WIXLIB

Case study–Global retailerACME Corporation, a large retailer, is currently using Azure Sentinel SIEM as its core cybersecurityanalytics monitoring tool. There are several log sources running in Azure Cloud, including Azure PaaSand IaaS resources, on-premises infrastructure, and numerous SaaS applications used by the financedepartment. The current volume of ingested log is 125 GB/day and ACME Corporation is using capacityreservation for 100 GB/day for both Log Analytics and Azure Sentinel.ACME Corporation is subject to Payment Card Industry (PCI) data security standard (DSS) regulatorycompliance and, therefore, has a log retention requirement of 90 days online and 1 year offline.While investigating other options for extended retention, the company decided to extend the onlineretention period in Log Analytics to 365 days, paying an additional 3,500/month. Based on East U.S.Azure Region, the company currently pays a combined fee of 15,515/month.Availability of less costly storage options such as Azure Blob Storage or Cosmos DB are good ones toconsider to meet compliance requirements. Our experience from performing cost analysis exercisesshows that most organizations below 100 GB/day of data ingestion often choose to retain data inLog Analytics, primarily to maintain advanced security capabilities present in Log Analytics and AzureSentinel. Capacity reservations are of great benefit once your organization is beyond 100 GB/day, butfor larger ingestion and retention requirements, alternative storage options should be considered.Azure SentinelWith Log Analytics deployed, the Azure Sentinelresource is available for configuration to performSIEM functions. We will cover Azure Sentinel itselfin greater depth further in this whitepaper.Azure Logic AppsAzure Logic Apps provides security orchestrationand automated response (SOAR) capabilitiesin Azure Sentinel. Azure Logic Apps power“playbooks” and are, effectively, a sequenceof procedures that can be run in response to asecurity alert. Playbooks can help automate andorchestrate response actions that would typicallybe undertaken by security analysts. These can betriggered manually or set to run automaticallywhen specific alerts are triggered.Azure Sentinel Deployment Best PracticesAzure Logic Apps is a great beneficiary ofthe capabilities of elastic compute and usesthe power of the Azure Cloud platform toautomatically scale and meet demand—youdo not have to worry about the complexity ofinfrastructure capacity, hosting, maintenance,or availability for your workflows. It is highlylikely that if an organization has workloads inAzure Cloud, Logic Apps are already used inautomations for other services.Azure Logic Apps comes with many different outof-the-box connectors that enable organizationsto easily create Azure Sentinel playbooks forautomated workflows.6 Azure Logic Apps pricingstructure is based on the number of transactions(or executions) and the type of connector.8

As a Microsoft Azure Cloud service, Azure LogicApps runs under a consumption-based pricingand metering model. This means that the fees arerelated only to how many workflow actions AzureLogic Apps execute.The monthly price for deploying and using LogicApps to orchestrate security event response isgenerally not an significant factor in the total costof running Azure Sentinel. The versatility providesorganizations with a wide range of options forreporting, alerting, and orchestration involvingAzure Sentinel alerts. Other enterprise-gradeconnectors for non-security applications cancome with higher cost price tags, so evaluationon the volume of playbook runs should beundertaken before deployment.Case study–Community collegeEDU Research, a community college with 9,000 employees, is currently using Azure Sentinel SIEM forsecurity monitoring and automated security incident response. The following Azure Sentinel playbookswere configured using Azure Logic Apps, as part of EDU Research Sentinel alert rules response:Azure Usage runs a daily query in the Log Analytics usage table and sends an emailnotification to the EDU SOC team with aggregate daily Azure ingest costs per log source.Incident Notification runs when a Sentinel alert triggers and automatically opens aServiceNow ticket with incident details.Health Monitoring runs when an Azure Sentinel playbook fails and sends an emailnotification to EDU SOC team.Running in the East U.S. Azure Region, EDU Research pays a total monthly aggregated fee for AzureLogic Apps of 95.00, which includes standard connector actions, built-in actions, and data retentionfees. Relative to the value produced by automating response actions, the cost for building securityworkflow automations in Logic Apps is often negligible and a powerful way to drive business value froman Azure Sentinel deployment.Azure Sentinel Deployment Best Practices9

