Skip to content

Commit 011d56f

Browse files
cwatson-catcwatson-cat
committed
Sentinel autogen data connector refresh - add new files
1 parent 44639dd commit 011d56f

File tree

5 files changed

+604
-3
lines changed

5 files changed

+604
-3
lines changed

‎articles/sentinel/data-connectors/1password.md

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
title: "1Password (using Azure Functions) connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector 1Password (using Azure Functions) to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 07/26/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# 1Password (using Azure Functions) connector for Microsoft Sentinel
13+
14+
The [1Password](https://www.1password.com) solution for Microsoft Sentinel enables you to ingest sign-in attempts, item usage, and audit events from your 1Password Business account using the [1Password Events Reporting API](https://developer.1password.com/docs/events-api). This allows you to monitor and investigate events in 1Password in Microsoft Sentinel along with the other applications and services your organization uses.
15+
16+
**Underlying Microsoft Technologies used:**
17+
18+
This solution depends on the following technologies, and some of which may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or may incur additional ingestion or operational costs:
19+
20+
[Azure Functions](https://azure.microsoft.com/services/functions/#overview)
21+
22+
This is autogenerated content. For changes, contact the solution provider.
23+
24+
## Connector attributes
25+
26+
| Connector attribute | Description |
27+
| --- | --- |
28+
| **Log Analytics table(s)** | OnePasswordEventLogs_CL<br/> |
29+
| **Data collection rules support** | Not currently supported |
30+
| **Supported by** | [1Password](https://support.1password.com/) |
31+
32+
## Query samples
33+
34+
**Top 10 Users**
35+
36+
```kusto
37+
OnePasswordEventLogs_CL
38+
39+
| summarize count() by tostring(target_user.name)
40+
41+
| top 10 by count_
42+
```
43+
44+
45+
46+
## Prerequisites
47+
48+
To integrate with 1Password (using Azure Functions) make sure you have:
49+
50+
- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).
51+
- **1Password Events API Token**: A 1Password Events API Token is required. [See the documentation to learn more about the 1Password API](https://developer.1password.com/docs/events-api/reference).
52+
- A 1Password Business account is required.
53+
54+
55+
## Vendor installation instructions
56+
57+
58+
> [!NOTE]
59+
> This connector uses Azure Functions to connect to 1Password to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs from Azure. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
60+
61+
**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
62+
63+
64+
**STEP 1 - Configuration steps for the 1Password Events Reporting API**
65+
66+
[Follow these instructions](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens) provided by 1Password to obtain an Events Reporting API Token. A 1Password Business account is required.
67+
68+
69+
**STEP 2 - Deploy the functionApp using DeployToAzure button to create the table, dcr and the associated Azure Function**
70+
71+
**IMPORTANT:** Before deploying the 1Password connector, a custom table needs to be created.
72+
73+
Option 1 - Azure Resource Manager (ARM) Template
74+
75+
This method provides an automated deployment of the 1Password connector using an ARM Tempate.
76+
77+
1. Click the **Deploy to Azure** button below.
78+
79+
[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OnePassword-azuredeploy)
80+
2. Select the preferred **Subscription**, **Resource Group** and **Location**.
81+
3. Enter the **Workspace Name**, **Workspace Name**, **1Password Events API Key**, and **URI**.
82+
- The default **Time Interval** is set to five (5) minutes. If you'd like to modify the interval, you can adjust the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion.
83+
- Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](/azure/app-service/app-service-key-vault-references) for further details.
84+
4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.
85+
5. Click **Purchase** to deploy.
86+
87+
88+
89+
## Next steps
90+
91+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/1password1617200969773.azure-sentinel-solution-1password?tab=Overview) in the Azure Marketplace.

