3. Connecting to SIEM

Prerequisites

1. Registering the application in your tenant
2. Selecting a Plan

Introduction

EZMonitor enables your security team to monitor critical information with: intuitive dashboards, email alerts, as well as pushing the information to your SIEM.

Connecting To Azure Sentinel

1. Go to the EZMonitor Portal.
2. Login.
3. Click on Settings.
4. Expand your subscription’s advanced settings.
5. Enable the “Send Alerts to SIEM” option.
6. Select Sentinel as the SIEM Provider.
7. In another tab, go to the Azure Portal
8. Select the log analytics connected to your Sentinel instance.
9. Click on “Agents Management”.
10. Copy Your Workspace ID.
11. Go back to the EZMonitor tab and paste it in the “Workspace ID” field.
12. Go back to the Azure tab and copy the primary key.
13. Go back to the EZMonitor tab and paste the key in the “Workspace Key” field.
14. Click the “Test Connection” button, this will create a test log in your SIEM to make sure EZMonitor can write to the EZMonitor.
15. If the connection test is successful, click “Save changes”.
16. EZMonitor will now send your security alerts to your SIEM. If an error occurs it will email your subscription administrators. See below to see the different events EZMonitor will send.

Connecting To Splunk Cloud

1. Go to the EZMonitor Portal.
2. Login.
3. Click on Settings.
4. Expand your subscription’s advanced settings.
5. Enable the “Send Alerts to SIEM” option.
6. Select Splunk Cloud as the SIEM Provider.
7. In another tab, go to your splunk cloud instance.
8. Go to data inputs by clicking on the settings menu.
9. Add a new Http Event Collector.
10. Enter EZMonitor as the Name click next.
11. Leave input settings with the default values and click next.
12. Click Submit.
13. Copy the splunk token we just created. Note this is a credential so do not share it publicly.
14. Now let’s go back to the ezmonitor portal and copy the url of your splunk instance and the token we just created.
15. Click the “Test Connection” button, this will create a test log in your SIEM to make sure EZMonitor can write to the EZMonitor.
16. If the connection test is successful, click “Save changes”.
17. EZMonitor will now send your security alerts to your SIEM. If an error occurs it will email your subscription administrators. See below to see the different events EZMonitor will send.

SIEM Events

Below is the list of events EZMonitor and their corresponding Event ID. Use this information to create custom alert rules and automation to mitigate the issues.

EZ Monitor Events

EZMonitor has two types of alerts, The first type are alerts generated by scanning Certificate Transparency logs, and the second are alerts generated by scanning the SSL health of your servers.

Certificate Transparency Logs Based Alerts

Network Scan Based Alerts

Internal Network Scan Based Alerts (Includes all Network Scan Alerts)

Creating Alerts in Azure Sentinel

Using Azure Sentinel enables you to create alerts and automation for critical operations or abnormal behavior. We recommend setting up alerts for all EZMonitor events. Below are sample queries that can be used to create alerts. The best way to separate each alert is by their Vulnerability ID, below is a query that will return all the dangle DNS entries that are vulnerable to domain takeover.

EZMonitor_Alerts_CL | where VulnerabilityID_d == 18

Creating Alerts in Splunk Cloud

Using Splunk Cloud enables you to create alerts and automation for critical operations or abnormal behavior. We recommend setting up alerts for all EZMonitor events. Below are sample queries that can be used to create alerts. The best way to separate each alert is by their Vulnerability ID, below is a query that will return all the dangle DNS entries that are vulnerable to domain takeover.

sourcetype="ezmonitor_alerts" VulnerabilityID=18