Azure Sentinel Normalization?

[ajiwanand]

Coming from a general SIEM background I understand that Sentinel approaches things in a different way however I am really struggling to understand how we can use sentinel from an MSSP standpoint. From my (very limited) experience with Sentinel, depending on the log source and log source type the fields can be different.

This can cause alot of problems when you try to create rules that span multiple log sources or have analysts that need to query across the whole environment.

Has anyone run into the same situation and addressed it?

[#2]

@ajiwanand we have started a private preview for a normalized schema. Join our Private Previews program if you want to review and provide feedback.

That said, normalization is a broad topic. It would be great to learn what value you are looking for from normalization.

~ Ofer

[#3]

@Ofer_Shezaf 

I will definitely sign up for the preview!

As for clarification, like I said above my experience lies mostly with traditional SIEM technologies where we have a large amount of log sources reporting into a platform. These log sources are then mapped to a common information schema/format where we can search one field (e.g username) and that field is translated to all the username fields of each log sources, effectively giving the analyst the ability to query across multiple log sources using a common information schema.

I do know that there is the possibility of aliases or even parsing into new fields is quite easy with sentinel, however the manual work and maintenance required to keep this up to date makes it really tough to achieve.

So essentially, we are looking for a common information schema which allows users to query across multiple log sources easily. I should also add, my perspective on this is also from a service provider(MSSP) and while we may be able to build out the aliases or fields required for one customer, if we are trying to use sentinel for multiple customers you can probably see the amount of effort required to get this standardized set of fields on all customers. Not to mention the other main issue which is the training we need to give all analysts if we dont have a standardized set of fields.

Hope this makes sense, and let me know if im missing a concept of sentinel or a feature :)

[#4]

@Ofer_Shezaf, I will definitely join the preview program.

As for clarification, like i said most of my background have been in traditional SIEMs so forgive me if im missing a concept or something like that, but the idea is that if you have a large amount of data sources (e.g CEF, Security Events, other syslog, audit events) reporting to the platform. You should be able to utilize a standardized information schema to search and correlate across all these log sources. Usually a list of predefined fields like Username,IP Address, Host, and some more are parsed to the same field names, allowing the user whether it be an analyst or content creator to either search across all log sources or create rules that span multiple log sources.

Some vendors even go so far as to classify a "common event" that is a field that will explain what the event means (and is the same for all log sources). I know we can have field aliases or even parse our own fields quite easily however the management and manual effort required to keep this up to date is a lot.

Hope this makes sense, let me know if i need to clarify further.

- Ajay J

[#5]

@ajiwanand 

Thanks, makes sense. Exctracting sepcific requirements:

- Microsoft provided parsers to a standard schema

- Easy search across multiple occurences of simlar values in the schema (IP Address, User)

Happy if you join our Private Previews program to give feedback on our normalization project.