Skip to main content

Microsoft Sentinel integration

Mark Glinski
  • Updated

In this article:

    If you use Microsoft Sentinel, you can use this integration to create logs in in Sentinel with data from Scorecard scores, factor scores, and issues for your organization and Portfolios. The integration also inserts three carefully curated dashboards into a Sentinel Workbook.

    Set up the integration

    Before you start setup, make sure you have the following:

    • A Microsoft Azure instance with:
      • A subscription
      • A Resource Group
      • A Log Analytics workspace
      • A Sentinel instance
    • A SecurityScorecard API token to enable Sentinel to communicate with SecurityScorecard. Learn how to create a token.

    To set up the integration, take the following steps:

    Step 1: Install the Azure application

    1. After logging into your Microsoft Azure instance, enter SecurityScorecard in the top search bar.
    2. Filter by the Marketplace tag and select SecurityScorecard Ratings for Microsoft Sentinel.

      ms-sentinel-install-1.png

     

    1. In the application overview, click Create.

      ms-sentinel-install-2.png
    1. Select the subscription, resource group, and workspace for installing the integration, and  complete the creation process.
      Note: The workspace name is the same as the Sentinel instance name.

    A completion message appears.

    ms-sentinel-install-4.png

    Step 2: Add data connectors

    1. In your chosen Sentinel instance, select Data connectors. from the left menu.
    2. Select SecurityScorecard Cybersecurity Ratings, and click Open connector page.

      ms-sentinel-data-collex-1.png

    1. Copy the workspace ID and the primary key. Then click Deploy to Azure.

      ms-sentinel-data-collex-2.png

    1. Provide the information needed for the deployment:
      • Paste in the  workspace ID and the primary key (workspace key) that you copied from the connector page.
      • Paste in the the SecurityScorecard key (API token) that you created. 
      • Enter https://api.securityscorecard.io as the base URL.
      • Enter the domain for your organization’s Scorecard.
      • Enter a comma-separated list of SecurityScorecard Portfolio IDs.
      • Set a daily ratings schedule.
        For example the expression 0 0 2 * * * includes seconds.
      • Leave default settings for other fields.

        ms-sentinel-data-collex-3.png
    1. Complete the creation of the data connector.

      ms-sentinel-data-collex-4.png

    Set up the other two data connectors the same way. All three connectors are necessary for operating the integration workbook.

    Step 3: Add the workbook

    1. Open the Sentinel instance and select Workbooks from the left menu.

      ms-sentinel-add-workspace-1.png
    1. Locate the SecurityScorecard workbook and scroll down in the panel on the right to select View saved workbook.

      ms-sentinel-add-workspace-2.png
    1. Update the placeholder domain with your own and save it. Then click Refresh.

      ms-sentinel-add-workspace-3.png

    The information for your Scorecard domain appears.

    ms-sentinel-add-workspace-4.png

    1. Click Vendor Scores, and click Refresh to see the information for your domain in that tab.
    2. Click Save on the top menu.

    The workbook updates and retains your domain..

    Start using the integration

    Query the logs

    This integration creates one table with each data connector, classified as Custom Logs. To view and query these logs:

    1. Inside the Sentinel instance, select Logs from the left menu.
    2. Close any pop-up dialogs.
    3. Use Azure’s Kusto Query Language to query the individual tables, as with the following example screenshots.
      Note: These tables are named according to the parameters you provided during the Data Connector setup.
      ms-sentinel-logs-1.png

      ms-sentinel-logs-2.png

      ms-sentinel-logs-3.png

    Use the workbook

    Note: You must set up all three data connectors to use the workbook that is provided with this integration.

    This workbook incudes six dashboards:

    • My Scorecard - An overview of your organization's Scorecard
    • Vendor Scores - An overview of scores for vendors and partners whom you follow
    • Active Issues - An overview of currently unresolved issues across your Portfolio
    • Issues per Vendor (CVE) - A filtered version of the Active Issues dashboard focused on common vulnerability enumerations (CVEs)
    • Issue per Vendor (Ransomware) -
    • A filtered version of the Active Issues dashboard focused on Ransomware events
    • Spotlight - A set of important and notable insights

    See the following examples:

    ms-sentinel-dash-1.png

    ms-sentinel-dash-2.png

    ms-sentinel-dash-3.png

    ms-sentinel-dash-4.png

    ms-sentinel-dash-5.png

    ms-sentinel-dash-6.png

    ms-sentinel-dash-7.png

    Learn more

    See the listing for the Sentinel integration in Azure Marketplace.

    Get Help

    If you need help or have questions about the integration, submit a Support request.

    Related articles