{"id":54630,"date":"2023-12-01T09:30:00","date_gmt":"2023-12-01T09:30:00","guid":{"rendered":"https:\/\/infrasos.com\/?p=54630"},"modified":"2023-11-30T05:50:32","modified_gmt":"2023-11-30T05:50:32","slug":"real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools","status":"publish","type":"post","link":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/","title":{"rendered":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"54630\" class=\"elementor elementor-54630\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1c058b0c ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1c058b0c\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1f7e3012 ot-flex-column-vertical\" data-id=\"1f7e3012\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6da05fb elementor-widget elementor-widget-text-editor\" data-id=\"6da05fb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing only that however wont improve your incident response. Companies should instead look to ingest these logs into their current security operations center (SOC) model. In most cases, this means feeding the logs into their <a href=\"https:\/\/infrasos.com\/top-10-best-siem-tools-for-cyber-attack-monitoring\/\">security information and event management<\/a> (SIEM) with the aim to have all logging centralized.\u00a0<\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p>In doing so, you are enabling your <a href=\"https:\/\/infrasos.com\/azure-security-center-best-practices-how-to-secure-azure\/\">security teams<\/a> to view the full attack chain during security events and incidents. Without those logs, it may increase manual effort and displacement of logs. This may result in slower response times, or the effectiveness of your SOC.<\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p>Another use case to ingest logs into your SIEM would be for retention. In most cases, <a href=\"https:\/\/infrasos.com\/soar-vs-siem-whats-the-difference\/\">SIEM solutions offer retention<\/a> as part of the package, so that you comply with your <a href=\"https:\/\/infrasos.com\/how-to-implement-compliance-and-governance-policies-in-azure\/\">governance and compliance logging<\/a> requirements.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef7c655 elementor-widget elementor-widget-text-editor\" data-id=\"ef7c655\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/soar-vs-siem-whats-the-difference\/\">SOAR vs SIEM \u2013 What\u2019s the Difference ? (Pros and Cons)<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f261baa elementor-widget elementor-widget-heading\" data-id=\"f261baa\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">Real-time Monitoring with Azure AD Auditing: <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e65b031 elementor-widget elementor-widget-heading\" data-id=\"e65b031\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Entra ID Logging Retention<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-739d9b5d elementor-widget elementor-widget-text-editor\" data-id=\"739d9b5d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><!-- wp:paragraph --><\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p>By default, logging retention for Entra ID is as followed:\u00a0<\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p><b>Sign-in Logs:<\/b><\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:list --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul><!-- wp:list-item --><\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Free and Basic tiers: Retained for 30 days.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Premium P1 and P2 tiers: Retained for 90 days.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Azure AD P2 and Azure AD P3 tiers: Retained for 180 days.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Enterprise Agreement (EA) or Azure AD Premium P3 with an EA add-on: Can retain <a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\">sign-in logs<\/a> for up to 730 days using Azure Log Analytics service.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- \/wp:list --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p><strong>Audit Logs:<\/strong><\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:list --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul><!-- wp:list-item --><\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Free license SKU: Retained for 7 days.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>P1 and P2 licenses: Retained for 30 days.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Interactive retention period can be increased up to 730 days using the Analytics log data plan, provided the user has an Enterprise E5 subscription and an add-on license.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>To retain audit logs for longer than 90 days (and up to 1 year), a user needs to be assigned an Office 365 E5 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- \/wp:list --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p><strong>Provisioning Logs:<\/strong><\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:list --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul><!-- wp:list-item --><\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Can be stored for 30+ days using <a href=\"https:\/\/infrasos.com\/how-to-configure-azure-ad-activity-logs-for-effective-monitoring\/\">Azure Monitoring<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- wp:list-item --><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>The article suggests that provisioning logs can be stored for longer periods by integrating them with Azure Monitor logs, which allows for the creation of custom queries, alerts, and dashboards to manage the logs.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>To lean more <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/microsoft-entra-pricing\" target=\"_blank\" rel=\"noopener\">click here<\/a><\/p>\n<p><!-- \/wp:list-item --><\/p>\n<p><!-- \/wp:list --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p><!-- \/wp:paragraph --><\/p>\n<p><!-- wp:paragraph --><\/p>\n<p><!