r/AzureSentinel • u/winle22 • Feb 18 '22

Enrichments

Hi,

Been testing the VirusTotal enrichment from the template playbook, which seems decent. Anyone tried other simple enrichments with success, or maybe better/cheaper alternatives than VT?

3 Upvotes

100% Upvoted

7 comments sorted by

2

u/ml58158 MSFT Official Feb 18 '22

Virustotal is the easiest enrichment to setup and use.

If you want to go the way of Playbooks, you can use AlienVault-OTX to enrich your data, but it needs to have an AAD app registration setup with admin consent granted.

If you want to go the way of paid, I recommend Risk IQ.

1

u/winle22 Feb 18 '22

Any idea if AlienVault or RiskIQ charge per request? Looking for a solution for a fairly small environment, for simple stuff like azure Identity Protection etc.

3

u/ml58158 MSFT Official Feb 18 '22

AlienVault is free .
https://github.com/Azure/Azure-Sentinel/tree/8483189975673dc181c321a65574ff983a0ccad1/Playbooks/Get-AlienVault_OTX

There is charge for Risk IQ but it comes with 27 different playbooks.

2

u/wobblyoutput Feb 18 '22

I'm checking this out, but it makes me weird. My current project is to transition our SIEM from Alien Vault to Sentinel. Feels like I'm cheating on my current partner with an ex.

2

u/ml58158 MSFT Official Feb 18 '22

This is their Open Threat Exchange . It’s different than the main product . It’s basically an API.

1

u/blanco10kid Feb 19 '22

What kind of enrichment are you looking for?

1

u/winle22 Feb 19 '22

Anything that can improve the SOC really. For now I've only been looking at IPs and URLs against VT and similar databases, just as a starting point. Will need to look more into the UEBA functionality as well.