Sending logs from one tenant to a different tenant Sentinel instance

%3CLINGO-SUB%20id%3D%22lingo-sub-2185531%22%20slang%3D%22en-US%22%3ESending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2185531%22%20slang%3D%22en-US%22%3E%3CP%3ETeam%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20scenario%20where%20logs%20from%20one%20tenant%20needs%20to%20be%20forwarded%20to%20another%20tenant%20LA%20workspace%20Sentinel.%20I%20know%20we%20have%20Azure%20lighthouse%20which%20can%20be%20used%20but%20customer%20requirement%20is%20to%20fwd%20all%20the%20logs%20from%20one%20tenant%20to%20another%20tenant.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20are%20the%20possible%20options%20do%20we%20have%20%3F%20cost%20is%20not%20a%20factor%20for%20the%20customer.%26nbsp%3B%20I%20think%20of%20one%20option%20which%20is%20to%20use%20the%20LA%20Data%20export%20and%20send%20the%20events%20to%20eventhubs%20of%20that%20tenant.%20But%20how%20can%20the%20Sentinel%20instance%20of%20a%20different%20tenant%20can%20consume%20those%20logs%20from%20the%20eventhubs%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20other%20approaches%20to%20cater%20to%20the%20requirements%20also%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2185594%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2185594%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F613764%22%20target%3D%22_blank%22%3E%40pavankemi%3C%2FA%3E%26nbsp%3BWhile%20you%20can%20send%20the%20data%20from%20one%20tenant%20to%20another%2C%20keep%20in%20mind%20that%20a%20lot%20of%20the%20data%20will%20not%20be%20useful%20as%20you%20will%20loose%20a%20lot%20of%20the%20reference%20data%20(for%20instance%2C%20user%20GUIDs)%20and%20the%20vast%20majority%20of%20the%20data%20will%20need%20to%20be%20put%20into%20custom%20tables%20as%20you%20cannot%20add%20your%20own%20data%20to%20Azure%20Sentinel's%20tables.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWith%20that%20being%20said%2C%20once%20the%20data%20is%20in%20an%20Event%20Hub%2C%20you%20can%20write%20a%20Logic%20App%20to%20process%20the%20data%20and%20write%20it%20to%20the%20Logic%20App%20in%20the%20new%20tenant.%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fconnectors%2Fconnectors-create-api-azure-event-hubs%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EConnect%20to%20Azure%20Event%20Hubs%20-%20Azure%20Logic%20Apps%20%7C%20Microsoft%20Docs%3C%2FA%3E.%26nbsp%3B%20There%20is%20an%20Azure%20Monitor%20Send%20Data%20connector%20to%20write%20to%20a%20Log%20Analytics%20Workspace.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2185685%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2185685%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20Gary%20for%20the%20quick%20response.%20What%20approach%20we%20can%20follow%20so%20that%20we%20can%20forward%20the%20data%20without%20losing%20any%20reference%20data.%3C%2FP%3E%3CP%3E3rd%20party%20SIEM%20solutions%20use%20eventhubs%20to%20get%20the%20data%20from%20the%20Azure.%20We%20are%20trying%20to%20perform%20the%20similar%20exercise%20but%20in%20this%20case%20we%20are%20sending%20to%20Sentinel.%20What%20changes%20between%203rd%20party%20SIEM%20solutions%20and%20Sentinel.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2185984%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2185984%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F613764%22%20target%3D%22_blank%22%3E%40pavankemi%3C%2FA%3E%26nbsp%3BI%20doubt%203rd%20party%20SIEMs%20would%20do%20any%20better%20unless%20they%20download%20the%20information%20from%20Azure%20AD%20as%20well%20(for%20my%20example).%26nbsp%3B%20I%20think%20the%20biggest%20issue%20will%20be%20writing%2Fmodifying%20all%20the%20queries%20to%20look%20at%20the%20new%20tables.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2186671%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2186671%22%20slang%3D%22en-US%22%3EHi%20Gary.i%20was%20looking%20at%20the%20Azure%20monitor%20send%20data%20connector%20in%20logic%20apps%20but%20there%20is%20no%20such%20action%20listed%20under%20azure%20monitor.%20Am%20i%20doing%20something%20wrong%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2187805%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2187805%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F613764%22%20target%3D%22_blank%22%3E%40pavankemi%3C%2FA%3E%26nbsp%3BThat%20would%20be%20because%20I%20told%20you%20the%20wrong%20connector%20name.%26nbsp%3B%20Sorry.%26nbsp%3B%20%26nbsp%3BIt%20is%20actually%20the%20%22Azure%20Log%20Analytics%20Data%20Collector%22%20connector%20that%20you%20want%20to%20use.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2194101%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2194101%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F613764%22%20target%3D%22_blank%22%3E%40pavankemi%3C%2FA%3E%26nbsp%3B%3A%3C%2FP%3E%0A%3CP%3E-%20I%20would%20use%20Azure%20functions%20and%20not%20Logic%20Apps%2C%20as%20Logic%20Apps%20cost%20may%20become%20prohibitive.%3C%2FP%3E%0A%3CP%3E-%20It%20is%20not%20a%20simple%20project.%20We%20have%20customers%20doing%20that%2C%20but%20there%20is%20an%20inherent%20effort%20both%20in%20the%20custom%20connectors%20and%20modifying%20queries%20to%20work%20with%20it.%20Also%2C%20with%20custom%20connectors%20free%20sources%20are%20no%20longer%20free.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20try%20to%20best%20help%3A%20why%20do%20you%20need%20to%20move%20all%20data%20to%20a%20central%20tenant%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2195334%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2195334%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F293879%22%20target%3D%22_blank%22%3E%40Ofer_Shezaf%3C%2FA%3E%3CBR%20%2F%3EThank%20you%20for%20the%20response.%20Customer%20has%20multiple%20tenants%20which%20are%20owned%20by%20Customer%20but%20one%20tenant%20is%20being%20managed%20by%20the%20vendor.%20Customer%20needs%20logs%20from%20the%20vendor%20managed%20tenant%20and%20send%20it%20to%20their%20Tenant%20to%20centrally%20monitor.%20In%20short%2C%20customer%20has%20few%20contractual%20obligations%20with%20the%20vendor%20and%20cannot%20deploy%20Lighthouse%20and%20wanted%20to%20go%20with%20logs%20forwarding%20from%20Tenant%201%20to%20Tenant%202%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2195514%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2195514%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F613764%22%20target%3D%22_blank%22%3E%40pavankemi%3C%2FA%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFirst%2C%20it%20would%20be%20a%20large%20effort%20to%20just%20not%20use%20Lighthouse.%20However%2C%20any%20future%20support%20for%20cross%20tenant%20collection%20will%20also%20use%20Lighthouse%20(though%20reverse%20Lighthouse).%20So%20the%20contractual%20issues%20will%20have%20to%20be%20resolved.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2195607%22%20slang%3D%22en-US%22%3ERe%3A%20Sending%20logs%20from%20one%20tenant%20to%20a%20different%20tenant%20Sentinel%20instance%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2195607%22%20slang%3D%22en-US%22%3EThank%20you%20Ofer%20for%20the%20information%3C%2FLINGO-BODY%3E
Contributor

