- Overview
- Functionality
- Downloads
- Data Connector
- Generating a Personal Access Token (PAT) in Identity Security Cloud
- Deploying ARM Template
- Post-Deployment
- Analytics Rules
- Deployment
- Post-Deployment
- Logic Apps Connector
- List of Actions (Connector Actions)
- Deployment
- Post Deployment
- Usage
Overview
Azure Sentinel by Microsoft is a combination Security Orchestration Automated Response (SOAR) and a Security Information Event Management (SIEM) tool. Sentinel not only ingests and stores security data from cloud and on-premises applications, but also provides a way to analyze this security data, process security alerts in a priority manner, and perform advanced threat hunting.
The purpose of this integration is to create a full featured solution that will make SailPoint’s rich, identity-centric contextual information available in the Azure Sentinel product, allowing our joint customers to better collect, detect, investigate, and respond to security threats.
Functionality
The full set of functionalities consists of:
- Data connector for pulling Identity Security Cloud ' audit events' data into Sentinel (Logs).
- Logic Apps Custom Connector to call the IdentityNow API's to retrieve Identity data for alert/incident enrichment.
- Analytic queries to retrieve interesting/security related datapoints from the events once ingested in Sentinel (Analytics).
Downloads
Attached is a zip file with azure deploy ARM template to deploy/import the Data Connector & Analytic Rules.
Data Connector
This section covers the requirements and process flow for creating a Sentinel ‘Data Connector’ for pulling SailPoint event data via REST API.
Because the SailPoint SaaS platform cannot ‘pipe’ event data to an external system, the integration can’t make use of the Sentinel syslog forwarding option. It will need to make use of Azure Functions to connect to the Identity Security Cloud Search API. It should be noted that the use of Azure Functions may increase customer data ingestion costs.
The Azure Function will call a python script to fetch the events from Identity Security Cloud tenant (https://docs.microsoft.com/en-us/azure/azure-functions/functions-reference-python). The script will oversee connectivity with SailPoint APIs, collecting the most recent events since the last execution, and then writing them to custom Log Analytics table.
Generating a Personal Access Token (PAT) in Identity Security Cloud
Before configuring data connector in sentinel, you must generate a Personal Access Token (PAT) in your SailPoint ISC environment.
Note: The method for generating PATs has been updated to use the dedicated Vendor Integration menu.
- Log in to your SailPoint Identity Security Cloud tenant.
- Navigate to your user profile and select Personal Access Tokens.
- Click New Token.
- Important: In the creation menu, locate the Vendor Integration dropdown and select Microsoft Azure Sentinel for SailPoint IdentityNow.
- SCOPE: Kindly select sp:search:read as shown when creating personal access token.
- Copy the generated Client ID and Client Secret. Keep these secure, as you will not be able to view the secret again.
Deploying ARM Template
The data connector can be deployed using an ARM template. Following are the steps to achieve this:
- On the main page of the azure portal, click on Create a resource. On the Create a resource page search for Template deployment (deploy using custom templates) and then select that from the dropdown. Click Create to create a template.
2. Click Create to create a custom deployment template.
3. Once you have clicked on the Create button, the Azure portal will navigate you to a custom template deployment. On this page click on Build your own template in the editor. This will allow you to upload the ARM template.
4. Click on Load file to upload the ARM template(Attached is a zip file with azure deploy ARM template).
5. Once you select the azuredeploy_SailPoint_IdentityNow_FunctionApp.json ARM template you will see the following:
6. Click Save and continue.
7. The template now is ready, and you will see the following page:
- Subscription - All resources in an Azure subscription are billed together. This will be populated by default.
- Resource group - A resource group is a collection of resources that share the same lifecycle, permissions, and policies.
- Region - Choose the Azure region that's right for you and your customers. Not every resource is available in every region.
- Identity Now Function Name - Name of the Data Connector function for SailPoint IdentityNow platform. SearchEvent is assigned by default.
Note: Ensure all the IdentityNow services & resources are in the same Resource group & Region.
Add the following:
- Tenant Id - The tenant-id is the usually the organization name. (Ex: https://example-org.identitynow.com in this case it is the “example-org”).
- Client Id - The PAT Client Id generated in previous step
- Client Secret - The PAT Client Secret generated in previous step.
- Limit - Number of events that will be queried by the function app every time it executes. By default, it is set to 1000.