‎articles/sentinel/data-connectors/tenable-identity-exposure.md

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
title: "Tenable Identity Exposure connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector Tenable Identity Exposure to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 07/26/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# Tenable Identity Exposure connector for Microsoft Sentinel
13+
14+
Tenable Identity Exposure connector allows Indicators of Exposure, Indicators of Attack and trailflow logs to be ingested into Microsoft Sentinel.The different work books and data parsers allow you to more easily manipulate logs and monitor your Active Directory environment. The analytic templates allow you to automate responses regarding different events, exposures and attacks.
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Kusto function alias** | afad_parser |
23+
| **Log Analytics table(s)** | Tenable_IE_CL<br/> |
24+
| **Data collection rules support** | Not currently supported |
25+
| **Supported by** | [Tenable](https://www.tenable.com/support/technical-support) |
26+
27+
## Query samples
28+
29+
**Get the number of alerts triggered by each IoE**
30+
31+
```kusto
32+
afad_parser
33+
34+
| where MessageType == 0
35+
36+
| summarize AlertCount = count() by Codename
37+
```
38+
39+
**Get all IoE alerts with severity superior to the threshold**
40+
41+
```kusto
42+
let threshold = 2;
43+
let SeverityTable=datatable(Severity:string,Level:int) [
44+
"low", 1,
45+
"medium", 2,
46+
"high", 3,
47+
"critical", 4
48+
];
49+
afad_parser
50+
51+
| where MessageType == 0
52+
53+
| lookup kind=leftouter SeverityTable on Severity
54+
55+
| where Level >= ['threshold']
56+
```
57+
58+
**Get all IoE alerts for the last 24 hours**
59+
60+
```kusto
61+
afad_parser
62+
| where MessageType == 0 and TimeGenerated > ago(1d)
63+
```
64+
65+
**Get all IoE alerts for the last 7 days**
66+
67+
```kusto
68+
afad_parser
69+
| where MessageType == 0 and TimeGenerated > ago(7d)
70+
```
71+
72+
**Get all IoE alerts for the last 30 days**
73+
74+
```kusto
75+
afad_parser
76+
| where MessageType == 0 and TimeGenerated > ago(30d)
77+
```
78+
79+
**Get all trailflow changes for the last 24 hours**
80+
81+
```kusto
82+
afad_parser
83+
| where MessageType == 1 and TimeGenerated > ago(1d)
84+
```
85+
86+
**Get all trailflow changes for the last 7 days**
87+
88+
```kusto
89+
afad_parser
90+
| where MessageType == 1 and TimeGenerated > ago(7d)
91+
```
92+
93+
**Get the number of alerts triggered by each IoA**
94+
95+
```kusto
96+
afad_parser
97+
98+
| where MessageType == 2
99+
100+
| summarize AlertCount = count() by Codename
101+
```
102+
103+
**Get all IoA alerts for the last 30 days**
104+
105+
```kusto
106+
afad_parser
107+
| where MessageType == 2 and TimeGenerated > ago(30d)
108+
```
109+
110+
111+
112+
## Prerequisites
113+
114+
To integrate with Tenable Identity Exposure make sure you have:
115+
116+
- **Access to TenableIE Configuration**: Permissions to configure syslog alerting engine
117+
118+
119+
## Vendor installation instructions
120+
121+
122+
This data connector depends on [afad_parser](https://aka.ms/sentinel-TenableApp-afad-parser) based on a Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.
123+
124+
1. Configure the Syslog server
125+
126+
You will first need a **linux Syslog** server that TenableIE will send logs to. Typically you can run **rsyslog** on **Ubuntu**.
127+
You can then configure this server as you wish, but it is recommended to be able to output TenableIE logs in a separate file.
128+
129+
Configure rsyslog to accept logs from your TenableIE IP address.:
130+
131+
```shell
132+
sudo -i
133+
134+
# Set TenableIE source IP address
135+
export TENABLE_IE_IP={Enter your IP address}
136+
137+
# Create rsyslog configuration file
138+
cat > /etc/rsyslog.d/80-tenable.conf << EOF
139+
\$ModLoad imudp
140+
\$UDPServerRun 514
141+
\$ModLoad imtcp
142+
\$InputTCPServerRun 514
143+
\$AllowedSender TCP, 127.0.0.1, $TENABLE_IE_IP
144+
\$AllowedSender UDP, 127.0.0.1, $TENABLE_IE_IP
145+
\$template MsgTemplate,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\n"
146+
\$template remote-incoming-logs, "/var/log/%PROGRAMNAME%.log"
147+
*.* ?remote-incoming-logs;MsgTemplate
148+
EOF
149+
150+
# Restart rsyslog
151+
systemctl restart rsyslog
152+
```
153+
154+
2. Install and onboard the Microsoft agent for Linux
155+
156+
The OMS agent will receive the TenableIE syslog events and publish it in Microsoft Sentinel :
157+
158+
159+
3. Check agent logs on the Syslog server
160+
161+
```shell
162+
tail -f /var/opt/microsoft/omsagent/log/omsagent.log
163+
```
164+
165+
4. Configure TenableIE to send logs to your Syslog server
166+
167+
On your **TenableIE** portal, go to *System*, *Configuration* and then *Syslog*.
168+
From there you can create a new Syslog alert toward your Syslog server.
169+
170+
Once this is done, check that the logs are correctly gathered on your server in a separate file (to do this, you can use the *Test the configuration* button in the Syslog alert configuration in TenableIE).
171+
If you used the Quickstart template, the Syslog server will by default listen on port 514 in UDP and 1514 in TCP, without TLS.
172+
173+
5. Configure the custom logs
174+
175+
Configure the agent to collect the logs.
176+
177+
1. In Microsoft Sentinel, go to **Configuration** -> **Settings** -> **Workspace settings** -> **Custom logs**.
178+
2. Click **Add custom log**.
179+
3. Upload a sample TenableIE.log Syslog file from the **Linux** machine running the **Syslog** server and click **Next**
180+
4. Set the record delimiter to **New Line** if not already the case and click **Next**.
181+
5. Select **Linux** and enter the file path to the **Syslog** file, click **+** then **Next**. The default location of the file is `/var/log/TenableIE.log` if you have a Tenable version <3.1.0, you must also add this linux file location `/var/log/AlsidForAD.log`.
182+
6. Set the **Name** to *Tenable_IE_CL* (Azure automatically adds *_CL* at the end of the name, there must be only one, make sure the name is not *Tenable_IE_CL_CL*).
183+
7. Click **Next**, you will see a resume, then click **Create**
184+
185+
186+
6. Enjoy !
187+
188+
You should now be able to receive logs in the *Tenable_IE_CL* table, logs data can be parse using the **afad_parser()** function, used by all query samples, workbooks and analytic templates.
189+
190+
191+
192+
## Next steps
193+
194+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/tenable.tenable-sentinel-integration?tab=Overview) in the Azure Marketplace.