-- \/wp:paragraph --><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-70e6eb0 e-con-boxed e-con\" data-id=\"70e6eb0\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b7baf6b elementor-widget elementor-widget-text-editor\" data-id=\"b7baf6b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/why-monitoring-azure-ad-user-activity-is-essential-for-security\/\">Why Monitoring Azure AD User Activity is Essential for Security?<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-332a6e0 elementor-widget elementor-widget-heading\" data-id=\"332a6e0\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Key Benefits of SIEM Integration<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7c00934 elementor-widget elementor-widget-text-editor\" data-id=\"7c00934\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">SIEM solutions are only as good as the logs that are feeding into them. With Entra ID, you are feeding your identity logs into a central repository. Depending on your solution, the SIEM then correlates events to give a greater level of insight during security events. <\/span><br style=\"font-weight: 400;\" \/><br \/><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-449610b elementor-widget elementor-widget-image\" data-id=\"449610b\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1.jpeg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ2MzUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TT0MtU0lFTS1zaW1wbGUtMS5qcGVnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"142\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-768x142.jpeg\" class=\"attachment-medium_large size-medium_large wp-image-54635\" alt=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-768x142.jpeg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-300x55.jpeg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-1024x189.jpeg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-720x133.jpeg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1.jpeg 1253w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-36a4615 e-con-boxed e-con\" data-id=\"36a4615\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-05aaf37 elementor-widget elementor-widget-text-editor\" data-id=\"05aaf37\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A perfect example is a phishing campaign. If your company is hit with a phishing campaign, you hope that your email protection solution such as Defender for <a href=\"https:\/\/infrasos.com\/office-365-security-best-practices-secure-your-office-365\/\">O365 would alert and protect you<\/a>. In some cases, however, these attacks pass through so it\u2019s important for your SOC to have the logs to be able to assess the impact.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If a user has clicked the link, or attachment, you want to be able to have the telemetry to understand what happened next. In most cases, credentials are stolen, used or sold. This is where the Entra logs come into play. If your SOC has your email security solution, <a href=\"https:\/\/infrasos.com\/azure-vm-security-antivirus-patching-endpoint-protection\/\">endpoint protection<\/a> and identity logs ingesting into your SIEM, you are assured that your SOC has a better chance at seeing the full attack chain. This includes post-attacks such as<a href=\"https:\/\/infrasos.com\/top-10-best-ways-to-prevent-cyber-attacks-on-businesses\/\"> brute force, or using compromised credentials<\/a>.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0d42bae elementor-widget elementor-widget-image\" data-id=\"0d42bae\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing.jpeg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Phishing SOC Response\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ2MzIsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TT0MtU0lFTS1QaGlzaGluZy5qcGVnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"382\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing-768x382.jpeg\" class=\"attachment-medium_large size-medium_large wp-image-54632\" alt=\"Phishing SOC Response\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing-768x382.jpeg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing-300x149.jpeg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing-1024x509.jpeg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing-1536x763.jpeg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing-720x358.jpeg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-Phishing.jpeg 1690w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-582f467 elementor-widget elementor-widget-text-editor\" data-id=\"582f467\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The quicker they do this, the faster the response. If they are having to look for logs in multiple places, and having to search one by one, they are likely to miss something, or be too late.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5f35512 elementor-widget elementor-widget-text-editor\" data-id=\"5f35512\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/top-10-best-siem-tools-for-cyber-attack-monitoring\/\">Top 10 Best SIEM Tools for Cyber Attack Monitoring (Pros Cons)<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae7ed26 elementor-widget elementor-widget-heading\" data-id=\"ae7ed26\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Integrating Entra ID (Azure AD) with your SIEM<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-25e7a91 elementor-widget elementor-widget-text-editor\" data-id=\"25e7a91\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">SIEM solutions vary, however integration paths are often repeated. During this post, I show how to ingest logs into Azures native solution: Sentinel.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you are not running Sentinel, your SIEM solution has documentation on how to ingest logs. In most cases, this is via Graph API, or EventHUB. I will touch more on these options later.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6d98343 elementor-widget elementor-widget-heading\" data-id=\"6d98343\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Prerequisites<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-274289f elementor-widget elementor-widget-text-editor\" data-id=\"274289f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Before you ingest Entra logs into Sentinel confirm you have the following:\u00a0<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">A Microsoft Entra ID P1 or P2 license is required to ingest sign-in logs into Microsoft Sentinel. Any Microsoft Entra ID license (Free\/O365\/P1 or P2) is sufficient to ingest the other log types.