- Customer Id - Azure Object Id of your workspace (Workspace Id) to log event data. Navigate to the associated Log Analytics workspace > Agents management > Workspace ID.
- Shared Key - Primary Key of the Log Analytics workspace to log event data. Navigate to the associated Log Analytics workspace > Agents management > Primary key.
- App Insight Workspace Resource ID- Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}
Successful deployment of this template will look as follows:
Post-Deployment
After successfully deploying the template, you can navigate to your Resource group and verify if there is a new resource named as searcheventXXXXXXXXXXXXX of Function App type created. The suffix on the resource name is the resource group id. Along with the Function App you will find 2 more resource created of Application Insights & Storage account type that assists the Function App with logs & storage respectively.
Clicking on this resource you will be able to see the following:
Note: The Memory working set & Function Execution Count may not have any data as this is a newly deployed resource. The above screenshot shows what a successful execution over a period looks like.
The Function app deploys a python script which at set frequency (every 5 minutes by default) queries the IdentityNow tenant to fetch the events. More technical details can be found here.
These events are added to the Custom Logs in the Sentinel workspace under SailPointIDN_Events_CL table. Navigate to Sentinel > Select your workspace > Logs > Custom Logs > SailPointIDN_Events_CL to locate this table
Analytics Rules
The main purpose of the data connector is to import the events from IdentityNow. After the events are imported you can use analytic rules to classify/create alerts and incidents. As part of this integration, there are 6 out of the box Analytic Rules.
Following are the rules available:
- SailPointIdentityNowAlertsForTriggers - Create alerts for SailPoint IdentityNow Event Trigger Service.
- SailPointIdentityNowEventType - Created to detect failed events of specific type from SailPointIDN_Events.
- SailPointIdentityNowEventTypeTechnicalName - Created to detect new threat events from the data in SailPointIDN_Events.
- SailPointIdentityNowFailedEvents - Detects all events with status failed.
- SailPointIdentityNowFailedEventsBasedOnTime - Detects failed events based on created time.
- SailPointIdentityNowUserWithFailedEvents - Detects any failed event for a particular user.
Deployment
To deploy this to your Azure environment, follow the same deployment steps (1-4) as that of the Data Connector i.e., import the using ARM template.
- Load/import the following ARM template: azuredeploy_SailPoint_IdentityNow_AnalyticsRules.json
- Upon uploading the ARM template, you would see the following.
Click Save and continue.
3. The template now is ready, and you will see the following page:
Confirm the following:
- Subscription - All resources in an Azure subscription are billed together. This will be populated by default.
- Resource group - A resource group is a collection of resources that share the same lifecycle, permissions, and policies.
- Region - Choose the Azure region that's right for you and your customers. Not every resource is available in every region.
Note: Ensure all the IdentityNow services & resources are in the same Resource group & Region.
Add the following:
- Workspace – This is the Sentinel workspace where the Data Connector is storing the incoming events.
Post-Deployment
Navigate to Analytics section of the workspace to view them. After the rules are imported, you can modify them to execute at defined frequencies for custom intervals.
When these rules are enabled, they will analyze the events that were imported to create Alerts/Incidents (when they matched the queries). These Incidents are essential indicator that something has gone wrong, and an action is required. You can navigate to the Sentinel > select your workspace > Incidents to see all the incidents that were created by these rules.
A detailed view of one of the incidents is as shown below:
Logic Apps Connector
Beneath the hood, Azure Sentinel uses the Microsoft Logic Apps product to perform the incident enrichment and response components. To this end, we build a SailPoint Logic Apps Custom Connector.
The connector will provide two basic functions – retrieving contextual Identity data to adorn SailPoint information to a security incident ticket and providing a mechanism to initiate governance actions within IdentityNow to assist in alert remediation.
Retrieving Identity Context
Identity context retrieves information from the SailPoint platform. This information includes identity attributes, accounts, assigned roles, entitlements, etc.
Initiate Governance Response
Governance responses can be utilized when a security incident requires an immediate remediation (removal of access).
