|
| 1 | +--- |
| 2 | +title: "Tenable Identity Exposure connector for Microsoft Sentinel" |
| 3 | +description: "Learn how to install the connector Tenable Identity Exposure to connect your data source to Microsoft Sentinel." |
| 4 | +author: cwatson-cat |
| 5 | +ms.topic: how-to |
| 6 | +ms.date: 07/26/2024 |
| 7 | +ms.service: microsoft-sentinel |
| 8 | +ms.author: cwatson |
| 9 | +ms.collection: sentinel-data-connector |
| 10 | +--- |
| 11 | + |
| 12 | +# Tenable Identity Exposure connector for Microsoft Sentinel |
| 13 | + |
| 14 | +Tenable Identity Exposure connector allows Indicators of Exposure, Indicators of Attack and trailflow logs to be ingested into Microsoft Sentinel.The different work books and data parsers allow you to more easily manipulate logs and monitor your Active Directory environment. The analytic templates allow you to automate responses regarding different events, exposures, and attacks. |
| 15 | + |
| 16 | +This is autogenerated content. For changes, contact the solution provider. |
| 17 | + |
| 18 | +## Connector attributes |
| 19 | + |
| 20 | +| Connector attribute | Description | |
| 21 | +| --- | --- | |
| 22 | +| **Kusto function alias** | afad_parser | |
| 23 | +| **Log Analytics table(s)** | Tenable_IE_CL<br/> | |
| 24 | +| **Data collection rules support** | Not currently supported | |
| 25 | +| **Supported by** | [Tenable](https://www.tenable.com/support/technical-support) | |
| 26 | + |
| 27 | +## Query samples |
| 28 | + |
| 29 | +**Get the number of alerts triggered by each IoE** |
| 30 | + |
| 31 | + ```kusto |
| 32 | +afad_parser |
| 33 | + |
| 34 | + | where MessageType == 0 |
| 35 | + |
| 36 | + | summarize AlertCount = count() by Codename |
| 37 | + ``` |
| 38 | + |
| 39 | +**Get all IoE alerts with severity superior to the threshold** |
| 40 | + |
| 41 | + ```kusto |
| 42 | +let threshold = 2; |
| 43 | + let SeverityTable=datatable(Severity:string,Level:int) [ |
| 44 | + "low", 1, |
| 45 | + "medium", 2, |
| 46 | + "high", 3, |
| 47 | + "critical", 4 |
| 48 | + ]; |
| 49 | + afad_parser |
| 50 | + |
| 51 | + | where MessageType == 0 |
| 52 | + |
| 53 | + | lookup kind=leftouter SeverityTable on Severity |
| 54 | + |
| 55 | + | where Level >= ['threshold'] |
| 56 | + ``` |
| 57 | + |
| 58 | +**Get all IoE alerts for the last 24 hours** |
| 59 | + |
| 60 | + ```kusto |
| 61 | +afad_parser |
| 62 | + | where MessageType == 0 and TimeGenerated > ago(1d) |
| 63 | + ``` |
| 64 | + |
| 65 | +**Get all IoE alerts for the last 7 days** |
| 66 | + |
| 67 | + ```kusto |
| 68 | +afad_parser |
| 69 | + | where MessageType == 0 and TimeGenerated > ago(7d) |
| 70 | + ``` |
| 71 | + |
| 72 | +**Get all IoE alerts for the last 30 days** |
| 73 | + |
| 74 | + ```kusto |
| 75 | +afad_parser |
| 76 | + | where MessageType == 0 and TimeGenerated > ago(30d) |
| 77 | + ``` |
| 78 | + |
| 79 | +**Get all trailflow changes for the last 24 hours** |
| 80 | + |
| 81 | + ```kusto |
| 82 | +afad_parser |
| 83 | + | where MessageType == 1 and TimeGenerated > ago(1d) |
| 84 | + ``` |
| 85 | + |
| 86 | +**Get all trailflow changes for the last 7 days** |
| 87 | + |
| 88 | + ```kusto |
| 89 | +afad_parser |
| 90 | + | where MessageType == 1 and TimeGenerated > ago(7d) |
| 91 | + ``` |
| 92 | + |
| 93 | +**Get the number of alerts triggered by each IoA** |
| 94 | + |
| 95 | + ```kusto |
| 96 | +afad_parser |
| 97 | + |
| 98 | + | where MessageType == 2 |
| 99 | + |
| 100 | + | summarize AlertCount = count() by Codename |
| 101 | + ``` |
| 102 | + |
| 103 | +**Get all IoA alerts for the last 30 days** |
| 104 | + |
| 105 | + ```kusto |
| 106 | +afad_parser |
| 107 | + | where MessageType == 2 and TimeGenerated > ago(30d) |
| 108 | + ``` |
| 109 | + |
| 110 | + |
| 111 | + |
| 112 | +## Prerequisites |
| 113 | + |
| 114 | +To integrate with Tenable Identity Exposure make sure you have: |
| 115 | + |
| 116 | +- **Access to TenableIE Configuration**: Permissions to configure syslog alerting engine |
| 117 | + |
| 118 | + |
| 119 | +## Vendor installation instructions |
