Roles para configurar conector Threat Intelligence

HUGO ANDRES CORTES BONILLA 0

Buenos Dias

Agradezco de su apoyo con la información de que permisos se deben tener para poder editar el conector Threat Intelligence, se tiene el rol que indica la documentación pero no se habilita la opción para editar el conector

1 answer

Akshay-MSFT 17,656 Reputation points Microsoft Employee

2023-10-30T10:29:57.6766667+00:00
@HUGO ANDRES CORTES BONILLA

Thank you for posting your query on Microsoft Q&A, from above description I could understand that your admin is not able to edit the Threat Intelligence connector though recommended roles have been assigned.

Please do correct me if this is not the case by responding in the comments section:

As per Connect your threat intelligence platform Prerequisites

In order to install, update and delete standalone content or solutions in content hub, you need the Microsoft Sentinel Contributor role at the resource group level.

You must have either the Global administrator or Security administrator Microsoft Entra roles in order to grant permissions to your TIP product or to any other custom application that uses direct integration with the Microsoft Graph Security tiIndicators API.

You must have read and write permissions to the Microsoft Sentinel workspace to store your threat indicators.

Still if the issue persist then:

Kindly share the screenshot of error which admin is getting while trying edit the connector.

Browser trace while trying reproduce the issue.

Also share the screenshot of roles assigned to the admin.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.
Please sign in to rate this answer.
HUGO ANDRES CORTES BONILLA 0 Reputation points

2023-10-30T15:03:30.4733333+00:00

Buenos Dias Akshay

Estos son los roles que se tienen asignados en el IAM de Áreas de trabajo de Log Analytics

Esta es la vista que tengo en cualquier conector sin tener la opción de poder configurar o editar

Revisando documentación este es un ejemplo de como debe aparecer las funciones para editar

Agradezco me pueda ayudar para determinar que mas roles debo tener para llegar a el objetivo final

HUGO ANDRES CORTES BONILLA 0 Reputation points

2023-10-30T19:25:02.81+00:00

Gracias por la respuesta Akshay

Estos son los roles que tiene el usuario actualmente

Esto sale cuando quiero editar cualquier conector

Espero poder encontrar la solución a mi falla que no me permite tener la opción de editar cualquier conector

Akshay-MSFT 17,656 Reputation points Microsoft Employee

2023-11-03T08:04:11.24+00:00

@HUGO ANDRES CORTES BONILLA

I have been able to reproduce this in my lab. On checking Further I was able to see that each connector have its own configuration pane.

For example when you enable:

Microsoft Defender Threat Intelligence data connector, you get the following configuration options:

Similarly when I tried to install Github Enterprise audit log, I got following configuration options:

Hence, in order to configure Threat Intelligence Upload Indicators API (Preview) we have got different options, there is nothing wrong with your permissions:

To set this up you would be needed to follow given steps:

You can connect your threat intelligence data sources to Microsoft Sentinel by either:

Using an integrated Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, and others.

Calling the Microsoft Sentinel data plane API directly from another application.

Follow These Steps to Connect to your Threat Intelligence:

Get AAD Access Token

To send request to the APIs, you need to acquire Azure Active Directory access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token

Notice: Please request AAD access token with scope value: https://management.azure.com/.default

Send indicators to Sentinel

You can send indicators by calling our Upload Indicators API. For more information about the API, click here.

HTTP method: POST

Endpoint: https://sentinelus.azure-api.net/workspaces/[WorkspaceID]/threatintelligenceindicators:upload?api-version=2022-07-01

WorkspaceID: the workspace that the indicators are uploaded to.

Header Value 1: "Authorization" = "Bearer [AAD Access Token from step 1]"

Header Value 2: "Content-Type" = "application/json"

Body: The body is a JSON object containing an array of indicators in STIX format.

Thanks for your patience!

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Akshay-MSFT 17,656 Reputation points Microsoft Employee

2023-11-09T17:24:41.75+00:00

@HUGO ANDRES CORTES BONILLA

I am following up on above clarification. Hope this does answer your query. Request you to please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Thanks,

Akshay Kaushik

HUGO ANDRES CORTES BONILLA 0 Reputation points

2023-11-09T19:16:09.4033333+00:00

I have a concern, I have seen that the connector already has a configuration from a different source and this gives me two questions.

To be able to edit the configuration and leave a new one, there is the option to do so or delete the connector and configure again

How can you see what configuration this existing connector has?

Akshay-MSFT 17,656 Reputation points Microsoft Employee

2023-11-20T11:09:11.32+00:00

@HUGO ANDRES CORTES BONILLA

To connect and configure Threat Intelligence Upload Indicators API (Preview) connector for Microsoft Sentinel.

You can connect your threat intelligence data sources to Microsoft Sentinel by either:

Using an integrated Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, and others.

Calling the Microsoft Sentinel data plane API directly from another application.

Follow These Steps to Connect to your Threat Intelligence:

Get Microsoft Entra access token

To send request to the APIs, you need to acquire Microsoft Entra access token. You can follow instruction in this page: Get Microsoft Entra tokens for users by using MSAL.

You need to check configuration with the TIP platforms only.

Thanks,

Akshay Kaushik
Sign in to comment

Share via

Roles para configurar conector Threat Intelligence

1 answer