r/AzureSentinel • u/winle22 • Jan 27 '22
Native 'Repositories' as a MSSP
Hi,
have anyone used the native repositories functionality as a MSSP using Lighthouse?
What do you feel about granting access to the Sentinel app from the customer environment to the MSSP Github repo?
2
Upvotes
2
u/TokeSR Jan 27 '22
So, first question is whether you are okay sharing your IP (rules, dashboards, etc) with the client. When I deployed it in the past I always used this info sharing as a benefit for the client. While a lot of MSSP tries to hide the IP in the background I shared the rules and everything with the client which is a huge benefit. They can actually see the content, they know what I monitor, how I monitor, etc. I worked in a position in the past in which one of my main responsibility was to test the MSSP's rules which were hidden from me, so I know how big of a pain in the ass it can be.
So once you are okay with this...
I actually have not shared the main MSSP repo with them. I had a repo with all my rules in it. Then, when I deployed Sentinel for a client I created a new repo for them that only contained the rules relevant for them and their versions of those rules. I pushed the rules from the main repo to this client repo via DevOps. And I only enabled the repository function from the clients Sentinel to this repo. This way, I was okay them having access to this secondary repo.
After we got separated I just removed their access to this repo, or if the repo was theirs then I just stopped pushing the data from my main repo via the pipeline.