| 120 | + |
| 121 | +This data connector depends on [afad_parser](https://aka.ms/sentinel-TenableApp-afad-parser) based on a Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution. |
| 122 | + |
| 123 | +1. Configure the Syslog server |
| 124 | + |
| 125 | + You will first need a **linux Syslog** server that TenableIE will send logs to. Typically you can run **rsyslog** on **Ubuntu**. You can then configure this server as you wish, but it is recommended to be able to output TenableIE logs in a separate file. |
| 126 | + |
| 127 | + Configure rsyslog to accept logs from your TenableIE IP address.: |
| 128 | + |
| 129 | + ```shell |
| 130 | + sudo -i |
| 131 | + |
| 132 | + # Set TenableIE source IP address |
| 133 | + export TENABLE_IE_IP={Enter your IP address} |
| 134 | + |
| 135 | + # Create rsyslog configuration file |
| 136 | + cat > /etc/rsyslog.d/80-tenable.conf << EOF |
| 137 | + \$ModLoad imudp |
| 138 | + \$UDPServerRun 514 |
| 139 | + \$ModLoad imtcp |
| 140 | + \$InputTCPServerRun 514 |
| 141 | + \$AllowedSender TCP, 127.0.0.1, $TENABLE_IE_IP |
| 142 | + \$AllowedSender UDP, 127.0.0.1, $TENABLE_IE_IP |
| 143 | + \$template MsgTemplate,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\n" |
| 144 | + \$template remote-incoming-logs, "/var/log/%PROGRAMNAME%.log" |
| 145 | + *.* ?remote-incoming-logs;MsgTemplate |
| 146 | + EOF |
| 147 | + |
| 148 | + # Restart rsyslog |
| 149 | + systemctl restart rsyslog |
| 150 | + ``` |
| 151 | +
|
| 152 | +2. Install and onboard the Microsoft agent for Linux |
| 153 | +
|
| 154 | + The OMS agent will receive the TenableIE syslog events and publish it in Microsoft Sentinel. |
| 155 | +
|
| 156 | +
|
| 157 | +3. Check agent logs on the Syslog server |
| 158 | +
|
| 159 | + ```shell |
| 160 | + tail -f /var/opt/microsoft/omsagent/log/omsagent.log |
| 161 | + ``` |
| 162 | +
|
| 163 | +4. Configure TenableIE to send logs to your Syslog server |
| 164 | +
|
| 165 | + On your **TenableIE** portal, go to *System*, *Configuration* and then *Syslog*. |
| 166 | + From there you can create a new Syslog alert toward your Syslog server. |
| 167 | +
|
| 168 | + Once this is done, check that the logs are correctly gathered on your server in a separate file (to do this, you can use the *Test the configuration* button in the Syslog alert configuration in TenableIE). |
| 169 | + If you used the Quickstart template, the Syslog server will by default listen on port 514 in UDP and 1514 in TCP, without TLS. |
| 170 | +
|
| 171 | +5. Configure the custom logs |
| 172 | +
|
| 173 | +Configure the agent to collect the logs. |
| 174 | +
|
| 175 | +1. In Microsoft Sentinel, go to **Configuration** -> **Settings** -> **Workspace settings** -> **Custom logs**. |
| 176 | +2. Click **Add custom log**. |
| 177 | +3. Upload a sample TenableIE.log Syslog file from the **Linux** machine running the **Syslog** server and click **Next** |
| 178 | +4. Set the record delimiter to **New Line** if not already the case and click **Next**. |
| 179 | +5. Select **Linux** and enter the file path to the **Syslog** file, click **+** then **Next**. The default location of the file is `/var/log/TenableIE.log` if you have a Tenable version <3.1.0, you must also add this linux file location `/var/log/AlsidForAD.log`. |
| 180 | +6. Set the **Name** to *Tenable_IE_CL* (Azure automatically adds *_CL* at the end of the name, there must be only one, make sure the name is not *Tenable_IE_CL_CL*). |
| 181 | +7. Click **Next**, you will see a resume, then click **Create**. |
| 182 | +
|
| 183 | +
|
| 184 | +6. Enjoy! |
| 185 | +
|
| 186 | +You should now be able to receive logs in the *Tenable_IE_CL* table, logs data can be parse using the **afad_parser()** function, used by all query samples, workbooks, and analytic templates. |
| 187 | +
|
| 188 | +
|
| 189 | +
|
| 190 | +## Next steps |
| 191 | +
|
| 192 | +For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/tenable.tenable-sentinel-integration?tab=Overview) in the Azure Marketplace. |
0 commit comments