Skip to main content

Microsoft Sentinel Credentials - Data Plane for Automation or Attack Detective

Use in Attack Detective or in Automation (ex Continuous Content Management) and for direct deployment from a Sigma rule page

S
Written by Sergey Bayrachny

To get the credentials required for setting up a Microsoft Sentinel Data Plane to be used in Attack Detective or in Automation (ex Continuous Content Management) and for direct deployment from a Sigma rule page, follow these steps:

  1. Register your app in Azure Active Directory:

    1. Go to App registrations

    2. Click New registration

    3. Register your app with a name of your choice

  2. Copy your app credentials in Azure Active Directory:

    1. Go to App registrations > Owned applications and select your app from the list.

    2. In the Essentials section of the Overview page, copy Application (client) ID and Directory (tenant) ID

    3. Paste the value of Application (client) ID into the Client ID field and the value of the Directory (tenant) ID into the Tenant ID field in your Data Plane profile on the SOC Prime Platform.

  3. Create and copy your client secret in Azure Active Directory:

    1. Go to Certificates & secrets > Client secrets and add a client secret by clicking New client secret.

    2. Enter the secret description and expiration date, and then click Add.

    3. Copy the client secret Value. Attention: ensure you've copied and saved the Value at this step since it will be impossible to access it once again.

    4. Paste the client secret Value into the Client Secret field in your Data Plane profile on the SOC Prime Platform.

  4. Assign the required permission to your app (the steps below describe the process via Sentinel, but you can also do it directly in your Log Analytics workspace):

    1. In Azure Active Directory, go to API permissions and ensure there are no existing permissions.

    2. Go to Microsoft Sentinel and select your workspace

    3. Select Settings > Workspace settings

    4. Select Access control (IAM) > Role assignments

    5. Select Add > Add role assignment

    6. Select the role to be assigned to your app:

      • Microsoft Sentinel Contributor – if you're going to deploy content from the SOC Prime Platform

      • Microsoft Sentinel Reader – if you're not going to deploy content from the SOC Prime Platform and will use the integration only for Attack Detective

      and click Next

    7. Click Select members, select your app to assign the permission, and click Next

  5. Copy and paste the URL of your Microsoft Sentinel web console:

    1. Open your workspace

    2. Select Settings > Workspace settings

    3. Select Logs and copy the URL of the current page

    4. Paste the URL to the Microsoft Sentinel URL field in your Data Plane profile on the SOC Prime Platform

Did this answer your question?