Forum Discussion

Brass Contributor

May 27, 2021

Solved

Multiple vendor monitoring single Azure sentinel console

Team, Is there a possibility to monitor the same Azure Sentinel console from multiple vendors ( vendor will monitor only the logs ingested by the log sources managed by vendor ) while restricting...

GaryBushey
May 27, 2021
pavankemi For that to work you would need to use the 2nd option and setup custom roles that can then be used in the Table level RBAC. It should be noted that all users will be able to see all incidents in the environment and if they can modify one they can modify all.

Depending on what data sources are required for all the queries, you may want to see about using 2 different Azure Sentinel environments and use Azure Lighthouse to be able to see both in one view for the people that need to see all of the incidents.

pavankemi

Brass Contributor

May 27, 2021

Thanks Gary for the quick response. From your response second vendor uses Azure Sentinel Reader Role. This vendor also need to work on the alerts generated from the device managed by them and create any analytic rules on the devices managed by them. How can this be achieved?

GaryBushey

Bronze Contributor

May 27, 2021

pavankemi For that to work you would need to use the 2nd option and setup custom roles that can then be used in the Table level RBAC. It should be noted that all users will be able to see all incidents in the environment and if they can modify one they can modify all.

Depending on what data sources are required for all the queries, you may want to see about using 2 different Azure Sentinel environments and use Azure Lighthouse to be able to see both in one view for the people that need to see all of the incidents.