Azure Sentinel (Preview)

Cloud-native SIEM with a built-in AI so you can focus on what matters most

This connector is available in the following products and regions:

Azure Sentinel Connector

Authentication

Triggers and actions in the Azure Sentinel connector can operate on behalf of any identity that has the necessary permissions (read and/or write) on the relevant workspace. The connector supports multiple identity types:

• Azure AD user
• Service principal (Azure AD application)

Permissions required

Learn more about permissions in Azure Sentinel.

Authenticate as an Azure AD user

To make a connection, select Sign in. You will be prompted to provide your account information. Once you have done so, follow the remaining instructions on the screen to create a connection.

Authenticate as a service principal (Azure AD application)

Service principals can be created by registering an Azure AD application. It is preferable to use a registered application as the connector's identity, instead of using a user account, as you will be better able to control permissions, manage credentials, and enable certain limitations on the use of the connector.

To use your own application with the Azure Sentinel connector, perform the following steps:

1. Register the application with Azure AD and create a service principal. Learn how.

2. Get credentials (for future authentication).

   In the registered application blade, get the application credentials for later signing in:

   • Client ID: under Overview
   • Client secret: under Certificates & secrets.

3. Grant permissions to the Azure Sentinel workspace.

   In this step, the app will get permission to work with Azure Sentinel workspace.

   • In the Azure Sentinel workspace, go to Settings -> Workspace Settings -> Access control (IAM)

   • Select Add role assignment.

   • Select the role you wish to assign to the application. For example, to allow the application to perform actions that will make changes in the Sentinel workspace, like updating an incident, select the Azure Sentinel Contributor role. For actions which only read data, the Azure Sentinel Reader role is sufficient. Read more about the available roles in Azure Sentinel.

   • Find the required application and save. By default, Azure AD applications aren't displayed in the available options. To find your application, search for the name and select it.

4. Authenticate

   In this step we use the app credentials to authenticate to the Sentinel connector in Logic Apps.

   • Select Connect with Service Principal.
   • Fill in the required parameters (can be found in the registered application blade)
     • Tenant Id: under Overview
     • Client Id: under Overview
     • Client Secret: under Certificates & secrets

Manage your API connections

Every time an authentication is created for the first time, a new Azure resource of type API Connection is created. The same API connection can be used in all the Azure Sentinel actions and triggers in the same Resource Group.

All the API connections can be found in the API connections blade (search for API connections in the Azure portal).

You can also find them by going to the Resources blade and filtering the display by type API Connection. This way allows you to select multiple connections for bulk operations.

In order to change the authorization of an existing connection, enter the connection resource, and select Edit API connection.

Azure Sentinel actions summary

Actions on Incidents - Usage Examples

[!TIP] The actions Update Incident and Add a Comment to Incident require the Incident ARM ID.
Use the Alert - Get Incident action beforehand to get the Incident ARM ID.

• Update an incident

  Basic playbook to show how to use the action in a playbook that starts with an alert:

  

• Use Incident Information

  Basic playbook to send incident details over mail:

  

• Add a comment to the incident

  Basic playbook to show how to use the action in a playbook that starts with an alert:

  

Work with specific Entity type

The Entities dynamic field is an array of JSON objects, each of which represents an entity. Each entity type has its own schema, depending on its unique properties.

The "Entities - Get <entity name>" action allows you to do the following:

• Filter the array of entities by the requested type.
• Parse the specific fields of this type, so they can be used as dynamic fields in further actions.

The input is the Entities dynamic field.

The response is an array of entities, where the special properties are parsed and can be directly used in a For each loop.

Currently supported entity types are:

• IP

• Host

• Account

• URL

• FileHash

  

For other entity types, same functionality can be achieved using Logic Apps built in actions:

• Filter the array of entities by the requested type using Filter Array.
• Parse the specific fields of this type, so they can be used as dynamic fields in further actions using Parse Json.

Known issues and limitations

Cannot trigger Logic App called by Azure Sentinel trigger using "Run Trigger" button

This item refers to the button on the overview blade of the Logic Apps resource.

Triggering an Azure Logic Apps is made by a POST REST call, which its body is the input for the trigger. Logic Apps that start with Azure Sentinel triggers expect to get an alert or an incident in the body of the call. When trying to do so from Logic Apps overview blade, the call is empty, and there for an error is expected. Proper ways to trigger:

Proper ways to trigger:

• Manual trigger in Azure Sentinel
• Automated response of an analytic rule in Azure Sentinel
• Use "Resubmit" button in an existing Logic Apps run blade
• Call directly the Logic Apps endpoint (attaching an alert/incident as the body)

Updating the same incident in parallel For each loops

For each loops are set by default to run in parallel, but can be easily set to run sequentially. If a for each loop might update the same Azure Sentinel incident in separate iterations, it should be configured to run sequentially.

Restoring alert's original query is currently not supported via Logic Apps

Usage of the Azure Monitor Logs connector to retrieve the events captured by the scheduled alert analytics rule is not consistently reliable.

• Azure Monitor Logs do not support the definition of a custom time range. Restoring the exact same query results requires defining the exact same time range as in the original query.
• Alerts may be delayed in appearing in the Log Analytics workspace after the rule triggers the playbook.

Available resources

Azure Sentinel

• Azure Sentinel Github templates gallery
• Azure Sentinel playbooks documentation
• Azure Sentinel API reference

Azure Logic Apps

• Scenarios, examples and walkthroughs for Azure Logic Apps
• Logic Apps expressions

Creating a connection

The connector supports the following authentication types:

Default

Applicable: All regions

Required parameters for creating connection.

Throttling Limits

Actions

Add comment to incident (V2)

Add comment to incident (V3)

Add comment to incident [DEPRECATED]

Add labels to incident (to be deprecated)

Alert - Get incident

Alert - Get incident

ASI trigger unsubscribe [DEPRECATED]

Change incident description

Change incident description (V2) (to be deprecated)

Change incident severity (to be deprecated)

Change incident status (to be deprecated)

Change incident title

Change incident title (V2) (to be deprecated)

Entities - Get Accounts

Entities - Get FileHashes

Entities - Get Hosts

Entities - Get IPs

Entities - Get URLs

Get incident

Remove labels from incident (to be deprecated)

Update incident

Triggers

When a response to an Azure Sentinel alert is triggered

When a response to an Azure Sentinel alert is triggered [DEPRECATED]

When Azure Sentinel incident creation rule was triggered (Private Preview only)

Definitions

BatchResponseAccount

Account

BatchResponseUrl

UrlEntity

BatchResponseHost

Host

BatchResponseIP

IP

BatchResponseFileHash

FileHash

OldIncident

OldIncidentProperties

IncidentAdditionalData

IncidentLabel

IncidentOwnerInfo

AttackTactic

AlertSeverity

HuntingBookmark

SecurityAlert

HuntingBookmarkProperties

SecurityAlertProperties

Incident

FullIncident

IncidentProperties

FullIncidentProperties

IncidentEventNotification

CreatedByUserInfo

UpdatedByUserInfo

Alert

IncidentComment

IncidentCommentProperties

string