Forum Discussion

SimonR's avatar
SimonR
Brass Contributor
Apr 17, 2020

Separating Logs for RBAC

Hi,   I'm in the process of setting up Sentinel with a number of log sources being sent via CEF. It appears that all the logs will go into the CommonSecurityEvents table which I need to separate ou...
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Apr 20, 2020

SimonR : You got things right. No options I am aware of not listed in the blog post. 

SimonR's avatar
SimonR
Brass Contributor
Apr 21, 2020

Ofer_Shezaf Thanks for this, I'm just sorting out Arc now. My plan currently is:

 

1) Install Arc on Collector1 and grant the NetOps group Log Analytics Reader access to the resource in Azure.

2) Push logs via syslog to Collector1

3) SecOps will be able to query logs via Sentinel along with everything else

4) NetOps will be able to query logs sent by Collector1 using Azure Monitor, but won't see anything else. For example if we created Collector2 for a different team.

 

With regards to the access would you grant the access directly on the resource or do you think it's better to have a separate resource group for the team so they can add Workbooks they want to create?

  • Ofer_Shezaf's avatar
    Ofer_Shezaf
    Icon for Microsoft rankMicrosoft
    Apr 21, 2020

    SimonR

     

    While not immidiately of importance, creating a resource group adds alot of flexbilty. For example if you needed a second connector VM.

     

    ~ Ofer 

    • SimonR's avatar
      SimonR
      Brass Contributor
      Apr 24, 2020

      Ofer_Shezaf thanks for this, I've decided we should definitely use Resource Groups otherwise I think we are going to end up with a mess to sort out later.

       

      I've created a resource group for this and added the Collector VM to it and granted my test user Log Analytics Reader and Workbook Contributor to the groups.

       

      Now I have what I hope is a really simple issue to resolve. If I use my test user and go to Azure Arc I can see and search logs for that device. However if I go to Monitor with the same account it prompts me to select a scope, but I can't see anything under the subscription. (I would have thought I would see the resource group and the collector VM under that). Am I just missing a permissions somewhere or have I misunderstood how this will all work?

       

      Thanks in advance.

Resources