Min Diagnostic Event Categories for Azure Sentinel

Question

HelloI've been trying to find some definitive recommendations on what event categories we should send in a diagnostic setting to the analytics workspace that the sentinel will ingest.&nbsp; I'm looking for only the categories that would have useful security information.&nbsp; Does anyone have some suggestions?&nbsp;&nbsp;&nbsp;

ibnmbodji · Answer

thidalgo&nbsp;I would Say Security . You can find the description for each category below&nbsp;Ref :&nbsp;https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema&nbsp;CategoryDescriptionAdministrativeContains the record of all create, update, delete, and action operations performed through Resource Manager. Examples of Administrative events include&nbsp;create virtual machine&nbsp;and&nbsp;delete network security group.Every action taken by a user or application using Resource Manager is modeled as an operation on a particular resource type. If the operation type is&nbsp;Write,&nbsp;Delete, or&nbsp;Action, the records of both the start and success or fail of that operation are recorded in the Administrative category. Administrative events also include any changes to Azure role-based access control in a subscription.Service HealthContains the record of any service health incidents that have occurred in Azure. An example of a Service Health event&nbsp;SQL Azure in East US is experiencing downtime.Service Health events come in Six varieties:&nbsp;Action Required,&nbsp;Assisted Recovery,&nbsp;Incident,&nbsp;Maintenance,&nbsp;Information, or&nbsp;Security. These events are only created if you have a resource in the subscription that would be impacted by the event.Resource HealthContains the record of any resource health events that have occurred to your Azure resources. An example of a Resource Health event is&nbsp;Virtual Machine health status changed to unavailable.Resource Health events can represent one of four health statuses:&nbsp;Available,&nbsp;Unavailable,&nbsp;Degraded, and&nbsp;Unknown. Additionally, Resource Health events can be categorized as being&nbsp;Platform Initiated&nbsp;or&nbsp;User Initiated.AlertContains the record of activations for Azure alerts. An example of an Alert event is&nbsp;CPU % on myVM has been over 80 for the past 5 minutes.AutoscaleContains the record of any events related to the operation of the autoscale engine based on any autoscale settings you have defined in your subscription. An example of an Autoscale event is&nbsp;Autoscale scale up action failed.RecommendationContains recommendation events from Azure Advisor.SecurityContains the record of any alerts generated by Azure Security Center. An example of a Security event is&nbsp;Suspicious double extension file executed.PolicyContains records of all effect action operations performed by Azure Policy. Examples of Policy events include&nbsp;Audit&nbsp;and&nbsp;Deny. Every action taken by Policy is modeled as an operation on a resource.

thidalgo · Answer

Thanks for that. And that table is what had me thinking, administrative events like create, update, delete operations...wouldn't that be interesting information to correlate with security events if sentinel allows this kind of correlation.

ibnmbodji · Answer

HiIn any case if you are using adavanced threat protection + analytics abnormal operations ( delete many files in a short time ) will be detected as security issues . If you build a good RBAC strategy leveraging least privilege and custom roles if needed you may have less false positives when adding administrative operations so yes that make sense.

digitalohm · Answer

just bumping this up to see if anyone has more insights. thanks!

Forum Discussion

Min Diagnostic Event Categories for Azure Sentinel

Share

Resources

Category	Description
Administrative	Contains the record of all create, update, delete, and action operations performed through Resource Manager. Examples of Administrative events include create virtual machine and delete network security group. Every action taken by a user or application using Resource Manager is modeled as an operation on a particular resource type. If the operation type is Write, Delete, or Action, the records of both the start and success or fail of that operation are recorded in the Administrative category. Administrative events also include any changes to Azure role-based access control in a subscription.
Service Health	Contains the record of any service health incidents that have occurred in Azure. An example of a Service Health event SQL Azure in East US is experiencing downtime. Service Health events come in Six varieties: Action Required, Assisted Recovery, Incident, Maintenance, Information, or Security. These events are only created if you have a resource in the subscription that would be impacted by the event.
Resource Health	Contains the record of any resource health events that have occurred to your Azure resources. An example of a Resource Health event is Virtual Machine health status changed to unavailable. Resource Health events can represent one of four health statuses: Available, Unavailable, Degraded, and Unknown. Additionally, Resource Health events can be categorized as being Platform Initiated or User Initiated.
Alert	Contains the record of activations for Azure alerts. An example of an Alert event is CPU % on myVM has been over 80 for the past 5 minutes.
Autoscale	Contains the record of any events related to the operation of the autoscale engine based on any autoscale settings you have defined in your subscription. An example of an Autoscale event is Autoscale scale up action failed.
Recommendation	Contains recommendation events from Azure Advisor.
Security	Contains the record of any alerts generated by Azure Security Center. An example of a Security event is Suspicious double extension file executed.
Policy	Contains records of all effect action operations performed by Azure Policy. Examples of Policy events include Audit and Deny. Every action taken by Policy is modeled as an operation on a resource.