Dashboard on Key Risk Indicators

Prasenna Kannan 436

Hello,

We have hosted our data center in Azure which has multiple subscriptions, VNET's, VM's, WVD, PaaS databases etc.

We have deployed Azure Sentinnel, Security Center.

I'm trying to accomplish the following insights in a single dashboard.

1) Sign on failures and malicious attempts from Azure AD.
2) VM Key Metrics (When the CPU is high, disk is running out of space).
3) Monitoring RBAC and auditing.
4) Tracking of malicious request hitting our server.

The above is just a sample, there are lot other key risk indicates we are trying to track and report it in the dashboard. What is the best possible way to report them in a single dashboard?

Shashi Shailaj 7,606 Reputation points Microsoft Employee

2020-11-04T16:14:05.87+00:00

@Prasenna Kannan , There are two ways of creating such KPI dashboards . One using Azure Dashboard or second using Azure Sentinel Workbook If you are looking for creating a azure dashboard and sharing it within the team then , you may see some limitations however using Azure Sentinel workbook , you can create the whole thing what you have mentioned from a SOC KPI dashboard perspective . Azure Sentinel stores data in azure monitor workspace which can be visualized as per need by some eforts in writing the queries. There are some details related to permissions as to who can see the report designed using that workbook which I am still tryin to find out and will provide more information on the same after some test.
Prasenna Kannan 436 Reputation points

2020-11-10T01:30:25.807+00:00

@ShashiShailaj-MSFT : Any luck with this one?
James Hamil 25,236 Reputation points Microsoft Employee

2020-11-26T00:50:03.617+00:00

Hi, do you still require assistance?

Thank you,
James
Prasenna Kannan 436 Reputation points

2020-11-26T05:36:57.497+00:00

@James Hamil :

What we have done to accomplish the dashboard and sentinel:

1) Created a centralized log analytic workspace.
2) Consolidated and re-mapped the existing scattered mechanism of logging (storage account, multiple log analytics workspace) to the workspace created in (1).
3) Created a shared dashboard and pinned the interactive log analytics query results to the dashboard.
4) Created sentinel and associated with the log analytics workspace.
5) Defined scheduled and Microsoft analytic rules for triggering incidents.
6) Leveraged hunting queries for custom security solutions.

So, we have accomplished what we wanted to.

Thanks! :)

Share via

Dashboard on Key Risk Indicators

Your answer