Forum Discussion
Solved
MS Threat Intel matching with custom logs
MS Threat Intel matches only with default Sentinel tables (like CommonSecurityLog )
How same can be utilized with custom table events.
If you run below command, you will get the result
CommonSecurityLog
| summarize count() by CommunicationDirection, MaliciousIPCountry
while if you run same for custom table like below, you will get the error
CustomLog_CL
| summarize count() by MaliciousIPCountry
There are ways to do it but it requires a bit of creative log ingestion. I am not sure how you get the data from that custom log into Sentinel but in our case, when we want to have a log enriched with the Microsoft threat intel, we "force" it through the CEF connector. The challenge of course, is to process the data that is not available in CEF. For that we use Logstash to get the raw logs, parse and adjust the format to match CEF standard and send it as syslog to the Sentinel collector (using the syslog facility configured for the CEF collector).
Here is an example of our custom threat intel feed (that we compile and saved as csv file on a server on hourly basis) converted as CEF through Logstash and sent to Sentinel through the CEF data collector (and you can see that some entries match Microsoft's threat intel as well):
The Logstash part is not as complicated as one may think:
Adrian Grigorof
There are ways to do it but it requires a bit of creative log ingestion. I am not sure how you get the data from that custom log into Sentinel but in our case, when we want to have a log enriched with the Microsoft threat intel, we "force" it through the CEF connector. The challenge of course, is to process the data that is not available in CEF. For that we use Logstash to get the raw logs, parse and adjust the format to match CEF standard and send it as syslog to the Sentinel collector (using the syslog facility configured for the CEF collector).
Here is an example of our custom threat intel feed (that we compile and saved as csv file on a server on hourly basis) converted as CEF through Logstash and sent to Sentinel through the CEF data collector (and you can see that some entries match Microsoft's threat intel as well):
The Logstash part is not as complicated as one may think:
Adrian Grigorof
Hi AdiGrio
Thanks for your response. your suggestion is helpful and even I was looking to onboard custom threat Intel with Sentinel.
Dev_Choudhary It appears that your custom log is missing that field. Where did you get the log from?
it can be any source like Cisco Meraki, Okta
Hello Dev_Choudhary,
As mentionned on the CEF Connector "By connecting your CEF logs to Azure Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log". So the MS Threat Intelligence is applied only when using the associated connector. However, imported logs do not get into the same connection process. This explains why the MaliciousIPCountry column is not added in the imported logs.
Thus, your custom log need to be analyzed with Threat Intelligence (not necessarily MS) before being imported into the Log Analytics workspace.
