Azure Sentinel with Lighthouse

[fm1984]

We have deployed Azure Lighthouse to manage Azure Sentinel with Azure Sentinel Contributor and Azure Logic App Contributor roles.  we can access client's Sentinel.

We've got a few incidents now. we can click on the investigate which shows a nice graph and all, but we have some limitations.

• We can't expand entities like users we just get AADUSERID: 5xxxx-xxxxxx-xx and FRIENDLYNAME: 5xxxx-xxxx-xxxxx but not the actual user name.
• We get basic IP information, no hostnames 
• We can't assign the incident to client users (only our tenant users), likely because we're missing the permission to list tenant users ?

[#2]

1. From which Log Analytics Table does that data come from, or which Alert (or is a custom one) is the Incident generated? Is it Signinlogs?
2. see #1

[#3]

@CliveWatson 

. From which Log Analytics Table does that data come from, or which Alert (or is a custom one) is the Incident generated? Is it Signinlogs?

this is an alert from Firewall related to Key vault access .  this is not custom one 

so my main issues are the i am using lighthouse to access customers sentinel and i can not see customers users when i want to assign an incident. so wondering if this is not possible at the moment or i need to do some role to do this.     

second is that when i investigate an incident I can not see the user name of the account involved in that incident. is this also related to the some permission.

[#4]

@fm1984 We are having the same with seeing the customer's user.  Have you found a role or another solution to solve this issue?

[#5]

@fm1984 In regards to the 3rd bullet point, you are correct that Azure Lighthouse will not be able to assign local users to an Incident. From my research, this would require "Directory Reader" rights that can only be granted at the Azure AD level and not through Lighthouse.

[#6]

@Gary Bushey 

Thanks for the info.  This is what we are seeing.  In the customer tenant, security user can see who is assigned an incident.  In the Lighthouse tenant, he can not see who is assigned, even though he has privileges' in the customer tenant.  Assigning Directory Reader in the customer tenant does not allow the user to see any users assigned.

[#7]

@lmpalermo That is what I would expect.  Even if you are using the same account in your own tenant and in the customer's tenant, Lighthouse doesn't check to see what rights that account has on the customer's tenant.  It only checks to see what rights have been granted via the ARM Template used to enable Lighthouse (and you cannot assign Directory Reader via Lighthouse).

If you need to assign customers to incidents, then Lighthouse will not work for you and you will need to login to the customer's tenant directly.

[#8]

@Gary Bushey 

That is what we expected.  So we wouldn't be able to see Owner either, correct?

[#9]

@lmpalermo That is correct.  You don't have permission to translate the GUID to a username