel deployment
      3. Go to Data Export
      4. Select New export rule
      5. Provide a rule name under the Basic section and select the desired tables you want to export to a storage account under the Source section
      6. Under Destination, enter select Event Hub as the Type and fill in the following the additional details (subscription, region, event hubs namespace, event hub name, etc.)
      7. Select Review + create then click Create

      Gather Required Information

      1. Event Hub Connection string-primary key
        1. Navigate to the Event Hubs namespace and select Shared Access Policies
        2. Click RootManageSharedAccessKey and copy the connection string-primary key, which will need to be provided to AgileBlue
      2. Storage Account
        1. Navigate to All Services > Storage > Storage Accounts
        2. Click Create Storage Account and complete the settings based on the information created so far in this guide
        3. Note the Storage account name which will need to be provided to AgileBlue
        4. Click Review + create
        5. On the review page, copy the Storage Account Name and the values under Key 1 (Key and Connection string)

      Send Required Information to AgileBlue

      Once all prior steps have been completed, send the following information back to AgileBlue Support  via a secure communication method:

      • Azure Application
        • Application (client) ID
        • Directory (tenant) ID
        • Secret Value
        • Secret Value Expiration Date
      • Event Hub
        • Event Hub Name (NOTE: This is the name of the event hub, NOT the name of the Event Hubs namespace)
        • Connection String
        • Storage Account Name
        • Storage Account Key

      Questions? Contact AgileBlue Support.

      Email: support@agileblue.com
      Phone: (216) 606-9400