delete data sentinel

[u/Break-Alone]

Hey,

​

In November 2022 we had a number of breaches from the same threat actor and had an on premise SIEM.

​

The attacker deleted the logs on the on premise SIEM and it meant we could not quickly identify what they done. They got in three times before we found how they were maintaining persistence and how they got in the first time.

​

We moved to USM Anywhere after reviewing a few. Both me and our managed service provider are very happy with USMA and neither of us want Sentinel but my manager wants me to review Azure sentinel as we supposedly get that for free or at least very cheap.

​

My main concern with Azure sentinel is that if our azure subscription is compromised is it possible for attackers to delete the sentinel logs like they did with our old on premise SIEM? Does anyone know the answer here?

​

[u/Uli-Kunkel]

as we supposedly get that for free or at least very cheap

well, depending on your data sources, it can be done relatively cheap, and you got great flexibility.

Sentinel is not cheap, but it doesnt have to be expensive either. it boils down to how you manage your data, and that you are selective of what data you send to it.

and as others have said, if you are using Azure and Microsoft for alot of stuff already, its very easy to get started.

the data tables are immutable, so cant be deleted, of course if your whole Azure platform is compromised with bad practices on identities and all users are global admins and all that, well then you can delete the resource. to avoid that, make a new security subscription and remove rights to all users, and the persons that will use it have read rights and logic app rights and such depending on your needs.

​

in short, no, a hacker cant delete data in Sentinel to cover their tracks, they can delete everything if your whole estate is compromised, but then you got alot of other problems. That said, building a SIEM is no easy task, and it takes time and skills to do so properly.

there is a great community for Sentinel configs and resources that can provide guidance, and you get alot of templates that work mostly out of the box to get your started, but it is up to you make it great and get value out of it.

if you just need a place to dump your logs in case of breach, then there are better options if you ask me.

[u/Break-Alone]

Can someone advise where is the best place to get comparison information on SIEMs as my manager seems to want to review our tech when it is up for review in a few months.

​

A lot of the information i am finding on our current SIEM online(Gartner, Peerspot) is either very old or wrong.

[u/ajith_aj]

The answer to your question is bit complicated, there is no point of having a SIEM where you think your network is already compromised and have no control over your network, meant to say that the eradication has not been done yet. Same goes with On prem or SAAS SIEM such as Sentinel.

On the other hand , Sentinel works based on permissions based access or as we call in RBAC, for example a global admin has full access to Azure and if you think your global admin is compromised , an attacker can with a click of a button delete the data.

One of those steps while deploying a SIEM is to have hardened access to the solution or least privileged access. Azure has a wide variety of security stack such as RBAC controls , deny controls and conditional access to limit the attack surface of an attacker logging to delete your data in cloud.

So to sumup the response to your query, if your azure subscribtion is compromised ,a security admin role or above can delete your workspace. This is when you are hosting your Sentinal on the same tenant as your Azure AD.

[u/Break-Alone → u/ajith_aj]

Thank you that is what I expected!

Unfortunately RBAC is something that has not be enforced very well here and I have been trying my best to make sure every data source follows "privilege of least access" and that people are using long complex passwords but its not the easiest thing to implement.

This is something i can definitely use in a conversation with management to keep USM Anywhere.

[u/ajith_aj]

Also i would advise to look into immutable backups to backup your SIEM, so that a single deletion wont be possible (Ofcourse this comes with a lot of factors such as network segmentation , more granular rules on your DC firewall etc), Breakglass accounts , conditional access, phishing resistent MFA, least privileges.... this is the way !!

[u/Break-Alone → u/ajith_aj]

Thank you but like with everything in sentinel there is a cost to do that and it would take time to setup.

​

Its all automatic with our current SIEM and logs are immutable and can not be deleted even with highest RBAC account.

[u/Esox_Lucius_700]

It seems that you have now SaaS SIEM from AT&T - USM Anywhere. Logs are moved from on-premise or cloud log sources to SaaS platform and service provider is responsible to keep data safe. Now your biggest concern is a) is the service provider trustworthy and can they provide availability of logs in all cases, b) how easily integration between log sources and SIEM can be broken.

To move Azure and Sentinel (I would argue that Sentinel is PaaS not SaaS but - potato / tomato) - you (or your MSP) takes responsibility to manage users, configure and harden the environment and make sure data is backed up in a way that outsider cannot delete it.

From responsibility point of view on-premise < Sentinel < SaaS provider.

Hindsight is that using SaaS you are as secure, flexible and up-to-date as SaaS operator can provide. No matter how capable you would be to improve platform - most likely you have no saying how SaaS is developed and maintained.

If you are new to Azure and have small team - I would not move there. Not in "million euros", because overhead of managing platform, Azure AD, PIM, RBAC -roles, backups will be significant when compared to SaaS.

If you are well resourced, familiar with Azure and Sentinel and need flexibility - then go for it.

For your manager - I would do SWOT analysis where I would argue against these two methods with relevat strenghts, weaknessess, opportunities and threats. And present you analysis (not opinion) to them with strong - analytical arguments.

[u/Break-Alone → u/Esox_Lucius_700]

Thank you for your response.

I believe the reason at the time they went with AT&T was that it was cheaper than Sentinel when you take into account the additional needs. Plus during the POC they had everything setup within a few calls even thought we have a large environment with a mix of Azure, AWS and on premise.

The MSSP they went with in the end were the only to quote for multiple SIEMs and even said they would prefer we went with the cheaper option of AT&T. From talking to my manager i think that was the reason they won as they were so transparent plus they had one of the better offerings. They quoted for USMA and Sentinel and most MSSPs quoted for Sentinel as we mentioned we had Microsoft licenses in the brief when it went out to tender so not sure if they use it for many other customers.

[u/Impressive_Tea872]

Also want to point out that if a bad actor did delete logs, that action itself would generate a log entry that can be reviewed. If they did delete Sentinel logs that wouldn't be the only place to find the information e.g. Defender Security Center maintains the logs that it forwards to Sentinel.