Azure Log Analytics Sentinel

Azure Sentinel & Log Analytics – Cross correlate between data on Azure Blob Storage and Log Analytics

I just wanted briefly document a quick way to bring external data to Sentinel / Log Analytics for cross-correlation between internal and external data sources.

Use cases

Typical use case is set of data, which is not part of existing logs in Log Analytics. For this case I wanted to have the refresh_token validity part of the logs when correlating with sign-in, and or non interactive sign-in logs

// This is just an example use case; better example use cases exists, but this works as technical example to show how this feature works (Refresh_token use can be correlated also on non interactive user logs)

References

Azure Log Analytics: how to read a file

ExternalDataOperator

Example

  • Get the data from the source & Export the data to CSV
Get-AzureADUser -All $true| select userPRincipalName, refresh | Export-Csv -Encoding Default -Delimiter "," c:\temp\lalist.csv -NoTypeInformation
  • add the SAStoken generated by the app to the LA query
externaldata(UserPrincipalName:string, RefreshTokensValidFromDateTime:string  ) [@"https://burneraccount.blob.core.windows.net/temp/lalist.csv?st=mysastoken"] 
| extend UserPrincipalNameFromCSV = tolower(UserPrincipalName)
| join kind=inner SigninLogs on $left.UserPrincipalNameFromCSV == $right.UserPrincipalName |distinct  UserPrincipalName, UserPrincipalNameFromCSV, RefreshTokensValidFromDateTime



  • Run the query

0 comments on “Azure Sentinel & Log Analytics – Cross correlate between data on Azure Blob Storage and Log Analytics

Vastaa

Täytä tietosi alle tai klikkaa kuvaketta kirjautuaksesi sisään:

WordPress.com-logo

Olet kommentoimassa WordPress.com -tilin nimissä. Log Out /  Muuta )

Google photo

Olet kommentoimassa Google -tilin nimissä. Log Out /  Muuta )

Twitter-kuva

Olet kommentoimassa Twitter -tilin nimissä. Log Out /  Muuta )

Facebook-kuva

Olet kommentoimassa Facebook -tilin nimissä. Log Out /  Muuta )

Muodostetaan yhteyttä palveluun %s

%d bloggaajaa tykkää tästä: