TISC Observables API - Microsoft Sentinel - SIR Setup Guide - Support and Troubleshooting

TISC Observables API - Microsoft Sentinel - SIR Setup Guide .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Purpose - This KB article will guide you on how TISC APIs can be used to integrate SIEMs such as Microsoft Sentinel to query malicious observables from TISC, monitor in SIEM and raise alerts or incidents. The article explains the steps using Microsoft Sentinel.

Pre-requisites -

Threat Intelligence Security Center installed in ServiceNow instance. Microsoft Sentinel - User should have 'Microsoft Sentinel' and 'Insights' role to access Logs workspace and query the data. SIR (optional) - To ingest incidents created in Microsoft Sentinel. Implementation Procedure

To verify if TISC workspace has any Observables data to ingest, navigate to Workspaces  Threat Intelligence Security Center  Threat Intel Library .

To create a Logic App to ingest observables from TISC to Microsoft Azure Sentinel. Login to portal.azure.com and search for Logic Apps . Click Add (which is available on the top left corner) to enter the instance and other required details and create a new Logic App. Once the Logic App is configured, start creating a flow to ingest the observables and send it to the Microsoft Azure Sentinel workspace. To send the ingested data, the workspace should already be setup to make the connection within the Logic App flow: Send Data step.

The connection is now built to send the ingested data to Microsoft Azure Sentinel workspace. Now, to verify the ingested Observables in the Microsoft Azure Sentinel workspace. Login to portal.azure.com and search for Microsoft Sentinel. Open the workspace from list and go to Logs  Expand Custom Logs  check for the table name that is used while setting up the connection in the Logic App flow. Run the query on that table to see if the ingested data is under Results tab (Refer below screenshot).

After ingesting the observables from TISC to Microsoft Azure Sentinel , you must write a join query on your Logs table and Observables ingested to generate alerts and incidents in Microsoft Azure Sentinel . Once the query is complete, Click on New alert rule to enter the details and setup the alert Rule (the Alert setup details will automatically contains the join query).

To verify the incidents getting created in Security Incident table. Navigate to Microsoft Azure Sentinel workspace  Click on Logs and expand Microsoft Sentinel . Check for either SecurityAlert or SecurityIncident table. Run the query on that table to verify if the alerts or incidents created based on the Alert rule setup.

(Optional) Ingest security incidents that are created in Microsoft Azure Sentinel to SIR workspace. Login to ServiceNow instance. Navigate to All and search for Azure Sentinel Incident Profile. Click New to setup a new profile to ingest the security incidents from Microsoft Azure Sentinel to SIR workspace.

(Optional) To check for the security incidents in the SIR Workspace that are created from the Microsoft Azure Sentinel incidents. Navigate to Workspaces  Security Incident Response Workspace  Expand Security Incidents under the List view  Click All . Verify the security incidents created that corresponds to the Microsoft Azure Sentinel incidents (In demo below, the Alert Rule column is used to filter security incidents created for Microsoft Sentinel ingested incidents).

Detailed Setup Demo Video

TroubleShooting

If Observables does not get ingested in Sentinel after configuring Logic App then please check 'Run history' of Logic App and see if any step failed.

Best Practices

For the Observables Fetch API which is used to fetch the observables from TISC application, ensure that the page size parameter value doesn’t exceed value of 1000 - which is the maximum page size that’s set in the instance and is controlled by a system property. It is not recommended to increase the maximum page size as it could increase the API response time and API might even result in timeout for a larger page size value.

Use 'Alert Rule' field from 'Security Alerts' table of Microsoft Sentinel to track the number of incidents that are created by Sentinel using TISC intelligence. Attached screenshot shows the mapping of incidents in SIR which are used to track incidents from an alert rule. In the above screenshot of Step 7, you can see how Alert Rule name is configured in Microsoft Azure Sentinel and populated in 'Alert Rule' field of Security Incident in SIR.

References

TISC API Sending REST API data to Azure Sentinel