Microsoft Sentinel Log integrity and non-repudiation

Darren Hughes 0

I have a question about Microsoft Sentinels Log integrity and non-repudiation properties of audit logs. For Example SPLUNK uses Bucket hashing to protect it's logs. Does Sentinel via Azure have any such protection, or can anyone shed light on how the log files immutability is guaranteed?

Givary-MSFT 32,291 Reputation points Microsoft Employee

2024-09-10T05:36:11.73+00:00

@Darren Hughes Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

1 answer

Clive Watson 6,346 Reputation points MVP

2024-09-03T13:18:34.5966667+00:00

source:

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-security#3-the-azure-monitor-service-receives-and-processes-data

Data in database storage can't be altered once ingested but can be deleted via purge API path. Although data can't be altered, some certifications require that data is kept immutable and can't be changed or deleted in storage. Data immutability can be achieved using data export to a storage account that is configured as immutable storage.
Please sign in to rate this answer.
Darren Hughes 0 Reputation points

2024-09-03T13:44:00.7833333+00:00

So is the tamper proofing reliant on the fact that "Azure Monitor is an append-only data platform" ?

Clive Watson 6,346 Reputation points MVP

2024-09-03T15:47:13.3666667+00:00

Correct and Microsoft Sentinel uses that data store. As per the statement if immutable to you is tamper proof but you are ok with DELETE then that's the solution.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Microsoft Sentinel Log integrity and non-repudiation

1 answer

Your answer