Data sourcesWe regularly encounter a commonmisconception among security executives andpractitioners that Azure Sentinel can only be usedfor Azure Cloud resources. In fact, Azure Sentinelis successfully used to ingest and correlate datafrom a wide range of log sources located ina variety of cloud platforms (Azure, AmazonWeb Service [AWS] and Google Cloud), onpremises network and compute infrastructure,3rd party security tools, or software as a service(SaaS) applications. In addition to the growingset of out-of-the-box data connectors, theAzure Sentinel public community is regularlydemonstrating new use cases and dataconnectors that expand the capabilitiesof the solution.Case study–Transportation companyWheels Transportation is a transportation and logistics company that has been in business for over100 years. At the time of initial engagement, Wheels did not have any workloads in Azure, includingcommon productivity tools such as Microsoft Office 365. Infrastructure was primarily on premise,including servers and network infrastructure.The security operations team at Wheels had been using an on-premises SIEM solution that requiredregular capital expenditure on storage and server hardware, which had to be aligned to predictedevents per second (EPS) ingestion requirements several years into the future. This EPS forecast was oftenmissed, resulting in unbudgeted purchases of additional hardware and log ingestion licenses.Wheels chose to deploy Azure Sentinel as its first Azure resource and primary SIEM solution because ofthe ability to operationalize log ingestion costs using public cloud. Although Wheels did not have anyexisting Azure Cloud infrastructure, the flexibility of the Azure Sentinel SIEM solution was the right fit.Azure Sentinel Deployment Best Practices10

The wide variety of potential data types as log sources means that the consideration paid to eachdifferent data type is important at the outset of an Azure Sentinel project. Azure Sentinel includesmore than 100 connectors, out of the box, with the ability to create custom sources to meet individualrequirements. We have collected a summary table of some of the more common data source types, withexperiential commentary relevant for deployment teams configuring new data ingest sources.To learn about the more than 100 connectors included with Azure Sentinel, go el/connect-data-sources.Log ingestion methodTypical log sourcesMicrosoft native dataconnectorsBuilt-in Azure Sentinel dataconnectors for Microsoft nativelog sources, such as AzureServices (e.g., Active Directory,distributed denial of service[DDoS] protection, KubernetesService, Web ApplicationFirewall [WAF]), Dynamics 365,Microsoft Office 365, MicrosoftDefender security services.Several of these data sourcesare free, such as alerts fromMicrosoft 365 Defender orAzure Defender, while additionaladvanced hunting logs are paid.Windows and Linux machinesdeployed on-premises or in anyother cloud environments.Windows events are typicallyvery noisy, and it will requirean advanced MMA/AMA agentconfiguration. Also filteringspecific Windows event IDslevel (done via Group Policyconfiguration) may be requiredon the source servers or via theAMA agent configuration.Log Analytics agentMicrosoft Internet InformationServer (IIS) Web Servers logs canbe collected via this agent.Any logs from other applicationsrunning on the same machinewhere MMA agent is running.This is collected via MMACustom Log settings.Azure Sentinel Deployment Best PracticesExperienceAzure Sentinel can nativelyingest security alerts fromDefender for Identity, Defenderfor Office 365, Defender forEndpoints, and Microsoft cloudapp security.Windows PerformanceCounters can be collected viathis agent, too. Depending onthe sample rate interval, thiscan increase the volume ofcollected events, increasing theoverall Azure consumption11

Syslog log forwarderFirewalls, intrusion preventionsystems (IPSs), L2/L3 networkdevices, and others.Syslog data is collected in Syslogformat and will require creationof log parsers in Azure Sentinel.All Syslog messages are storedin a single Log Analytics table(Syslog table).This method does not allow anycontrol on the volume or type oflog ingested.Common event format(CEF) log forwarderLogic App playbooksSome type firewalls, SoftwareDefined Wide Area Network(SDWAN), and Secure AccessService Edge (SASE) platformsCEF has a standard schemaused by many security vendors,allowing interoperabilityamong different platforms.CEF is an industry standard format.Microsoft provides the installationscripts and documentation for aLinux agent that can be deployedon the same machine where aSyslog agent runs.It does not require additionallog parsingPaaS and SaaS applications.Using remote application RESTAPI calls, the data connectorscan be set up to extract specificevents only, which is an effectivetool for log optimization.An Azure Logic Apps playbookusing a REST API call can be usedto pull events from an applicationor tool.Azure Sentinel Deployment Best PracticesMany platforms, like firewalls,allow customization of CEFtemplates, which is a greattool to optimize the volume ofingested logs at thesource point.12

