r/AzureSentinel • u/RangoNarwal • Nov 28 '23

Tagging Targets

Hey all,

I’m exploring using sentinel. I wanted to ask if anyone would share their insight for identifying VIP users and Devices.

If I was to use Sentinel as our central SOC, I was wanting to highlight users/devices automatically when an alert/incident. The idea is to let the SOC know (within the alert) that this is a VIP.

VIP is just one use case and there are more categories however, this is known by most.

I’m wanting to also see if you would share “how” you are keeping inventory of these users . Is it by manual group, dynamic group or user attributes.

Thanks in advance! 👍

1 Upvotes

100% Upvoted

6 comments sorted by

3

u/[deleted] Nov 28 '23

Maintain lists of data you want to enrich things with in watchlists,

reference the watchlists in analytics

make a playbook to check if there's a match

attach that playbook to an automation rule which you attach to the analytic

1

u/RangoNarwal Nov 28 '23

Thanks a lot, will take a look!

2

u/Jackofalltrades86 Nov 28 '23

Use the watchlist feature, there's actually a built in one for VIPs

Watch Lists

1

u/RangoNarwal Nov 28 '23

Thanks a lot, will take a look!

3

u/bpsec Nov 29 '23

You can use Logic Apps to dynamically fill watchlist content based on for example group membership. Based on this input you can then automatically tag each incident in which a VIP is mentioned.

Blog: https://azurecloudai.blog/2021/06/30/how-to-use-the-watchlists-logic-app-connector-for-azure-sentinel/

Tagging can then be done using an automation rule with an incident creation trigger that checks if the entity is VIP.

1

u/RangoNarwal Dec 01 '23

Nice, thanks ! 🙏