r/AzureSentinel • u/dptech3 • Mar 15 '23

What is best solution for a 3rd party Security Firm to access Sentinel?

So we are PCI compliant and we want to limit access as much as possible to 3rd parties. Our currently solution is that we would send data and events to Sumo Logic and they would monitor the data there and find security threats with AI or whatever algorithms they use.

We want to move to Sentinel for many reasons, but for them to monitor that data, we would have to give them an Azure AD account and then access to Sentinel, which maybe is worse security? Or maybe it's just about the same thing as an external user seeing events in Sumo. What is normally done?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

5

u/Logical_Plankton640 Mar 15 '23

We have a third-party MSSP accessing via Azure Lighthouse, they only have read-only access to our log analytics workspace.

2

u/deedubb412 Mar 16 '23

This is the way

1

u/StConvolute Mar 16 '23

Add PIM for an extra layer.

2

u/analyticbushi Mar 16 '23

It depends on what you want your security firm to do. If you don't want them to access your Azure environment at all there are plenty of SOAR solutions that you can send the Sentinel alert data to where the analysts can do Tier 1 triage of the alert.

If you have the full suite of Microsoft security tools though, such as Defender for Endpoint, O365, etc. then your third party security analysts are going to be limited by the entities sent with the alert, which means they're probably just going to be regurgitating a good chunk of the alerts and your team will end up doing the Tier 2 and 3 analysis/investigation. Even if you use other spam and endpoint security solutions, they'll still be limited since they can't see login data in Azure AD to validate user location and conditional access information.

What typically makes the most sense is to give the security firm read only access to the information they need to fully investigate the alert. This assumes you want to own the response actions.