Skip to content

Commit 5bbbcec

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #224096 from yelevin/yelevin/analytics-health-and-audit
Analytics rule health and audit
2 parents 66e871b + 1d7d5ab commit 5bbbcec

12 files changed

+329
-83
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@
6969
href: partner-integrations.md
7070
- name: Basic Logs
7171
href: basic-logs-use-cases.md
72-
- name: Health monitoring
72+
- name: Auditing and health monitoring
7373
href: health-audit.md
7474
- name: Architecture
7575
items:
@@ -450,12 +450,14 @@
450450
href: manage-soc-with-incident-metrics.md
451451
- name: Monitor Microsoft Sentinel health
452452
items:
453-
- name: Enable health monitoring
453+
- name: Enable auditing and health monitoring
454454
href: enable-monitoring.md
455455
- name: Monitor data connector health
456456
href: monitor-data-connector-health.md
457457
- name: Monitor automation rules and playbooks health
458458
href: monitor-automation-health.md
459+
- name: Audit and monitor the health of analytics rules
460+
href: monitor-analytics-rule-integrity.md
459461
- name: Monitor SAP system health and role
460462
href: monitor-sap-system-health.md
461463
- name: Auditing Microsoft Sentinel with Azure Activity Logs
@@ -537,6 +539,8 @@
537539
href: /powershell/module/az.securityinsights/
538540
- name: SentinelHealth table reference
539541
href: health-table-reference.md
542+
- name: SentinelAudit table reference
543+
href: audit-table-reference.md
540544
- name: Azure RBAC roles
541545
items:
542546
- name: All Azure roles

‎articles/sentinel/audit-table-reference.md

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
title: Microsoft Sentinel audit tables reference
3+
description: Learn about the fields in the SentinelAudit tables, used for audit monitoring and analysis.
4+
author: limwainstein
5+
ms.author: lwainstein
6+
ms.topic: reference
7+
ms.date: 01/17/2023
8+
ms.service: microsoft-sentinel
9+
---
10+
11+
# Microsoft Sentinel audit tables reference
12+
13+
This article describes the fields in the SentinelAudit tables, which are used for auditing user activity in Microsoft Sentinel resources. With the Microsoft Sentinel audit feature, you can keep tabs on the actions taken in your SIEM and get information on any changes made to your environment and the users that made those changes.
14+
15+
Learn how to [query and use the audit table](monitor-analytics-rule-integrity.md) for deeper monitoring and visibility of actions in your environment.
16+
17+
> [!IMPORTANT]
18+
>
19+
> The *SentinelAudit* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
20+
>
21+
22+
Microsoft Sentinel's audit feature currently covers only the analytics rule resource type, though other types may be added later. Many of the data fields in the following tables will apply across resource types, but some have specific applications for each type. The descriptions below will indicate one way or the other.
23+
24+
## SentinelAudit table columns schema
25+
26+
The following table describes the columns and data generated in the SentinelAudit data table:
27+
28+
| ColumnName | ColumnType | Description |
29+
| ------------------------ | -------------- | -------------------------------------------------------------- |
30+
| **TenantId** | String | The tenant ID for your Microsoft Sentinel workspace. |
31+
| **TimeGenerated** | Datetime | The time (UTC) at which the audit event occurred. |
32+
| <a name="operationname_audit"></a>**OperationName** | String | The Azure operation being recorded. For example:<br>- `Microsoft.SecurityInsights/alertRules/Write`<br>- `Microsoft.SecurityInsights/alertRules/Delete` |
33+
| <a name="sentinelresourceid_audit"></a>**SentinelResourceId** | String | The unique identifier of the Microsoft Sentinel workspace and the associated resource on which the audit event occurred. |
34+
| **SentinelResourceName** | String | The resource name. For analytics rules, this is the rule name. |
35+
| <a name="status_audit"></a>**Status** | String | Indicates `Success` or `Failure` for the [OperationName](#operationname_audit). |
36+
| **Description** | String | Describes the operation, including extended data as needed. For example, for failures, this column might indicate the failure reason. |
37+
| **WorkspaceId** | String | The workspace GUID on which the audit issue occurred. The full Azure Resource Identifier is available in the [SentinelResourceID](#sentinelresourceid_audit) column. |
38+
| **SentinelResourceType** | String | The Microsoft Sentinel resource type being monitored. |
39+
| **SentinelResourceKind** | String | The specific type of resource being monitored. For example, for analytics rules: `NRT`. |
40+
| **CorrelationId** | String | The event correlation ID in GUID format. |
41+
| **ExtendedProperties** | Dynamic (json) | A JSON bag that varies by the [OperationName](#operationname_audit) value and the [Status](#status_audit) of the event.<br>See [Extended properties](#extended-properties) for details. |
42+
| **Type** | String | `SentinelAudit` |
43+
44+
## Operation names for different resource types
45+
46+
| Resource types | Operation names | Statuses |
47+
| -------------------- | --------------- | -------- |
48+
| **[Analytics rules](monitor-analytics-rule-integrity.md)** | - `Microsoft.SecurityInsights/alertRules/Write`<br>- `Microsoft.SecurityInsights/alertRules/Delete` | Success<br>Failure |
49+
50+
## Extended properties
51+
52+
### Analytics rules
53+
54+
Extended properties for analytics rules reflect certain [rule settings](detect-threats-custom.md).
55+
56+
| ColumnName | ColumnType | Description |
57+
| ------------------------ | -------------- | --------------------------------------------------------------- |
58+
| **CallerIpAddress** | String | The IP address from which the action was initiated. |
59+
| **CallerName** | String | The user or application that initiated the action. |
60+
| **OriginalResourceState** | Dynamic (json) | A JSON bag that describes the rule before the change. |
61+
| **Reason** | String | The reason why the operation failed. For example: `No permissions`. |
62+
| **ResourceDiffMemberNames** | Array\[String\] | An array of the properties that changed on the relevant resource. For example: `['custom_details','look_back']`. |
63+
| **ResourceDisplayName** | String | Name of the analytics rule on which the audit issue occurred. |
64+
| **ResourceGroupName** | String | Resource group of the workspace on which the audit issue occurred. |
65+
| **ResourceId** | String | The resource ID of the analytics rule on which the audit issue occurred. |
66+
| **SubscriptionId** | String | The subscription ID of the workspace on which the audit issue occurred. |
67+
| **UpdatedResourceState** | Dynamic (json) | A JSON bag that describes the rule after the change. |
68+
| **Uri** | String | The full-path resource ID of the analytics rule. |
69+
| **WorkspaceId** | String | The resource ID of the workspace on which the audit issue occurred. |
70+
| **WorkspaceName** | String | The name of the workspace on which the audit issue occurred. |
71+
72+
73+
## Next steps
74+
75+
- Learn about [auditing and health monitoring in Microsoft Sentinel](health-audit.md).
76+
- [Turn on auditing and health monitoring](enable-monitoring.md) in Microsoft Sentinel.
77+
- [Monitor the health of your automation rules and playbooks](monitor-automation-health.md).
78+
- [Monitor the health of your data connectors](monitor-data-connector-health.md).
79+
- [Monitor the health and integrity of your analytics rules](monitor-analytics-rule-integrity.md).
80+
- [SentinelHealth tables reference](health-table-reference.md)