Team,

 

I have a scenario where logs from one tenant needs to be forwarded to another tenant LA workspace Sentinel. I know we have Azure lighthouse which can be used but customer requirement is to fwd all the logs from one tenant to another tenant.

 

What are the possible options do we have ? cost is not a factor for the customer.  I think of one option which is to use the LA Data export and send the events to eventhubs of that tenant. But how can the Sentinel instance of a different tenant can consume those logs from the eventhubs?

 

Any other approaches to cater to the requirements also helpful.

9 Replies

@pavankemi While you can send the data from one tenant to another, keep in mind that a lot of the data will not be useful as you will loose a lot of the reference data (for instance, user GUIDs) and the vast majority of the data will need to be put into custom tables as you cannot add your own data to Azure Sentinel's tables.

 

With that being said, once the data is in an Event Hub, you can write a Logic App to process the data and write it to the Logic App in the new tenant.  Connect to Azure Event Hubs - Azure Logic Apps | Microsoft Docs.  There is an Azure Monitor Send Data connector to write to a Log Analytics Workspace.

Thanks Gary for the quick response. What approach we can follow so that we can forward the data without losing any reference data.

3rd party SIEM solutions use eventhubs to get the data from the Azure. We are trying to perform the similar exercise but in this case we are sending to Sentinel. What changes between 3rd party SIEM solutions and Sentinel.

@pavankemi I doubt 3rd party SIEMs would do any better unless they download the information from Azure AD as well (for my example).  I think the biggest issue will be writing/modifying all the queries to look at the new tables.

Hi Gary.i was looking at the Azure monitor send data connector in logic apps but there is no such action listed under azure monitor. Am i doing something wrong

@pavankemi That would be because I told you the wrong connector name.  Sorry.   It is actually the "Azure Log Analytics Data Collector" connector that you want to use.

@pavankemi :

- I would use Azure functions and not Logic Apps, as Logic Apps cost may become prohibitive.

- It is not a simple project. We have customers doing that, but there is an inherent effort both in the custom connectors and modifying queries to work with it. Also, with custom connectors free sources are no longer free.

 

To try to best help: why do you need to move all data to a central tenant?

@Ofer_Shezaf
Thank you for the response. Customer has multiple tenants which are owned by Customer but one tenant is being managed by the vendor. Customer needs logs from the vendor managed tenant and send it to their Tenant to centrally monitor. In short, customer has few contractual obligations with the vendor and cannot deploy Lighthouse and wanted to go with logs forwarding from Tenant 1 to Tenant 2

@pavankemi:

 

First, it would be a large effort to just not use Lighthouse. However, any future support for cross tenant collection will also use Lighthouse (though reverse Lighthouse). So the contractual issues will have to be resolved. 

Thank you Ofer for the information