How-To: Export EZCA PKI Logs to a SIEM Solution

Introduction - How to Send your PKI Logs to your SIEM

EZCA enables your security team to monitor critical user actions by pushing the information to your SIEM. The following SIEM providers are currently supported:

• Azure Sentinel
• CrowdStrike Falcon LogScale
• Splunk

If your SIEM provider is not currently supported email your Keytos contact and request a connector for that specific provider.

Prerequisites

• Ensure the EZCA application is registered in your Azure tenant
• Select an EZCA plan

Video Version - How to Send your PKI Logs to your SIEM

How to Connect EZCA to Your SIEM Solution

Setup Azure Sentinel

1. Go to the EZCA Portal.
2. Click on Settings
3. Expand your subscription’s advanced settings
4. Enable the Send Audit Logs to SIEM option.
5. Select Sentinel as the SIEM Provider.
6. In another tab, go to the Azure Portal
7. Select the log analytics connected to your Sentinel instance.
8. Click on Agents Management
9. Copy Your Workspace ID
10. Go back to the EZCA tab and paste it in the Workspace ID field.
11. Go back to the Azure tab and copy the primary key.
12. Go back to the EZCA tab and paste the key in the Workspace Key field.
13. Click the Test Connection button, this will create a test log in your SIEM to make sure EZCA can write to the EZCA.
14. If the connection test is successful, click Save changes
15. EZCA will now send your security logs to your SIEM. If an error occurs it will email your subscription PKI administrators.

Setup CrowdStrike Falcon LogScale

1. Go to the EZCA Portal.
2. Click on Settings.
3. Expand your subscription’s advanced settings.
4. Enable the Send Audit Logs to SIEM option.
5. Select CrowdStrike Falcon LogScale as the SIEM Provider.
6. In another tab, go to your CrowdStrike Falcon LogScale instance.
7. Click on the Settings tab.
8. Select the Ingest Tokens menu.
9. Click on the Add Token button.
10. Enter the token name
11. Assign the json parser and click Create
12. Copy the token and the ingest host name.
13. Go back to the EZCA tab.
14. Paste the ingest host name in the Ingestion Endpoint field.
15. Paste the token in the Ingestion Token field.
16. Click the Test Connection button, this will create a test log in your SIEM to make sure EZCA can write to the SIEM.
17. If the connection test is successful, click Save changes

Setup Splunk

1. Go to the EZCA Portal.
2. Click on Settings.
3. Expand your subscription’s advanced settings.
4. Enable the Send Audit Logs to SIEM option.
5. Select Splunk as the SIEM Provider.
6. In another tab, go to your Splunk instance.
7. Go to Data inputs by clicking on the Settings menu.
8. Add a new Http Event Collector.
9. Enter “Keytos” as the Name click next.
10. Leave input settings with the default values and click Next.
11. Click Submit.
12. Copy the Splunk token we just created.
13. Now let’s go back to the EZCA portal and copy the url of your splunk instance and the token we just created.
14. Click the Test Connection"** button, this will create a test log in your SIEM to make sure EZCA can write to the SIEM.
15. If the connection test is successful, click Save changes
16. EZCA will now send your security alerts to your SIEM. If an error occurs it will email your subscription administrators. See below to see the different events EZCA will send.

How To Create Alerts in Your SIEM to Monitor Your PKI

SIEMs allow you to create alerts for critical operations or abnormal behavior. We recommend setting up alerts for any high criticality event, and closely monitor medium and low events. Below are sample queries that can be used to create alerts.

How To Detect Certificate Request Denied

Certificate request denied is an event that is created when a user requests a certificate that they do not have permission to request. It is important to alert on this event since it can be an attacker attempting to escalate privileges by requesting a certificate. Below is a sample query to retrieve this specific event:

• Azure Sentinel
• CrowdStrike Falcon LogScale
• Splunk

EZCA_Certificates_CL | where  EventID_d == 4888

LogType = "EZCA_Certificates" and EventID = 4888

index=your_index sourcetype="EZCA_Certificates" EventID=4888

How To Detect CA Permissions Changed

CA Permission Changed is an event that is created when a user changes the security permissions for a CA. This event should be monitored since it is a low frequency high impact action that could indicate a compromise to your PKI administrator’s accounts. Below is a sample query to retrieve this specific event:

• Azure Sentinel
• CrowdStrike Falcon LogScale
• Splunk

EZCA_CAs_CL | where EventID_d == 4882

LogType = "EZCA_CAs" and EventID = 4882

index=your_index sourcetype="EZCA_CAs" EventID=4882

How To Detect CA Changes Denied

CA Permission Denied is an event that is created when a user attempts to change the security permissions for a CA without having the proper security permissions. It is important to alert on this event since it can be an attacker attempting to escalate privileges by changing the security configuration of your certificate authority. Below is a sample query to retrieve this specific event:

• Azure Sentinel
• CrowdStrike Falcon LogScale
• Splunk

EZCA_CAs_CL | where EventID_d == 92

LogType = "EZCA_CAs" and EventID = 92

index=your_index sourcetype="EZCA_CAs" EventID=92

How To Detect a Deleted CA

CA Deleted is an event that is created when a user deletes a CA. This event should be monitored since it is a low frequency high impact action that could indicate a compromise to your PKI administrator’s accounts. Below is a sample query to retrieve this specific event:

• Azure Sentinel
• CrowdStrike Falcon LogScale
• Splunk

EZCA_CAs_CL | where EventID_d == 19

LogType = "EZCA_CAs" and EventID = 19

index=your_index sourcetype="EZCA_CAs" EventID=19

Cloud PKI SIEM Events Reference

CA Operation Events

Certificate Operation Events