‎articles/sentinel/enable-monitoring.md

Lines changed: 39 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,87 @@
11
---
2-
title: Turn on health monitoring in Microsoft Sentinel
2+
title: Turn on auditing and health monitoring in Microsoft Sentinel
33
description: Monitor supported data connectors by using the SentinelHealth data table.
4-
ms.topic: how-to
5-
ms.date: 11/07/2022
64
author: limwainstein
75
ms.author: lwainstein
8-
ms.service: microsoft-sentinel
6+
ms.topic: how-to
7+
ms.date: 01/19/2023
98
---
109

11-
# Turn on health monitoring for Microsoft Sentinel (preview)
10+
# Turn on auditing and health monitoring for Microsoft Sentinel (preview)
11+
12+
Monitor the health and audit the integrity of supported Microsoft Sentinel resources by turning on the auditing and health monitoring feature in Microsoft Sentinel's **Settings** page. Get insights on health drifts, such as the latest failure events or changes from success to failure states, and on unauthorized actions, and use this information to create notifications and other automated actions.
1213

13-
Monitor the health of supported Microsoft Sentinel resources by turning on the health monitoring feature in Microsoft Sentinel's **Settings** page. Get insights on health drifts, such as the latest failure events or changes from success to failure states, and use this information to create notifications and other automated actions.
14+
To get health data from the *SentinelHealth* data table, or to get auditing information from the *SentinelAudit* data table, you must first turn on the Microsoft Sentinel auditing and health monitoring feature for your workspace.
1415

15-
To get health data from the *SentinelHealth* data table, you must first turn on the Microsoft Sentinel health feature for your workspace.
16+
This article instructs you how to turn on these features.
1617

17-
When the health feature is turned on, the *SentinelHealth* data table is created at the first success or failure event generated for supported resource types.
18+
When the feature is turned on, the *SentinelHealth* and *SentinelAudit* data tables are created at the first event generated for the selected resources.
1819

