Ingest keyvault ,application logs

Question

We are planning to ingest azure Keyvault and application logs to Sumo logic .Can you Please specify what type of logs we will get from Kayvault and application logs ? what types of use cases we can implement to detect suspicious activities. Please help

Answer 1

@Ponugoti Narendra Thanks for reaching out.
Once you have setup the path from Azure to Sumo logic, the key vault can provide Alerts, Input data errors , usage and diagnostic logs.

• You can utilize it for various login scenarios.
• Failed attempts
• You can look for delete, purge or backup operations.

We can tell with reference to Azure sentinel, what all visibility you can get from Key vault using same set of logs :
https://techcommunity.microsoft.com/t5/azure-sentinel/visibility-of-azure-key-vault-activity-in-sentinel-azure-key/ba-p/2140751

This gets enhanced when using Azure security center + Azure sentinel.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

Answer 2

What all Pre alerts configured in Azure security center for key vault .Do you have any specific set of use cases for Azure sentinel

We don't have any web application firewall to monitor application logs. any use cases specific to applications??

Answer 3

@Ponugoti Narendra Following are the inbuilt Alerts configured for Key vault under Azure Defender (part of Azure security Center). This table shows the alert type along with the MITRE tactics status.

While security center makes you aware about that. Azure sentinel can help you visualize the problem and understand root cause and different entities involed, it also helps you automate the incident and response should there be any need.

Azure Sentinel uses AI and Microsoft's threat intelligence stream to detect threats across your environment, correlate alerts into incidents, use deep investigation tools to find the scope and root cause and access powerful hunting search and query tools.

It can build you complete network map for related involved entities and help in investigation :