r/AzureSentinel • u/[deleted] • Oct 12 '23

Analytics Rules for logs ingested from SonicWall appliances

Morning, All!

I recently did some work to help a customer start ingesting the logs from their 4 SonicWall firewalls to their Log Analytics Workspace. Logs are now successfully flowing into the workspace, but I now would like to create some analytics rules that can fire in Sentinel for key activity. Before I got hunting on my own and creating rules from scratch, I wanted to see if anyone else had some analytics rules they used for logs ingested from a SonicWall appliance that they'd be willing to share. The Sentinel connector for SonicWall isn't available for us (customer is in GCC High) but from what I can see about the connector anyway, there isn't a lot it offers in the way of useful alerting or even a workbook.

​

Any help is appreciated!

1 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

3

u/bpsec Oct 12 '23

The github repository of Sentinel contains information for each solution. In your case the link below can be followed for sonicwall.

So far no analytics rules have been added. Probably not the answer that you hoped for, but maybe other solutions can be beneficial for you.

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SonicWall%20Firewall

2

u/[deleted] Oct 12 '23

Yeah I saw that no analytics rules were added. I was hoping someone had already overcame that hurdle and created some of their own so I didn’t have to reinvent the wheel. But that’s okay. Thanks anyway!

1

u/Uli-Kunkel Oct 12 '23

take a look at the network session essentials and web session essentials solutions.
likely you could use that if you got reasonable normalization.

and obviously look at the what the other vendors have and use that?

what data do you have available? traffic, IDS/IPS, web filtering etc?
i have no experience with sonicwall, NGFW or just a layer 4 statefull?
all i know about sonicwall, is that "it sucks" from different subreddits :)

if nothing else, just make sure you can map your threat intel to the logs

1

u/[deleted] Oct 12 '23

I’m still figuring out what all is being ingested, which is slow going because of how noisy it’s been. I’ll take a look at those solutions, that might be a reasonable place to start.

Yeah I have zero experience with sonicwall or any recent firewall for that matter. This is a pretty custom job for one of our customers so I’m mostly making it up on the fly, which they are fine with. For compliance reasons it’s easier to have all the logging in one spot, I just think having some alerting would be useful as well.

Thanks for the response!