\u00a0<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Your user must be assigned the <\/span><b>Microsoft Sentinel Contributor role<\/b><span style=\"font-weight: 400;\"> on the workspace.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Your user must be assigned the <\/span><b>Global Admin <\/b><span style=\"font-weight: 400;\">or <\/span><b>Security Admin<\/b><span style=\"font-weight: 400;\">\u00a0roles on the tenant you want to stream the logs from.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Your user must have <\/span><b>read and write<\/b><span style=\"font-weight: 400;\"><a href=\"https:\/\/infrasos.com\/azure-ad-roles-and-permissions-assign-manage-roles-for-users-groups\/\"> permissions<\/a> to the Microsoft Entra ID diagnostic settings in order to be able to see the connection status.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">More info: <\/span><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/connect-azure-active-directory\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/connect-azure-active-directory<\/span><\/a><span style=\"font-weight: 400;\">\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-879edf8 elementor-widget elementor-widget-text-editor\" data-id=\"879edf8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-security-center-best-practices-how-to-secure-azure\/\">Azure Security Center Best Practices: How to Secure Azure<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8cdf5c0 e-con-boxed e-con\" data-id=\"8cdf5c0\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3a40d54 elementor-widget elementor-widget-heading\" data-id=\"3a40d54\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Integrate Entra (Azure AD) With Microsoft Sentinel<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bd37920 elementor-widget elementor-widget-text-editor\" data-id=\"bd37920\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">If you are not running Sentinel, but wish to follow along, you can easily create an instance via the Azure portal.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">First, login to the <\/span><b>Azure Portal<\/b><span style=\"font-weight: 400;\">, and search for <\/span><b>Sentinel<\/b><span style=\"font-weight: 400;\">. Notice that your instance gets a 31-day free trail.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9749533 elementor-widget elementor-widget-image\" data-id=\"9749533\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools.  Add Sentinel Workspace\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MjUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9BZGRfU2VudGluZWxfV29ya3NwYWNlLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"382\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-768x382.png\" class=\"attachment-medium_large size-medium_large wp-image-54825\" alt=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Add Sentinel Workspace\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-768x382.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-300x149.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-1024x509.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-1536x763.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-2048x1018.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Add_Sentinel_Workspace-720x358.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f186b2b elementor-widget elementor-widget-text-editor\" data-id=\"f186b2b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">If you haven\u2019t created a<a href=\"https:\/\/infrasos.com\/how-to-configure-azure-ad-activity-logs-for-effective-monitoring\/\"> log analytics workspace<\/a> already, you can do by clicking the <\/span><b>Create A New Workspace<\/b><span style=\"font-weight: 400;\"> button. Next, enter your values and click <\/span><b>Tags<\/b><span style=\"font-weight: 400;\">.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b048da elementor-widget elementor-widget-image\" data-id=\"4b048da\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Create_log_analytics_workspace\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MjYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9DcmVhdGVfbG9nX2FuYWx5dGljc193b3Jrc3BhY2UucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"526\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-768x526.png\" class=\"attachment-medium_large size-medium_large wp-image-54826\" alt=\"Create_log_analytics_workspace\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-768x526.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-300x205.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-1024x701.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-1536x1051.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-2048x1401.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Create_log_analytics_workspace-720x493.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5e15e0e elementor-widget elementor-widget-text-editor\" data-id=\"5e15e0e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Aftering filling in your tags, hit <\/span><b>Next <\/b><span style=\"font-weight: 400;\">and if happy; <\/span><b>Create<\/b><span style=\"font-weight: 400;\">. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">This takes you back to the Sentinel pane where you select your workspace. To do so, select the workspace and click <\/span><b>Add <\/b><span style=\"font-weight: 400;\">at the bottom left corner.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fadd92b elementor-widget elementor-widget-image\" data-id=\"fadd92b\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Sentinel select log analytics\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MjcsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TZW50aW5lbF9zZWxlY3RfbG9nX2FuYWx5dGljcy5wbmcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"402\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-768x402.png\" class=\"attachment-medium_large size-medium_large wp-image-54827\" alt=\"Sentinel select log analytics\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-768x402.