19-
The following resource types are currently supported:
20+
The following resource types are currently supported for health monitoring:
21+
- Analytics rules (New!)
2022
- Data connectors
2123
- Automation rules
2224
- Playbooks (Azure Logic Apps workflows)
2325
> [!NOTE]
2426
> When monitoring playbook health, you'll also need to collect Azure Logic Apps diagnostic events from your playbooks in order to get the full picture of your playbook activity. See [**Monitor the health of your automation rules and playbooks**](monitor-automation-health.md) for more information.
2527
26-
To configure the retention time for your health events, see [Configure data retention and archive policies in Azure Monitor Logs](../azure-monitor/logs/data-retention-archive.md).
28+
Only the analytics rule resource type is currently supported for auditing.
29+
30+
31+
To configure the retention time for your audit and health events, see [Configure data retention and archive policies in Azure Monitor Logs](../azure-monitor/logs/data-retention-archive.md).
2732

2833
> [!IMPORTANT]
2934
>
30-
> The *SentinelHealth* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
35+
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
3136
>
3237
33-
## Turn on health monitoring for your workspace
38+
## Turn on auditing and health monitoring for your workspace
3439

3540
1. In Microsoft Sentinel, under the **Configuration** menu on the left, select **Settings**.
3641

3742
1. Select **Settings** from the banner.
3843

39-
1. Scroll down to the **Health monitoring** section that appears below, and select it to expand.
44+
1. Scroll down to the **Auditing and health monitoring** section that appears below, and select it to expand.
4045

41-
1. Select **Configure Diagnostic Settings**.
46+
1. Select **Enable** to enable auditing and health monitoring across all resource types and to send the auditing and monitoring data to your Microsoft Sentinel workspace (and nowhere else).
47+
48+
Or, select the **Configure diagnostic settings** link to enable health monitoring only for the data collector and/or automation resources, or to configure advanced options, like additional places to send the data.
4249

4350
:::image type="content" source="media/enable-monitoring/enable-health-monitoring.png" alt-text="Screenshot shows how to get to the health monitoring settings.":::
4451

45-
1. In the **Diagnostic settings** screen, select **+ Add diagnostic setting**.
52+
If you selected **Enable**, then the button will gray out and change to read **Enabling...** and then **Enabled**. At that point, auditing and health monitoring is enabled, and you're done! The appropriate diagnostic settings were added behind the scenes, and you can view and edit them by selecting the **Configure diagnostic settings** link.
53+
54+
1. If you selected **Configure diagnostic settings**, then in the **Diagnostic settings** screen, select **+ Add diagnostic setting**.
55+
56+
(If you're editing an existing setting, select it from the list of diagnostic settings.)
4657

4758
- In the **Diagnostic setting name** field, enter a meaningful name for your setting.
4859

49-
- In the **Logs** column, select the appropriate **Categories** for the resource types you want to monitor, for example **Data Collection - Connectors**.
60+
- In the **Logs** column, select the appropriate **Categories** for the resource types you want to monitor, for example **Data Collection - Connectors**. Select **allLogs** if you want to monitor analytics rules.
5061

5162
- Under **Destination details**, select **Send to Log Analytics workspace**, and select your **Subscription** and **Log Analytics workspace** from the dropdown menus.
5263

64+
:::image type="content" source="media/enable-monitoring/diagnostic-settings.png" alt-text="Screenshot of diagnostic settings screen for enabling auditing and health monitoring.":::
65+
66+
If you require, you may select other destinations to which to send your data, in addition to the Log Analytics workspace.
67+
5368
1. Select **Save** on the top banner to save your new setting.
5469

55-
The *SentinelHealth* data table is created at the first success or failure event generated for the selected resources.
70+
The *SentinelHealth* and *SentinelAudit* data tables are created at the first event generated for the selected resources.
5671

57-
## Access the *SentinelHealth* table
72+
## Verify that the tables are receiving data
5873

5974
In the Microsoft Sentinel **Logs** page, run a query on the *SentinelHealth* table. For example:
6075

6176
```kusto
62-
SentinelHealth
77+
_SentinelHealth()
6378
| take 20
6479
```
6580

6681
## Next steps
6782

68-
- Learn what [health monitoring in Microsoft Sentinel](health-audit.md) can do for you.
69-
- [Monitor the health of your Microsoft Sentinel data connectors](monitor-data-connector-health.md).
70-
- [Monitor the health of your Microsoft Sentinel automation rules](monitor-automation-health.md).
71-
- See more information about the [*SentinelHealth* table schema](health-table-reference.md).
83+
- Learn about [auditing and health monitoring in Microsoft Sentinel](health-audit.md).
84+
- [Monitor the health of your automation rules and playbooks](monitor-automation-health.md).
85+
- [Monitor the health of your data connectors](monitor-data-connector-health.md).
86+
- [Monitor the health and integrity of your analytics rules](monitor-analytics-rule-integrity.md).
87+
- See more information about the [*SentinelHealth*](health-table-reference.md) and [*SentinelAudit*](audit-table-reference.md) table schemas.

0 commit comments

Comments
 (0)