‎articles/sentinel/data-connectors/tenable-io-vulnerability-management.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: "Tenable.io Vulnerability Management (using Azure Function) connector for
33
description: "Learn how to install the connector Tenable.io Vulnerability Management (using Azure Function) to connect your data source to Microsoft Sentinel."
44
author: cwatson-cat
55
ms.topic: how-to
6-
ms.date: 04/26/2024
6+
ms.date: 07/26/2024
77
ms.service: microsoft-sentinel
88
ms.author: cwatson
99
ms.collection: sentinel-data-connector
@@ -68,7 +68,7 @@ Tenable_IO_Assets_CL
6868
To integrate with Tenable.io Vulnerability Management (using Azure Function) make sure you have:
6969

7070
- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).
71-
- **REST API Credentials/permissions**: Both a **TenableAccessKey** and a **TenableSecretKey** is required to access the Tenable REST API. [See the documentation to learn more about API](https://developer.tenable.com/reference#vulnerability-management). Check all [requirements and follow the instructions](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm) for obtaining credentials.
71+
- **REST API Credentials/permissions**: Both a **TenableAccessKey** and a **TenableSecretKey** is required to access the Tenable REST API. [See the documentation to learn more about API](https://developer.tenable.com/reference#vulnerability-management). Check all [requirements and follow the instructions](https://docs.tenable.com/tenableio/vulnerabilitymanagement/Content/Settings/GenerateAPIKey.htm) for obtaining credentials.
7272

7373

7474
## Vendor installation instructions
@@ -87,7 +87,7 @@ To integrate with Tenable.io Vulnerability Management (using Azure Function) mak
8787

8888
**STEP 1 - Configuration steps for Tenable.io**
8989

90-
[Follow the instructions](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm) to obtain the required API credentials.
90+
[Follow the instructions](https://docs.tenable.com/tenableio/vulnerabilitymanagement/Content/Settings/GenerateAPIKey.htm) to obtain the required API credentials.
9191

9292

9393

0 commit comments

Comments
 (0)