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-300x157.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-1024x536.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-1536x804.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-2048x1072.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_select_log_analytics-720x377.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-63768ee elementor-widget elementor-widget-text-editor\" data-id=\"63768ee\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Once complete, you have your Sentinel instance:<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9a3d2a9 elementor-widget elementor-widget-image\" data-id=\"9a3d2a9\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Sentinel Dashboard\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTgsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TZW50aW5lbF9EYXNoYm9hcmQucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"317\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-768x317.png\" class=\"attachment-medium_large size-medium_large wp-image-54818\" alt=\"Sentinel Dashboard\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-768x317.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-300x124.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-1024x422.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-1536x634.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-2048x845.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Dashboard-720x297.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a9ba4ce elementor-widget elementor-widget-template\" data-id=\"a9ba4ce\" data-element_type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<div data-elementor-type=\"section\" data-elementor-id=\"7917\" class=\"elementor elementor-7917\">\n\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-30c8dcce ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"30c8dcce\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-19a106e2 ot-flex-column-vertical\" data-id=\"19a106e2\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ca1a12e elementor-widget elementor-widget-heading\" data-id=\"ca1a12e\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4c539a35 elementor-widget elementor-widget-text-editor\" data-id=\"4c539a35\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-16296eed ot-flex-column-vertical\" data-id=\"16296eed\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-65568df5 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"65568df5\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"7917\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"65568df5\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e9a25d3 elementor-widget elementor-widget-text-editor\" data-id=\"e9a25d3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-auditing-enabling-and-configuring-audit-logs\/\">Azure AD Auditing: Enabling and Configuring Audit Logs<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ee6991f elementor-widget elementor-widget-heading\" data-id=\"ee6991f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Connecting Azure Active Directory<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a07970c elementor-widget elementor-widget-text-editor\" data-id=\"a07970c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Now we have a Sentinel instance, we ingest our Entra ID (<a href=\"https:\/\/infrasos.com\/azure-ad-auditing-enabling-and-configuring-audit-logs\/\">Azure AD) logs<\/a>. For Sentinel, ingestion is done via <strong>Data Connectors. <\/strong>To enable these, browse <\/span><b>Content Hub<\/b><span style=\"font-weight: 400;\">. Because the backend of Sentinel is a Log Analytics Workspace, Integration support is often an option for most third-party solutions.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For anything Native, Microsoft have created these connectors already, and have listed them under <strong>Content Hub<\/strong>. In this walkthrough, we are looking at Entra ID logs, so we can load <\/span><b>Content Hub<\/b><span style=\"font-weight: 400;\"> and search <em>Azure Active Directory<\/em>. As you can see below, the provider is Microsoft.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-966f52b elementor-widget elementor-widget-image\" data-id=\"966f52b\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Sentinel_Contenthub\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTcsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TZW50aW5lbF9Db250ZW50aHViLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"354\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-768x354.png\" class=\"attachment-medium_large size-medium_large wp-image-54817\" alt=\"Sentinel_Contenthub\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-768x354.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-300x138.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-1024x473.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-1536x709.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-2048x945.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_Contenthub-720x332.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac63cc2 elementor-widget elementor-widget-text-editor\" data-id=\"ac63cc2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Once selected, we review the right hand pane to see what we are getting, the release notes and what is actually going to be created:\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fe65cd elementor-widget elementor-widget-image\" data-id=\"4fe65cd\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"AzureAD Install Connector\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9BenVyZUFEX0luc3RhbGxfQ29ubmVjdG9yLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"378\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-768x378.png\" class=\"attachment-medium_large size-medium_large wp-image-54816\" alt=\"AzureAD Install Connector\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-768x378.