Segregating and Identifying Alerts in Sentinel Workspace

Someiah C S 80

I am seeking a method to segregate alerts in a Sentinel workspace to facilitate easier identification and prioritization. For instance, if we have multiple clients' logs in a single workspace, we need a way to identify and segregate alerts based on the client.

Is tagging an alert based on the Resource Group (RG) the best approach? If so, how can we achieve and implement this?

Givary-MSFT 33,311 Reputation points Microsoft Employee

2024-07-03T05:27:49.2533333+00:00

@Someiah C S Thank you for reaching out to us, let me research on your ask and revert back.
Givary-MSFT 33,311 Reputation points Microsoft Employee

2024-07-04T04:07:34.32+00:00

Thank you @Andrew Blumhardt for answering this query and providing the inputs.

@Someiah C S Just wanted to check does the below info helps or not, let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Someiah C S 80 Reputation points

2024-07-04T05:24:45.59+00:00

Hi @Givary-MSFT

Thanks for checking with me, if you could also provide some suggestions on my below comment. That would be great.
Givary-MSFT 33,311 Reputation points Microsoft Employee

2024-07-11T04:12:27.13+00:00

@Someiah C S Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

Andrew Blumhardt 9,866 Reputation points Microsoft Employee

2024-07-03T12:22:55.9866667+00:00

If these clients are individual customers you may want to keep them in separate Sentinel instances for a variety of reasons. For example, billing, privacy, and the difficulty of separating clients later. Sentinel has many features to support an MSP model. https://aka.ms/mssentinelmssp.

I agree that tagging combined with filters or workbooks would be the best way to segment. I would start by trying automation rules first since this is the easiest to manage and at no additional cost. For example, if there is an identifiable naming standard for resource names. If the automation rule filters are insufficient your next option is a logic app. There you can use KQL or recourse graph queries to identify the client. It may not be easy or possible to attribute every alert to a client.

Start with the device or host entity. The logic app would be an incident trigger, followed by get host, then lookup the client identifier, and the add the tag. Other entity types will be harder and some alerts may not have entities. You might add a task to verify/manually add a tag to fill the gap.
Please sign in to rate this answer.
Someiah C S 80 Reputation points

2024-07-04T05:21:33.2466667+00:00

Hi @Andrew Blumhardt

Thanks for the suggestion. I tried starting with an automation rule, but it didn’t work. I'm now planning to use a logic app.

In my case, all the resource groups (RGs) are tagged with a client tag. I need some ideas on how to retrieve the tag from an RG when an incident is created for that specific RG.

Givary-MSFT 33,311 Reputation points Microsoft Employee

2024-07-04T08:07:15.31+00:00

@Someiah C S I tried creating automation rule using Playbook with incident trigger, however it is not giving the required details like tags details from the incident. Would recommend to create a custom solution by following the below steps

Provision a logic app (either consumption or standard) based on your requirements.

use the reocurrence trigger and schedule it for every 5 mins

using the http connector call the sentinel incident list/get rest api - https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/get?view=rest-securityinsights-2024-03-01&tabs=HTTP

Get incident details/Parse incident details/extract client tag - use Parse json to extract the tag.

Hope this info helps to achieve your ask.

Andrew Blumhardt 9,866 Reputation points Microsoft Employee

2024-07-04T14:15:15.5733333+00:00

It may be harder than it sounds now that I take a closer look. I assumed there might be a resource graph logic app connector. If not this will need to be an HTTP request to the graph API followed by a JSON parser.

You can get started with the graph query by filtering your Azure views and using the query button.

Easier said than done but feasible.

Incident trigger
Get device entity
Grab the ARM ID or name, maybe put into a variable (try to get the RG name from here, should be in the ARM ID).
Query graph for the tag (assuming not in get entity).
Parse the JSON output if using HTTP request. This will create a parameter containing the tag.
Then add a client tag to the incident

https://learn.microsoft.com/en-us/graph/use-the-api

https://www.starwindsoftware.com/blog/using-graph-api-with-azure-logic-apps

Givary-MSFT 33,311 Reputation points Microsoft Employee

2024-07-08T07:44:54.29+00:00

@Someiah C S Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Segregating and Identifying Alerts in Sentinel Workspace

1 answer

Your answer