Integrate Microsoft Sentinel with Red Canary

Start the integration process by locating your Microsoft Azure IDs.

1. Login using a Global Admin account for the tenant that you want to integrate with Red Canary.

2. In the search bar, type and then select Tenant properties.

3. Copy and save your Tenant ID. You’ll use this in a later step.

   

4. In the search bar, type and then select Subscriptions.

5. Copy and save your Subscription ID. You’ll use this in a later step.

   

6. Click on your subscription name.

7. Select your log analytics workspace ID, copy and save your workspace ID. You’ll use this in a later step.

8. In the search bar, type and then select Resource Groups.

9. Copy and save the Resource Group Name you are setting up a subscription for. You’ll use this in a later step.

10. In the search bar, type and then select Workspaces.

11. Copy and save the Workspace Name you're setting up a subscription for. You’ll use this in a later step.

Enter your Microsoft Azure information into Red Canary to start sending your alerts.

1. From your Red Canary homepage, click Integrations.

   

2. Select Microsoft Azure.

   

3. Click Configure.

4. Enter a Name for your external alert source.  

5. Select a Display Category.

6. Under the Ingest Format/Method dropdown, select Microsoft Azure Sentinel via API Poll.

7. Enter your Microsoft Azure Tenant ID from Step 1.3.

8. Enter your Microsoft Azure Subscription ID from Step 1.5.

9. Enter your Microsoft Sentinel Resource Group Name from Step 1.9.

10. Enter your Microsoft Sentinel Workspace Name from Step 1.11.

11. Enter your Microsoft Log Analytics Workspace ID from Step 1.7.

12. Click Save Configuration.

13. Click Edit Configuration.

14. Under the Permissions section, click the Azure consent link.

    

Confirm that the Red Canary enterprise application has been configured in your Azure Active Directory.

1. Login to the Microsoft Azure account you want to integrate with Red Canary.

2. Click Accept.

   

3. Login into your Microsoft Azure account again.

Grant Red Canary permission to read your Microsoft Azure Alerts to start sending security data for ingestion.

1. In the search bar, type and then select Subscriptions.

2. Click on your Azure Sentinel subscription name.

3. Click Access Control (IAM).

4. Click +Add, and then click Add role assignment.

5. In the search bar, type and then select Security Reader.

6. Click Next.

7. From the Assign access to section, select User, group, or service principal.

8. Click Select Members.

9. In the search bar, type and then select Red Canary + Azure Sentinel API Poller.

   

10. Click Select.

11. To review your role assignment, click Next.

12. Click Review + assign.

Grant Red Canary permission to read and analyze your Microsoft Azure telemetry to start sending security data for ingestion. 

1. In the search bar, type and then select Subscriptions.

2. Click on your Azure Sentinel subscription name.

3. Click Access Control (IAM).

4. Click +Add, and then click Add role assignment.

5. In the search bar, type and then select Log Analytics Contributor.

6. Click Next.

7. From the Assign access to section, select User, group, or service principal.

8. Click Select Members.

9. In the search bar, type and then select Red Canary + Azure Sentinel API Poller.

   

10. Click Select.

11. To review your role assignment, click Next.

12. Click Review + assign.

Grant Red Canary permission to edit data, incidents, and manage incidents in Microsoft Azure. 

1. In the search bar, type and then select Subscriptions.

2. Click on your Azure Sentinel subscription name.

3. Click Access Control (IAM).

4. Click +Add, and then click Add role assignment.

5. In the search bar, type and then select Sentinel Responder.

6. Click Next.

7. From the Assign access to section, select User, group, or service principal.

8. Click Select Members.

9. In the search bar, type and then select Red Canary + Azure Sentinel API Poller.

   

10. Click Select.

11. To review your role assignment, click Next.

12. Click Review + assign.

Enable your new Microsoft Azure Sentinel alert source in Red Canary.

1. From your Red Canary homepage, click Integrations.

   

2. Scroll down, and then select your third-party security source.

3. Click Edit Configuration.

4. With all of the required permission settings completed, select Confirm Microsoft Sentinel API Access Granted.

   

5. Click Save Configuration.

6. Click Edit Configuration.

7. Click Activate. 

Deploy the Red Canary provided ARM template in Azure to enable Red Canary to have the right permissions in your Azure tenant.

1. Login using a Global Admin account for the tenant that you want to integrate with Red Canary.

2. In the search bar, type and then select Service providers.

3. Click Service Provider Offers.

   

4. Click +Add offer, and then click Add via template.

5. Upload the Red Canary provided ARM Template, and then click Upload.

   

6. From the Subscription dropdown, select the subscription that your Sentinel instance resides in.

7. From the region dropdown, select the region your Sentinel instance is deployed in.

   

8. Click Next: Review + create >.

9. Click Create.