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-300x148.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-1024x504.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-1536x756.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-2048x1009.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Install_Connector-720x355.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2f47c35 elementor-widget elementor-widget-text-editor\" data-id=\"2f47c35\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Once complete, <strong>Install<\/strong> changes to <strong>Manage<\/strong>, which you click. The reason being is that it won\u2019t send all logs by default<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-53fa25a elementor-widget elementor-widget-image\" data-id=\"53fa25a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TZW50aW5lbF9BenVyZUFEX0NvbmZpZy5wbmcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"508\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config-768x508.png\" class=\"attachment-medium_large size-medium_large wp-image-54815\" alt=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config-768x508.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config-300x198.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config-1024x677.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config-1536x1016.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config-720x476.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Config.png 1760w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-53981b9 elementor-widget elementor-widget-text-editor\" data-id=\"53981b9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Select those that you require and hit apply changes. Remember that the more data the SIEM has, the greater level of correlation it performs, and insight it has. Log storage however comes with cost, so it&#8217;s worth finding the right balance.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Once done, the status changes to Green:\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-99f1b9a elementor-widget elementor-widget-image\" data-id=\"99f1b9a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Connector_Status.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"AzureAD Connector Status\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTQsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9BenVyZUFEX0Nvbm5lY3Rvcl9TdGF0dXMucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"224\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Connector_Status-768x224.png\" class=\"attachment-medium_large size-medium_large wp-image-54814\" alt=\"AzureAD Connector Status\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Connector_Status-768x224.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Connector_Status-300x87.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Connector_Status-720x210.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Connector_Status.png 940w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1f77369 elementor-widget elementor-widget-text-editor\" data-id=\"1f77369\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\">Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd8f197 elementor-widget elementor-widget-heading\" data-id=\"fd8f197\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Searching The Logs<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e8fd937 elementor-widget elementor-widget-text-editor\" data-id=\"e8fd937\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">You can now query these logs, by selecting Logs. Below is a simple query to <a href=\"https:\/\/infrasos.com\/what-is-event-id-4625-an-account-failed-to-log-on\/\">view failed logins<\/a>:<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-749acca elementor-widget elementor-widget-code-highlight\" data-id=\"749acca\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-markup line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-markup\">\n\t\t\t\t\t<xmp>SigninLogs\n| where ResultType != 0\n| project TimeGenerated, UserPrincipalName, ResultType, ResultDescription, Location, IPAddress\n<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f97a373 elementor-widget elementor-widget-image\" data-id=\"f97a373\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools  Sentinel AzureAD Query\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TZW50aW5lbF9BenVyZUFEX1F1ZXJ5LnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"366\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-768x366.png\" class=\"attachment-medium_large size-medium_large wp-image-54813\" alt=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools Sentinel AzureAD Query\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-768x366.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-300x143.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-1024x488.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-1536x732.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-2048x976.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_AzureAD_Query-720x343.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fa9e791 elementor-widget elementor-widget-text-editor\" data-id=\"fa9e791\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">You could then dive further, by looking at those that may be malicious. You can do this by clicking the filter icon on the column <\/span><b>ResultDescription <\/b><span style=\"font-weight: 400;\">or expanding your Kusto query. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-38d40b6 elementor-widget elementor-widget-image\" data-id=\"38d40b6\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Sentinel_security_logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MTIsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TZW50aW5lbF9zZWN1cml0eV9sb2dzLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"246\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-768x246.png\" class=\"attachment-medium_large size-medium_large wp-image-54812\" alt=\"Sentinel_security_logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-768x246.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-300x96.