How-To: Export your Cloud PKI Logs to CrowdStrike Falcon

Prerequisites

• The Keytos Entra ID application is registered in your tenant
• You have an active EZCA plan

How To Export Your Cloud PKI Audit Logs To CrowdStrike Falcon LogScale

1. Go to the EZCA Portal.

2. Click on Settings.

   

3. Expand your subscription’s advanced settings.

   

4. Enable the Send Audit Logs to SIEM option.

   

5. Select CrowdStrike Falcon LogScale as the SIEM Provider.

   

6. In another tab, go to your CrowdStrike Falcon LogScale instance.

7. Click on the Settings tab.

8. Select the Ingest Tokens menu.

9. Click on the Add Token button.

   

10. Enter the token name

11. Assign the json parser and click Create

    

12. Copy the token and the ingest host name.

    

13. Go back to the EZCA tab.

14. Paste the ingest host name in the Ingestion Endpoint field.

15. Paste the token in the Ingestion Token field.

16. Click the Test Connection button, this will create a test log in your SIEM to make sure EZCA can write to the SIEM.

    

17. If the connection test is successful, click Save changes

    

How To Create Alerts in CrowdStrike Falcon LogScale to Monitor Your Cloud PKI Activity

We recommend setting up alerts for any high criticality event, and closely monitor medium and low events. Here are some example queries to get you started:

Certificate Request Denied (Event ID 4888)

Certificate request denied is an event that is created when a user requests a certificate that they do not have permission to request. It is important to alert on this event since it can be an attacker attempting to escalate privileges by requesting a certificate.

LogType = "EZCA_Certificates" and EventID = 4888

CA Permission Changed (Event ID 4882)

CA Permission Changed is an event that is created when a user changes the security permissions for a CA. This event should be monitored since it is a low frequency high impact action that could indicate a compromise to your PKI administrator’s accounts.

LogType = "EZCA_CAs" and EventID = 4882

CA Changes Denied (Event ID 92)

CA Permission Denied is an event that is created when a user attempts to change the security permissions for a CA without having the proper security permissions. It is important to alert on this event since it can be an attacker attempting to escalate privileges by changing the security configuration of your certificate authority.

LogType = "EZCA_CAs" and EventID = 92

Deleted CA (Event ID 19)

CA Deleted is an event that is created when a user deletes a CA. This event should be monitored since it is a low frequency high impact action that could indicate a compromise to your PKI administrator’s accounts.

LogType = "EZCA_CAs" and EventID = 19

What Logs are Sent to CrowdStrike Falcon?

EZCA sends the following log types to your SIEM:

CA Operation Events

Certificate Operation Events