Forum Discussion
Need Some Information on Azure Sentinel
1. Sentinel re-uses the Azure Log Analytics Agent (Windows and Linux versions) to get data like Logs, Perf, Syslog etc... https://docs.microsoft.com/en-us/azure/azure-monitor/platform/log-analytics-agent
2. Sentinel has a CEF connector: https://docs.microsoft.com/en-us/azure/sentinel/connect-common-event-format
3. The community site has some of the queries and detentions used today as part of the preview: https://github.com/Azure/Azure-Sentinel
4.
5. https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources lists all the Microsoft services Sentinel connects to. When you say "how well" are you asking for Performance or SLA, or reliability? Please remember Sentinel is in Preview at the moment.
6. The preview show the Analytics (Alerts you specify) that then generate a Case. The Analytics in the future will be linked to a Playbook (Logic App).
7.
Microsoft
To add to Clive's answers:
- Additional non-Syslog sources:
- Pull collection, for example for files, database tables and REST APIs is available using Logic Apps - you schedule recurring automation that reads the source, and writes to the sentinel workspace. You can use the following resources:
- We support any Azure PaaS service that logs by pointing its diagnostics or activity log to the Sentinal workspace.
- More and more vendors offer direct streaming to Azure Sentinel, those include Symantec, Barracuda, and F5.
- CEF from SIEMs: As Clive mentions, we can collect from any CEF source. Some specific instructions on sending CEF from SIEM tools:
- Splunk - use the Splunk App for CEF.
- ArcSight - use the ArcSight forwarding connector and select CEF Syslog as the destination.
- Multitenancy: Sentinel is inherently multi-tenant as the workspace for each tenant (i.e., an MSSP customer or a sub-organization) leaves in a different Azure Tenant or a separate Sentinel workspace. We are working on central management for those tenants.
- Microsoft sources:
- Azure Security Center: supported
- Windows Defender ATP and Office ATP: the connectors are in the works.
- Event hub: use Logic Apps as described above for pull sources. See specific documentation here.
- Response automation: see the Logic Apps connectors list. Note that you can easily create custom API connectors or get more flexibility using Azure functions connectors.