This pack includes:
- Log Normalization - XDM mapping for key event types.
Supported Event Types:
- AuditLogs
- SignInLogs
- NonInteractiveUserSignInLogs
- ServicePrincipalSignInLogs
- ManagedIdentitySignInLogs
- ADFSSignInLogs
- ProvisioningLogs
- RiskyUsers
- UserRiskEvents
- RiskyServicePrincipals
- ServicePrincipalRiskEvents
Supported Timestamp Formats:
- YYYY-MM-DDTHH:MM:SS.S* (UTC)
- YYYY-MM-DDTH:M:S.S* (UTC)
Data Collection
To configure Microsoft Entra ID to send logs to Cortex XSIAM, follow the below steps.
Prerequisites
- Create an Azure event hub. For more information, refer to Microsoft's official documentation.
- Make sure that you have at least a Security Administrator role.
Stream logs to an event hub
- Sign in to the Microsoft Entra admin center.
- Navigate to Identity → Monitoring & health → Diagnostic settings.
- Select + Add diagnostic setting to create a new integration or select Edit setting for an existing integration.
- Enter a Diagnostic setting name. If you're editing an existing integration, you can't change the name.
- Select the log categories that you want to stream. Refer to the Log Normalization section for the supported log categories for normalization.
- Select the Stream to an event hub checkbox.
- Select the Azure subscription, Event Hubs namespace, and optional event hub where you want to route the logs.
For more information, refer to Microsoft's official documentation.
Cortex XSIAM side
To connect Cortex XSIAM to the Azure Event Hub, follow the below steps.
Azure Event Hub Collector
- Navigate to Settings → Data Sources.
- If you have already configured an Azure Event Hub Collector, select the 3 dots, and then select + Add New Instance. If not, select + Add Data Source, search for "Azure Event Hub" and then select Connect.
- Fill in the attributes based on the Azure Event Hub you streamed your data to.
- Leave the Use audit logs in analytics checkbox selected, unless you were told otherwise.
More information can be found here.
