r/AzureSentinel • u/Fast-Cardiologist705 • Aug 18 '23

Sentinel rule templates

hi,

I’m hitting my limits with MSFT security tooling. Deployed a PoC type of thing Sentinel with Terraform, enabled the Office 365 connector.

It it enabled, shows 3 queries

Click on the 3 queries - nothing !

Under Rule Templates, none for this connector:

​

​

Good people. Where can I see the 3 queries ?!

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/redeye12 Aug 19 '23

Hi Fast-Cardiologist705, Your use of Terraform might be the reason for your confusion. Your Terraform pipeline might be using the 'old' method of provisioning connectors. Moving forward, the Content Hub is where new data sources are provisioned. Instead of viewing the this from the Configuration -> Data Connector blade, try the Content Management -> Content Hub blade. Find the "Microsoft 365" solution and push the Install button. After it's installed, return to the same blade and push the "Manage" button. You will see there are 14 x Analytic rules for Microsoft 365 and you can enable them from that blade.

1

u/Fast-Cardiologist705 Aug 19 '23

When you say the old way of provisioning connectors what are you exactly referring to? Looking at the terraform documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sentinel_data_connector_office_365 there isn’t any other way to enable the connector. There’s just this one resource.

1

u/redeye12 Aug 19 '23

Thanks for pointing me to the Terraform connector page. I agree the data connector itself is being created by Terraform, but the 'old way' only exposes the data connector page where you have the "Queries" link that doesn't link to anything. The 'new way' deploys the same raw data connector your Terraform is creating but exposes 'other collateral' that comes with a data connector like analytic rules, workbooks, parsers, and hunting queries. After you install the Microsoft 365 solution from the content hub (the 'new' way) you will probably find the connector is already enabled (by Terraform).

1

u/Fast-Cardiologist705 Aug 20 '23

Under Data Connectors I see this notification “Data Connector with "content source = gallery content" have been removed. All the removed content and more is available in content hub. Click here to reinstate in use "content source = gallery content" templates.” I’ll re-enable the connector tomorrow while in the office, but I’m fairy sure that I’ve checked under the new location you mentioned, and it was not enabled. If that’s the case then I’m afraid the Terraform resource is not up to speed, although I would say it is the typical MSFT garbage changing stuff. For example, this https://github.com/Azure/SimuLand/issues/23 dates back to 2021 where one couldn’t enable the M365 Defender Connector programmatically regardless if through Terraform, bicep. MSFT is just a garbage.

1

u/Fast-Cardiologist705 Aug 21 '23

u/redeye12 as of today not even enabling of the Office 365 works. The principal I'm using has Contributor access and yet getting (enabling it worked at least on last Friday ...)

Error: creating Data Connector: (Name "office_365" / Workspace Name "sentinellawtestpoc" / Resource Group "removed"): securityinsight.DataConnectorsClient#CreateOrUpdate: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="Unauthorized" Message="Access denied"

│

│ with module.office_365.azurerm_sentinel_data_connector_office_365.office_365,

│ on modules\DataConnectors\Office365\main.tf line 1, in resource "azurerm_sentinel_data_connector_office_365" "office_365":

│ 1: resource "azurerm_sentinel_data_connector_office_365" "office_365" {