This method is typically used forSaaS applications. Data is ingestedin Azure Sentinel Log Analyticsworkspace and is placed in acustom table.Log ingestion is based on“pull,” within a predefinedtime interval (no real-timecapabilities).This relies on availability ofAzure Sentinel playbooks;therefore, additionalmonitoring is required forplaybook health and status.The customer has controlover Log Analytics tableschema definition.REST API(Azure function)SaaS applications.This method requires customdevelopment using remoteapplication REST APIs and Azurefunctions.Customer does not need to run aseparate machine/VM.Logs are ingested in a LogAnalytics custom table.Log optimization is dependent onremote application REST API.This is the Microsoftrecommended method for logcollection from customlog sources.Logstash collectorFirewalls, IPS, network devices,and others.A Logstash collector needs tobe deployed on-premises or in acloud environment on a VM.Data enrichment (such asgeo-location) can be done oncollection point.This allows log optimization, bycollecting only requiredlog fields.Once ingested in Azure SentinelLog Analytics workspace, datawill be stored in a custom table.Azure Sentinel Deployment Best Practices13

Many parsers and dataenrichment tools areavailable in open-sourceElasticsearch-LogstashKibana (ELK) community.Microsoft recentlyannounced that the Logstashcollector method will besupported as well.Azure diagnosticsAzure PaaS resources.Not always considered a separatelog ingestion method, collectingevents via Azure Diagnosticsis applicable to Azure PaaSresources only.Turning Azure Diagnostics forAzure PaaS resources, the auditlogs and metrics events can becollected and stored in an AzureDiagnostics Log Analytics table.The customer must createlog parsers for eachresource type.Data ingested via AzureDiagnostics is very noisyand will increase the overallAzure consumption.No data optimization canbe done via this method.Microsoft provides in AzureSentinel a set of standarddata connectors (e.g.,Azure Key Vault, AzureKubernetes) for a few PaaSresources.If the customer does nothave any compliancerequirements for logretention, using AzureDefender for monitoringand protecting Azure PaaSresources, in general, is amore cost-effective solutionfor this situation.Azure Sentinel Deployment Best Practices14

File-based ingestionAmazon Web ServicesUsed for ingestion of datafrom files located on the samemachines where Log AnalyticsAgent is running. This option usesthe Custom Logs configuration ofthe Log Analytics Agent.Logs are collected in a LogAnalytics custom table ( CL).Microsoft provides an AWSCloudTrail Azure Sentinel dataconnector out of the box.Limited to AWS CloudTrailonly (default).Collecting events from other AWSresources, a REST API function canbe developed.Threat intelligenceplatforms: StructuredThreat InformationExpression (STIX) andTrusted AutomatedeXchange of IndicatorInformation (TAXII)Available from external ThreatIntelligence Platforms and fromSTIX/TAXII feeds, both open sourceand premium, these can enrichAzure Sentinel with additionalindicators of compromise (IoC)such as known malicious internetprotocols (IPs) or domain nameservice (DNS) names.Using the Log AnalyticsAgent configuration tool, aspecific record delimiter anda path to the file can be used.Data is placed in AWSCloudTrail table, and it isalready parsed.Employ either the Azure SentinelThreat Intelligence Platforms dataconnector or Azure Sentinel TAXIIdata connector.This requires one or more externalThreat Intelligence Platforms and/or STIX/TAXII feeds.STIX/TAXII is an ingest protocolunique to importing securityintelligence data.Microsoft provides a set of guidelines for vendors and Azure Sentinel community for development ofnew data connectors.Azure Sentinel uses Azure Log Analytics as the backend for the log storage and querying capabilitiesthrough KQL. A wealth of information is available from various log sources stored in Log Analyticsas “tables.” There are a variety of default tables, though not always populated with data while otherscreated as specific Azure Sentinel data connectors are enabled and configured. Another range of tables,not covered in the list following, are represented by custom logs that can be used to ingest logs fromcustom applications that fall outside the scope of standard SIEM log sources.Azure Sentinel Deployment Best Practices15

Azure SentineltableDescriptionLog sourcesRelevant dataAuditLogsAzure Active Directoryactivities audit such ascreation/modification ofusers, groups, applicationsAzure dTrailAWS CloudTrail log ureActivityAzure activity such as creation/modification/deletion of Azureresources, policy age of diagnostic logs forAzure resources (resourcesmust be configured to sendthe diagnostics logs tothe specific Log aYesAzureMetricsProvides storage of metricsrecorded by var

Case study-Global retailer ACME Corporation, a large retailer, is currently using Azure Sentinel SIEM as its core cybersecurity analytics monitoring tool. There are several log sources running in Azure Cloud, including Azure PaaS and IaaS resources, on-premises infrastructure, and numerous SaaS applications used by the finance department.