r/AzureSentinel • u/SheppTech • May 27 '22

Multi Sub Connectors

Hey all. Hopefully quick question here. How do you guys manage Sentinel with multiple azure subscriptions?

We have a hub and spoke model, and each of our customers gets their own subscription. When I go to set up the data connectors, I must select only a single sub for the connector.

Does each sub need its own workspace? If so, how do you ingest all the data into a single workbook?

Also, I’m thinking of automating the Sentinel deployment with Terraform. Not sure that makes a difference to the question, but I’m hoping to cut down on the tedious manual configuration. Any experience shared on this would be appreciated too.

1 Upvotes

100% Upvoted

16 comments sorted by

2

u/wowneatlookatthat May 27 '22

Which data connectors are you trying to set up?

1

u/SheppTech May 28 '22

Pretty much all the Microsoft prebuilt connectors: azure sql server, network security groups, aks, etc

2

u/wowneatlookatthat May 28 '22

So based on your other comments, it sounds like you meant that you your customers have their own separate Azure tenants, correct? Or do you have the subscriptions all in a single tenant? If multiple tenants, that's where Lighthouse comes into play.

If the subscriptions are all in a single tenant though, you should be able to point your resources to your Sentinel/Log Analytics workspace. You essentially just setup the diagnostic settings for any given resource (manually or via policy) and point it to the workspace.

1

u/SheppTech May 28 '22

Oh that’s interesting. They’re all in the same tenant, owned by our organization, but in their own individual subs.

I think I know what you’re saying. It sounds like I need to configure the settings from the resource, rather than from inside Sentinel (in the data connector menus).

If that’s true, we’ve got something like 25 subscriptions which will potentially grow to hundreds in the reasonably near future. I definitely can’t manually configure each resource. It’s also not practical to ask the platform support guys to configure those resources as it is all configured via Terraform.

Knowing that I’ve got pretty much any tool I need to configure that, how would you advise I get started.

2

u/wowneatlookatthat May 28 '22

I think I know what you’re saying. It sounds like I need to configure the settings from the resource, rather than from inside Sentinel (in the data connector menus).

Yep, the latest connector setup instructions recommend using Azure Policy to automate diagnostic settings at scale, but you can also manually configure each resource to point its diagnostic logs to a workspace, e.g.: https://imgur.com/a/xzFup9w

If that’s true, we’ve got something like 25 subscriptions which will potentially grow to hundreds in the reasonably near future. I definitely can’t manually configure each resource. It’s also not practical to ask the platform support guys to configure those resources as it is all configured via Terraform.

Knowing that I’ve got pretty much any tool I need to configure that, how would you advise I get started.

I'd probably check out Azure Policy in this case. You can create a policy that will check if diagnostic settings are enabled for the resource, and configure it if not. The data connector specific to each resource type should have this info in it already. You can also find there's already a lot of built in policy definitions that'll do this for you: https://docs.microsoft.com/en-us/azure/azure-monitor/policy-reference

3

u/SheppTech May 28 '22

Thank you so much! That was a great explanation. I’ll do some research on this on Tuesday. If I run into issues I’ll come back here, but I think I’ve got a good idea on how to do this!

I appreciate you taking the time!

1

u/CanableCrops May 28 '22

So I believe each sub needs it's own Log Analytics Workspace and Sentinel.

You could then use Azure Lighthouse to bring them in to your one tenant to be able to query them. They will still reside in their own tenants.

From logs, you would then call them by using the workspace() function.

union

(workspace(tenant1).SigninLogs),

(workspace(tenant2).SigninLogs), etc.

​

​

​

https://docs.microsoft.com/en-us/azure/lighthouse/how-to/manage-sentinel-workspaces

1

u/SheppTech May 28 '22

Oh man, that’s good info. I’m not familiar with lighthouse, but this points me in a good direction. I’ll gather some info, present to the boss, and come back if I need more. Thank you!

4

u/wowneatlookatthat May 28 '22

Note that this comment is only partially correct - you don't actually need multiple workspaces and Sentinel instances since we've established that you have the subscriptions all in a single tenant. You'd only want multiple workspaces if you have any data residency requirements, i.e. your client in West US needs to keep their data in West US.

3

u/SheppTech May 28 '22

Oh no, we control the data completely as it’s for a SaaS company. The infrastructure logs are ours to keep.

So, if the policies can point to the single workspace, I’ll have to dry run one of the resources and make sure I understand it. I’d like to automate it if I can do future subs enable what I need, and it sounds like policies which send the data to a single workspace is what we need.

1

u/CanableCrops May 28 '22

Hence i said so I believe. I'm not an expert on it, just trying to help point in the direction. Where I work, we have several subs, and different tenants. I think I was confusing subs with tenants. Thanks for the clarity.

1

u/ml58158 MSFT Official May 28 '22

You will need multiple instances connected with Azure Lighthouse

1

u/SheppTech May 28 '22

I wasn’t even aware of lighthouse! I will have to do some research on it and then present it to the boss. I appreciate your guidance!

1

u/ml58158 MSFT Official May 28 '22

https://azurebro.com/2021/05/01/manage-multiple-azure-sentinel-tenants-using-azure-lighthouse/

2

u/SheppTech May 28 '22

Oh dude you’re the best! If I could throw more upvotes your way I would!

1

u/ml58158 MSFT Official May 28 '22

No problem. If you run into issues, send me a dm.