continued draft

Author: batamig

articles/defender-for-iot/organizations/TOC.yml

@@ -130,7 +130,7 @@
     items:
     - name: Integration catalog
       href: integrate-overview.md
-    - name: Send cloud data to partner services
+    - name: Stream cloud alerts to a 3rd party SIEM
       href: integrations/send-cloud-data-to-partners.md
     - name: Aruba ClearPass
       href: tutorial-clearpass.md

articles/defender-for-iot/organizations/integrations/send-cloud-data-to-partners.md

@@ -0,0 +1,119 @@
+---
+title: Stream Microsoft Defender for IoT cloud alerts to a partner SIEM - Microsoft Defender for IoT
+description: Learn how to send Microsoft Defender for IoT data on the cloud to a partner SIEM via Microsoft Sentinel, using Splunk as an example.
+ms.date: 12/26/2022
+ms.topic: how-to
+---
+
+# Stream Defender for IoT cloud alerts to a partner SIEM
+
+As more businesses convert OT systems to digital IT infrastructures, security operations center (SOC) teams and chief information security officers (CISOs) are increasingly responsible for handling threats from OT networks.
+
+We recommend using Microsoft Defender for IoT's out-of-the-box [data connector](../iot-solution.md) and [solution](../iot-advanced-threat-monitoring.md) to integrate with Microsoft Sentinel and bridge the gap between the IT and OT security challenge.
+
+However, if you have other security information and event management (SIEM) systems, you can also use Microsoft Sentinel to forward Defender for IoT alerts on to that partner SIEM, via an Event Hub.
+
+This article describes how to use Microsoft Sentinel to forward Defender for IoT alert data on to partner SIEMs. While this article uses Splunk as an example, you can use this process with any SIEM that supports Event Hub ingestion, such as  IBM QRadar.
+
+> [!IMPORTANT]
+> Using Event Hub and a Log Analytics export rule may incur additional charges. For more information, see Event Hubs pricing and Log Data Export pricing
+
+> [!TIP]
+> This process described in this article supports alerts generated by cloud-connected sensors only. If you're working on-premises, such as in air-gapped environments, you may be able to create a forwarding alert rule to forward alert data directly from an OT sensor or on-premises management console. For more information, see [Integrations with Microsoft and partner services](../integrate-overview.md).
+
+## Prerequisites
+
+Before you start, you'll need the **Microsoft Defender for IoT** data connector installed in your Microsoft Sentinel instance.
+
+For more information, see [Tutorial: Connect Microsoft Defender for IoT with Microsoft Sentinel](../iot-solution.md).
+
+<!--permissions?-->
+
+## Register an application in Azure Active Directory
+
+You'll need Azure Active Directory (Azure AD) to defined as a service principal for the [Splunk Add-on for Microsoft Cloud Services](https://splunkbase.splunk.com/app/3110/). To do this, you'll need an Azure AD application with specific permissions.
+
+**To register an Azure AD application and define permissions**:
+
+1. In [Azure AD](/azure/active-directory/), register a new application and add a new client secret for the service principal.
+
+    For more information, see [Register an application with the Microsoft identity platform](/azure/active-directory/develop/quickstart-register-app)
+
+1. In your app's **API permissions** page, grant API permissions to read data from your app.
+
+    1. Select to add a permission and then select **Microsoft Graph** > **Application permissions** > **SecurityEvents.ReadWrite.All**.
+
+    1. Make sure that admin consent is required for your permissions.
+
+    For more information, see [Configure a client application to access a web API](/azure/active-directory/develop/quickstart-configure-app-access-web-apis#add-permissions-to-access-your-web-api)
+
+1. From your app's **Overview** and **Certificates & secrets** pages, note the following values for your app:
+
+    - Display name
+    - Application (Client) ID
+    - Application (Client) secret
+    - Directory (tenant) ID
+
+
+## Create an Azure Event Hub
+
+Create an Azure Event Hub to use as a bridge between Microsoft Sentinel and your partner SIEM. Start this step by creating an Azure Event Hub namespace, and then adding an Azure Event Hub.
+
+**To create your Event Hub namespace and Event Hub**:
+
+
+1. In Azure Event Hubs, create a new Event Hubs namespace and then create an Azure event hub within the namespace.
+
+    Make sure to define the **Partition Count** and **Message Retention** settings.
+
+    For more information, see [Create an event hub using the Azure portal](/azure/event-hubs/event-hubs-create).
+
+1. In your Event Hubs namespace, select the **Access control (IAM)** page and add a new role assignment. Add the Azure AD service principle that you'd created earlier, and define the delegate as **Azure Event Hubs Data Receiver**.
+
+    For more information, see:
+
+1. In your Event Hubs namespace, make a note of the following values:
+
+    - Host name
+    - Azure Event Hub name
+
+## Forward Microsoft Sentinel incidents to your Event Hub
+
+To forward Microsoft Sentinel incidents or alerts to Azure Event Hub, you’ll need to define your Microsoft Sentinel workspace with a data export rule.
+
+
+In the Azure Portal, navigate to Log Analytics > select the workspace name related to Microsoft Sentinel > Data Export > New export rule.
+thumbnail image 8 of blog post titled 
+
+Name the rule, configure the Source as SecurityIncident and the Destination as Event Type utilizing the Event Hub Namespace and Event Hub Name configured previously. Click on Create.
+thumbnail image 9 of blog post titled 
+
+## Configure Splunk to consume Microsoft Sentinel incidents
+
+
+5. Configure Splunk to consume Microsoft Sentinel Incidents from Azure Event Hub
+For Microsoft Defender for IoT alerts to be ingested into Azure Event Hub, install the Splunk Add-on for Microsoft Cloud Services app.
+
+
+For the installation, open the Splunk portal and navigate to Apps > Find More Apps. For the dashboard find the Splunk Add-on for Microsoft Cloud Services app and Install.
+thumbnail image 10 of blog post titled 
+
+To add the Azure AD Service Principal, open the Splunk app and navigate to Azure App Account > Add. Use the details you’d noted earlier:
+Define a Name for the Azure App Account
+
+Add the Client ID, Client Secret, Tenant ID
+
+Choose Azure Public Cloud as Account Class Type
+
+Click Update to save and close the configuration.
+thumbnail image 11 of blog post titled 
+
+Now navigate to Inputs within the Splunk Add-on for Microsoft Cloud Services app and select Azure Event Hub in Create New Input selection. 
+
+Define a Name for the Azure Event Hub as Input, select the Azure App Account created before, define the Event Hub Namespace (FQDN), Event Hub Name, let the other settings as default and click Update to save and close the configuration.
+thumbnail image 12 of blog post titled 
+	
+Once the ingestion is processed, you can query the data by using sourcetype="mscs:azure:eventhub" in search field.
+thumbnail image 13 of blog post titled 
+	
+