Getting Data In

Ingesting Incidents from MS Sentinel

PickleRick
SplunkTrust
SplunkTrust

Anyone has any experience in ingesting Incidents from Microsoft Sentinel (formerly Azure Sentinel)?

I found info about the https://splunkbase.splunk.com/app/4564 add-on which works with Graph Security which is supposed to be a "middleware" of sorts between different kinds of security events but on the other hand I find that data pulled this way is very limited in terms of details. So I thought about callind Sentinel API directly. There is supposedly API we could use, it has PowerShell module, I'm not sure about decent "curlable" docs but I didn't look very hard for it. Yet. The question however is are we doomed to write something completely from scratch or is there anything ready that I could use?

Labels (1)
Tags (1)
0 Karma

Azeemering
Builder

I am in the same boat. I have the same requirement and am planning to write something from scratch using the API

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The key problem here is that I have no Azure experience whatsoever and all those services' names mean completely nothing to me 🙂

But.

From what I read, it seems that you supposedly can configure the Sentinel to send notifications about incidents to Event Hub. And I think that you can pull events from the Event Hub - https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureeventhubs

So it might be easier than I thought. Unfortunately, I didn't have any hands-on experience with Sentinel yet.

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...