Blog Post

Microsoft Entra Blog
3 MIN READ

CloudKnox Permissions Management is now in Public Preview

Alex_Simons's avatar
Alex_Simons
Icon for Microsoft rankMicrosoft
Feb 23, 2022
Last July we announced the acquisition of CloudKnox Security, a leader in Cloud Infrastructure Entitlement Management (CIEM). As an important move in our multicloud security vision, we have made trem...
Updated Mar 23, 2022
Version 3.0
Alex_Simons's avatar
Icon for Microsoft rankMicrosoft
Joined May 01, 2017
View Profile
Microsoft Entra Blog
Stay informed on how to secure access for employees, customers, and non-human identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions powered by AI.
rasad4468's avatar
rasad4468
Copper Contributor
Feb 02, 2023

TJBanasik

To onboard Cloud Knox Entra Provisioning data to Microsoft Sentinel, you will need to perform the following steps:

  1. Connect to Cloud Knox Entra Provisioning API: The first step is to connect to the CloudKnoxEntra Provisioning API to extract the relevant data. This data will include information on user permissions and access to sensitive resources.

  2. Configure Data Ingestion: Once you have connected to the CloudKnoxEntra Provisioning API, you will need to configure the data ingestion process in Microsoft Sentinel. This includes mapping the CloudKnox Entra Provisioning data fields to Sentinel data fields and defining the ingestion frequency.

  3. Validate Data Ingestion: After configuring the data ingestion process, you will need to validate the data ingestion to ensure that the CloudKnox Entra Provisioning data is being collected and processed correctly in Microsoft Sentinel.

  4. Create Alerts: Once the data ingestion process has been validated, you can create alerts in Microsoft Sentinel based on specific security-related events or conditions related to user permissions and access to sensitive resources.

  5. Monitor Alerts: The final step is to monitor the alerts and respond to any security incidents that are detected. Microsoft Sentinel provides a centralized dashboard for viewing and responding to alerts, and also integrates with Microsoft Teams for collaboration and communication.

In conclusion, to onboard CloudKnox/Entra Provisioning data to Microsoft Sentinel, you will need to connect to the CloudKnox/Entra Provisioning API, configure data ingestion, validate the data ingestion process, create alerts, and monitor the alerts for security incidents. This will provide you with real-time insights into your permission risk and help you detect and respond to security threats more effectively.