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-1024x328.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-1536x492.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-2048x656.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/Sentinel_security_logs-720x231.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fcf06a elementor-widget elementor-widget-text-editor\" data-id=\"4fcf06a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/office-365-reporting\/\">Try Office 365 Reporting Tool by InfraSOS<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d943110 elementor-widget elementor-widget-heading\" data-id=\"d943110\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Third Party Solutions<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dff4f6c elementor-widget elementor-widget-text-editor\" data-id=\"dff4f6c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Following on article Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools the third-party <a href=\"https:\/\/infrasos.com\/top-10-best-siem-tools-for-cyber-attack-monitoring\/\">SIEM solutions<\/a> may have different integration paths. For the majority of solutions, this is either via Log Analytic feeds, EventHub or Graph API. For the first two, these settings are found under the <\/span><b>Entra ID Portal<\/b><span style=\"font-weight: 400;\"> &gt; <\/span><b>Monitoring &amp; Health <\/b><span style=\"font-weight: 400;\">&gt; <\/span><b>Diagnostic Settings<\/b><span style=\"font-weight: 400;\">.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e1bf3ff elementor-widget elementor-widget-image\" data-id=\"e1bf3ff\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"AzureAD diag settings\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MzEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9BenVyZUFEX2RpYWdfc2V0dGluZ3MucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"518\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings-768x518.png\" class=\"attachment-medium_large size-medium_large wp-image-54831\" alt=\"AzureAD diag settings\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings-768x518.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings-300x202.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings-1024x690.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings-1536x1036.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings-720x485.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_diag_settings.png 1940w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0768309 elementor-widget elementor-widget-text-editor\" data-id=\"0768309\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400\">Here you can click <\/span><b>Add Diagnostic Settings<\/b><span style=\"font-weight: 400\"> and select your options:<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d0ecfbd elementor-widget elementor-widget-image\" data-id=\"d0ecfbd\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"AzureAD Entra Feed\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ4MzIsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9BenVyZUFEX0VudHJhX0ZlZWQucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"452\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-768x452.png\" class=\"attachment-medium_large size-medium_large wp-image-54832\" alt=\"AzureAD Entra Feed\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-768x452.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-300x177.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-1024x603.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-1536x904.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-2048x1205.png 2048w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/AzureAD_Entra_Feed-720x424.png 720w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4cef5c1 elementor-widget elementor-widget-text-editor\" data-id=\"4cef5c1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">For API integrations, you are most likely have to create an <\/span><b>Application Registration<\/b><span style=\"font-weight: 400;\"> that has read access to the necessary logs. This works by querying the logs using the identity of the Service Principal.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c8d9262 elementor-widget elementor-widget-image\" data-id=\"c8d9262\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI.jpeg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools.  AzureAD GraphAPI\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ2MzMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEwXC9TT0MtU0lFTS1HcmFwaEFQSS5qcGVnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"178\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI-768x178.jpeg\" class=\"attachment-medium_large size-medium_large wp-image-54633\" alt=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. AzureAD GraphAPI\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI-768x178.jpeg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI-300x70.jpeg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI-1024x238.jpeg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI-720x167.jpeg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-GraphAPI.jpeg 1293w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c7ed1df elementor-widget elementor-widget-text-editor\" data-id=\"c7ed1df\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\">Get-AzureADAuditSignInLogs \u2013 Find Sign In Logs Last 30 Days PowerShell<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c38ee09 elementor-widget elementor-widget-heading\" data-id=\"c38ee09\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools Conclusion<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8f36ad elementor-widget elementor-widget-text-editor\" data-id=\"f8f36ad\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Whilst getting the logs into your SIEM is the first step, it requires you to fine-tune your solution to get the most out of it. Entra ID logs without context are just logs. It requires further fine-tuning, automation and alerting in order for the logs to be worth it.