Chapter 15: Enabling and Integrating Azure AD Logs with SIEM Solutions

The previous chapter covered how to analyze, review, and investigate our logs and events to protect against risky sign-ins and elevated-risk users. This included creating reports and reviewing insights for user activity to recognize potential vulnerabilities and alert against possible threats. In this chapter, we will discuss how to integrate and enable the use of these logs with Microsoft Sentinel or a third-party security incident and event management (SIEM) solution. This will include how to use Log Analytics with Kusto queries to review activity in Microsoft Sentinel.

In this chapter, we're going to cover the following main topics:

• Enabling and integrating Azure AD diagnostic logs with Log Analytics and Microsoft Sentinel
• Exporting sign-in and audit logs to a third-party SIEM
• Reviewing Azure AD activity by using Log Analytics and Microsoft Sentinel

Technical requirements

In this chapter, we will continue to explore configuring a tenant for use of Microsoft 365 and Azure. There will be exercises that will require access to Azure Active Directory (AD). If you have not yet created the trial licenses for Microsoft 365, please follow the directions provided in Chapter 1, Preparing for Your Microsoft Exam.

Enabling and integrating Azure AD diagnostic logs with Log Analytics and Microsoft Sentinel

In the previous chapter, we discussed how to access and use activity logs and audit logs to review user activity and filter that activity for monitoring, reporting, and managing potential vulnerabilities and threats. In this chapter, we will discuss how we can use this information within Microsoft Sentinel and third-party SIEM solutions to provide an integration of these logs to handle security operations more efficiently in one location.

This section will provide guidance on how to export logs to Microsoft Sentinel. The next section will discuss how to export logs to third-party security tools, if you are not utilizing Microsoft Sentinel. Let's start by explaining Microsoft Sentinel and what SIEM and security orchestration automated response (SOAR) solutions are.

A SIEM is a solution within a security operations center that gathers logs and events from various appliances and software...

Exporting sign-in and audit logs to a third-party SIEM

Azure Monitor is the Azure solution that most Azure services utilize for activity, event, and security logging. Azure AD, Azure Resource Manager, Azure Firewall, and Microsoft Defender for Cloud all utilize integration with Azure Monitor for monitoring and managing activity within Azure. The previous section discussed how to use and connect Microsoft Sentinel for monitoring, managing, and alerting on security activity based on these logs through Azure Monitor and Log Analytics. Companies that currently have a third-party SIEM and/or SOAR solution can also connect to Azure Monitor to monitor Azure AD activity. Azure Monitor routes the logs through Azure Event Hubs to deliver the log data to external applications.

More information on connecting Azure Monitor to third-party SIEM solutions for Azure AD logs can be found at this link: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-monitoring...

Reviewing Azure AD activity by using Log Analytics and Microsoft Sentinel

In this section, we will go through the step-by-step process of running a log query for Azure AD activity within Microsoft Sentinel. We will also step through how to review Azure AD workbooks and save the workbooks for monitoring, reviewing, and exporting:

1. Navigate to your Microsoft Sentinel workspace from within portal.azure.com:

Figure 15.17 – Microsoft Sentinel workspace

2. Select Logs under the General menu to access the Log Analytics workspace that is connected to Microsoft Sentinel. There is a video available here to provide an overview of Log Analytics. Select the X icon at the top right to close this video window:

Figure 15.18 – Microsoft Sentinel Logs screen

3. A tile of common queries opens. Select the X icon on the right to close this tile:

Figure 15.19 – Common queries...

Summary

In this chapter, we covered the integration of Azure Monitor with Microsoft Sentinel and other third-party SIEM and SOAR solutions. This included the configuration and setup of Microsoft Sentinel. Microsoft has provided the capability to integrate Azure Monitor with popular third-party SIEM and SOAR solutions, and we provided solutions and links to help with the integration process. The final section of the chapter provided steps to run Kusto queries with Log Analytics to review Azure AD activity, along with Azure AD workbooks for monitoring Azure AD activity.

The next chapter will provide practice questions to help you in your final preparation for the Identity and Access Administrator Associate exam.