Integration of Sentinel with other 3rd party on-prem SIEM solutions (stream alerts to eventhub)

[Manuel_DEste]

Dear Sentinel community,

I'm wondering if anyone already explored the possibilities of integrating sentinel Alerts with other SIEM solutions. 

An Example could be for customers which want to leverage Sentinel for their Azure cloud environments but still need their on Premies SIEM solutions to receive logs also from other logs sources. 

One option could be to stream Sentinel Alerts to Azure EventHub and then use the EventHub as log source in the on prem SIEM. Is this something supported on Sentinel? 


regards,

Manuel  

[#2]

@Manuel_DEste 

@Chris Boehm 

@Ofer_Shezaf: Is this something you can help with?

[#3 · Accepted solution]

Hi @Manuel_DEste, great meeting you again!

Yes and no.

Forwarding alerts to an event hub is supported. You can use one of several ways:

• Run a Logic App scheduled playbook to read alerts using the Log Analytics connector and then write them to an event hub using the Event Hub connector.
• Soon you will be able to do it by running a playbook automatically when an alert triggers.
• Lastly, you can Use the Security Graph API. Note that this will send all Azure alerts to your SIEM, not just Sentinel's.

Why no? because what you really want to send are cases and not alerts, which are automatically aggregated and reduced alerts. We are working to make sure those can be sent to a SIEM as well. 

[#4]

 Hi @Ofer_Shezaf, great meeting you again too!

Thank you for your reply, I'll try the Security Graph API for now, I didn't know about this feature!

[#5]

@Manuel_DEste / @Ofer_Shezaf , is there any update on the ability to integrate outputs from Sentinel with other SIEMs?

Thanks.

[#6]

@isfleming : no updated here. That is apart from the fact that automated triggering of playbooks was released of course. What are you find lacking in the solutions above?

~ Ofer

[#7]

@isfleming Streaming Security Graph events (Including Sentinel Incidents) to EventHub works. I believe that Pulling events from EventHub into your SIEM is supported by most SIEM vendors.

I hope anyway something like "continuous export" for Azure Security Center will be an option for Sentinel as well  for easier integration and troubleshooting https://docs.microsoft.com/en-us/azure/security-center/continuous-export

[#8]

@Ofer_Shezafthanks for the quick reply. I have not started working with this integration as yet. I am trying to determine what the requirements are for the data and what options there are to obtain it. Hopefully there will be nothing lacking. 🙂

[#9]

@Manuel_DEste  thanks!

[#10]

@Ofer_Shezaf  hey i have one question: i am new in azure sentinel, and i want to know what is the difference between using MMA agent and Using syslogs in adding 3d party ressource

thank you

[#11]

@BMaro Syslog is used for remote collection for systems that support it (which is most networking and security systems). The MMA (or Log Analytics Agent), is our software for collecting both Syslog as well as local telemetry on the system the MMA is installed on.

[#12]

@Manuel_DEste 

For sending logs to other SIEMs, Sentinel might not be the best tool as most of the SIEMs have their own ways (though in many cases not very robust) of bringing logigng data from the cloud. There is also a bandwidth cost to take data out of the cloud, might be negligible for small logs but it all adds up.

However, for a subset of alerts, filtered as part of a use case (basically the output of an alert) one can get really creative. You can the available APIs (like Log Analytics REST API) to bring any kind of data from Sentinel and then send it through a logging tool like Logstash to a wide variety of destinations, including syslog, ELK, etc. I've also seen alerts being sent to other SIEMs through a specially crafter SMTP email (there is a native LogicApp connector for it).