02-06-2020 06:10 PM
02-06-2020 06:10 PM
We have deployed Azure Lighthouse to manage Azure Sentinel with Azure Sentinel Contributor and Azure Logic App Contributor roles. we can access client's Sentinel.
We've got a few incidents now. we can click on the investigate which shows a nice graph and all, but we have some limitations.
02-07-2020 03:12 AM
02-09-2020 03:07 PM
. From which Log Analytics Table does that data come from, or which Alert (or is a custom one) is the Incident generated? Is it Signinlogs?
this is an alert from Firewall related to Key vault access . this is not custom one
so my main issues are the i am using lighthouse to access customers sentinel and i can not see customers users when i want to assign an incident. so wondering if this is not possible at the moment or i need to do some role to do this.
second is that when i investigate an incident I can not see the user name of the account involved in that incident. is this also related to the some permission.
06-25-2020 04:54 AM
@fm1984 In regards to the 3rd bullet point, you are correct that Azure Lighthouse will not be able to assign local users to an Incident. From my research, this would require "Directory Reader" rights that can only be granted at the Azure AD level and not through Lighthouse.
06-25-2020 06:01 AM
Thanks for the info. This is what we are seeing. In the customer tenant, security user can see who is assigned an incident. In the Lighthouse tenant, he can not see who is assigned, even though he has privileges' in the customer tenant. Assigning Directory Reader in the customer tenant does not allow the user to see any users assigned.
06-25-2020 08:30 AM
@lmpalermo That is what I would expect. Even if you are using the same account in your own tenant and in the customer's tenant, Lighthouse doesn't check to see what rights that account has on the customer's tenant. It only checks to see what rights have been granted via the ARM Template used to enable Lighthouse (and you cannot assign Directory Reader via Lighthouse).
If you need to assign customers to incidents, then Lighthouse will not work for you and you will need to login to the customer's tenant directly.