List of Actions (Connector Actions)
- GetAccessToken
- SubmitAnAccessRequest
- GetAListOfAccounts
- CreateAnAccount
- GetAccountDetails
- DeleteAnAccount
- UpdateAnExistingAccount
- GetAccountEntitlements
- ReloadAccount
- EnableAccount
- DisableAccount
- UnlockAccount
- GetAListOfAccountActivities
- GetAnAccountActivity
- IdentityCampaignCertificationsByIds
- IdentityCertificationById
- ListOfAccessReviewItems
- AccessSummaries
- DecideOnACertificationItem
- SummaryOfCertificationDecisions
- SummaryForIdentity
- IdentitySummariesForIdentityCampaignCertification
- ReassignIdentitiesOrItems
- FinalizeIdentityCertificationDecisions
- GetAListOfPublicIdentities
- GetThePublicIdentitiesConfiguration
- UpdateThePublicIdentitiesConfiguration
- ReturnAListOfRequestableObjects
- ReturnAListOfSavedSearches
- CreateASavedSearch
- ReturnASavedSearchById
- DeleteADocumentById
- UpdateSavedSearch
- ExecuteASavedSearchById
- ReturnAListOfScheduledSearches
- CreateANewScheduledSearch
- ReturnAScheduledSearchById
- DeleteAScheduledSearchById
- UpdateAnExistingScheduledSearch
- UnsubscribeARecipientFromScheduledSearch
- GetAListOfDocuments
- CountTheNumberOfDocumentsSatisfyingAQuery
- PerformASearchQueryAggregation
- GetADocumentById
Deployment
In order to deploy Logic App Connector to your Azure environment, click - Deploy to Azure or Deploy to Azure Gov.
Upon clicking the link, a custom deployment template (ARM Wizard) will be created in the Azure portal. This template will look as follows:
Confirm the following:
- Subscription - All resources in an Azure subscription are billed together. This will be populated by default.
- Resource group - A resource group is a collection of resources that share the same lifecycle, permissions, and policies.
- Region - Choose the Azure region that's right for you and your customers. Not every resource is available in every region.
- IdentityNow Connector Name - Connector for SailPoint IdentityNow platform. SailPoint-IdentityNow is assigned by default.
Note: Ensure all the IdentityNow services & resources are in the same Resource group & Region.
Add the following:
- IdentityNow Service Url - The tenant-id is the usually the organization name. Ex: https://example-org.identitynow.com (in this case it is “example-org”).
Post Deployment
After successfully deploying the template, navigate to your Resource group and verify if there is a new resource created of Logic apps custom connector type. The name of this resource will be the connector name configured during deployment.
Click on this resource > edit page and you will be able to see the following:
Ensure the Host prefix is the tenant-Id that you have provided during deployment.
On the Security page:
- Authorization URL - OAuth Authorization URL for IdentityNow Tenant. Ex: https://{exampleorg}.identitynow.com/oauth/authorize
- Token URL – OAuth Token URL for IdentityNow Tenant. This URL is different from the Authorization URL (has the api in prefix before identitynow.com) Ex: https://{example-org}.api.identitynow.com/oauth/token
Add the following:
- Client Id - Client Id for OAuth from Identity Security Cloud Tenant.
- Client Secret - Client Secret for OAuth from Identity Security Cloud Tenant.
- Refresh URL - Refresh URL for Identity Security Cloud Tenant. Same as Token URL. Example – https://{exampleorg}.api.identitynow.com/oauth/token
Note: You might need to click on the Edit button on the left-hand bottom of the page to make these changes.
Click on Update connector button on the top-right to save these settings. The definition page will give you all the actions supported by this connector along with details required for each action.
Usage
Actions that are added as part of the Logic apps connector to you Azure portal can now be utilized in Logic Apps. These can be configured as individual steps added to the Logic Apps to either retrieve identity context (identities, accounts, roles, entitlements, etc.) or initiate governance response (approve/deny access request).
To incorporate these actions into your Logic Apps, add an action and in the Choose an operation window select Custom tab (far right). SailPoint-IdentityNow (the name of the connector) will be visible along with all the actions supported by this connector.
Select the action that you want to perform, and it will prompt for a connection creation (first time only) to your Identity tenant (this will look like a Sign in request shown below):
Click on the Sign in button to create an API connection. All the necessary connectivity details including credentials (like the Client Id & Client Secret) are already configured (on the edit page of the connector). This will automatically create the connection and the action is ready to use.
Newly created API connection can be viewed in the same resource group as that of the custom connector.
Kindly contact [email protected] for any implementation related or technical questions.
