Skip to content

Azure Sentinel via Webhooks

Microsoft Azure Sentinel is a cloud-native security information and event management (SIEM) tool that provides intelligent security analytics for your organization. This guide will walk you through the process of setting up Azure Sentinel to inject Peakhour events via webhooks into a custom table. This will help security engineers better understand and analyze Peakhour events to enhance the security posture of their organization.

Prerequisites:#

  1. An Azure subscription.
  2. Access to the Azure Portal.
  3. A Log Analytics workspace.

Step 1: Create a Logic App#

  1. Log into your Azure dashboard.
  2. Click on "Create a resource".
  3. Search for "Logic App" and select it.
  4. Click on "Create".
  5. Fill in the required information for your Logic App and click "Create".
  6. Wait for the deployment to complete.

Step 2: Configure Logic App to Receive Webhooks and Forward Logs to Log Analytics#

  1. Navigate to the Logic App you created in Step 1.
  2. Click on "Logic App Designer" under the "Development Tools" section.
  3. In the designer, search for "HTTP" in the connectors search bar and select "When a HTTP request is received".
  4. Configure the HTTP trigger with the appropriate method (POST) and JSON schema for Peakhour events.
  5. Add a new action by searching for "Azure Log Analytics" and selecting "Send Data".
  6. Connect to your Log Analytics workspace by providing the necessary credentials (Workspace ID, Shared Key).
  7. In the "Custom Log Name" field, enter the desired table name (suggested is PeakhourEvent).
  8. Map the fields from the HTTP request to the Log Analytics fields.
  9. Save the Logic App.

Step 3: Configure Peakhour to Send Logs via Webhooks#

  1. Log into your Peakhour dashboard.
  2. Navigate to the domain for which you want to forward logs to Azure.
  3. Under Log Forwarding, go to the Webhooks form.
  4. Enter the Logic App HTTP request URL as the webhook URL.
  5. Select the log type to be 'Event'.
  6. Submit the configuration.

Step 4: Verify the Integration#

Now that you have set up the integration, it's important to verify that the Peakhour events are being collected and stored in the custom table.

  1. Navigate to the Azure Sentinel dashboard in the Azure Portal.
  2. In the left-hand menu, click on "Logs".
  3. In the query editor, enter the following KQL query:
PeakhourEvent_CL | take 10
  1. Click on "Run" to execute the query. You should see the most recent Peakhour events in the custom table, along with the enriched fields.

This how-to guide has shown you the process of setting up Azure Sentinel to inject Peakhour events via webhooks into a custom table. By following these steps, security engineers can better monitor, analyze, and respond to Peakhour events, improving the overall security of their organization.