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Additional native features, such as <a href=\"https:\/\/infrasos.com\/how-to-implement-compliance-and-governance-policies-in-azure\/\">Identity Governance Logs<\/a> (Risky users) also helps to boost the usefulness of these logs by highlighting identities that may be at risk, or compromised.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Whichever method you choose, make sure that this is reviewed on a frequent basis. Microsoft is constantly changing the Graph API integration around Entra ID, and this may have a knock-on effect to your log ingestion. Whilst some managed SIEM providers may alert you directly, it\u2019s worth monitoring Microsoft&#8217;s feature updates. <\/span><\/p>\n<p><br style=\"font-weight: 400;\" \/><br style=\"font-weight: 400;\" \/><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-220521db elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"220521db\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-12810793 ot-flex-column-vertical\" data-id=\"12810793\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2e9cf438 elementor-widget elementor-widget-image\" data-id=\"2e9cf438\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-7f32644 ot-flex-column-vertical\" data-id=\"7f32644\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-11e47fbe elementor-widget elementor-widget-heading\" data-id=\"11e47fbe\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5b5a07d1 elementor-widget elementor-widget-text-editor\" data-id=\"5b5a07d1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6f8fbce0 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"6f8fbce0\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"54630\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"6f8fbce0\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2493f58e elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"2493f58e\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing only that however wont improve your incident response. Companies should instead look to ingest these logs into their current security operations center (SOC) model. In most cases, this means feeding the logs into their [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[67,127],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools<\/title>\n<meta name=\"description\" content=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\" \/>\n<meta property=\"og:description\" content=\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-12-01T09:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-11-30T05:50:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-768x142.jpeg\" \/>\n<meta name=\"author\" content=\"Ashley Moran\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ashley Moran\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\"},\"author\":{\"name\":\"Ashley Moran\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168\"},\"headline\":\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\",\"datePublished\":\"2023-12-01T09:30:00+00:00\",\"dateModified\":\"2023-11-30T05:50:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\"},\"wordCount\":1498,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"azure ad\",\"monitoring azure ad\"],\"articleSection\":[\"Azure AD\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\",\"url\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\",\"name\":\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2023-12-01T09:30:00+00:00\",\"dateModified\":\"2023-11-30T05:50:32+00:00\",\"description\":\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168\",\"name\":\"Ashley Moran\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g\",\"caption\":\"Ashley Moran\"},\"description\":\"I am a seasoned Security Engineer with several years of experience, primarily in the healthcare industry.\",\"sameAs\":[\"https:\/\/amoran.io\",\"https:\/\/www.linkedin.com\/in\/ashleymoran\/\"],\"url\":\"https:\/\/infrasos.com\/author\/amoranioshgmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools","description":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/","og_locale":"en_US","og_type":"article","og_title":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools","og_description":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing","og_url":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2023-12-01T09:30:00+00:00","article_modified_time":"2023-11-30T05:50:32+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/10\/SOC-SIEM-simple-1-768x142.jpeg"}],"author":"Ashley Moran","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Ashley Moran","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/"},"author":{"name":"Ashley Moran","@id":"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168"},"headline":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools","datePublished":"2023-12-01T09:30:00+00:00","dateModified":"2023-11-30T05:50:32+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/"},"wordCount":1498,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["azure ad","monitoring azure ad"],"articleSection":["Azure AD"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/","url":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/","name":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2023-12-01T09:30:00+00:00","dateModified":"2023-11-30T05:50:32+00:00","description":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools. Enabling Entra ID (AzureAD) logging is crucial for securing your identities. Doing","breadcrumb":{"@id":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/real-time-monitoring-with-azure-ad-auditing-siem-analytics-tools\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"Real-time Monitoring with Azure AD Auditing: SIEM\/ Analytics Tools"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168","name":"Ashley Moran","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g","caption":"Ashley Moran"},"description":"I am a seasoned Security Engineer with several years of experience, primarily in the healthcare industry.","sameAs":["https:\/\/amoran.io","https:\/\/www.linkedin.com\/in\/ashleymoran\/"],"url":"https:\/\/infrasos.com\/author\/amoranioshgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/54630"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=54630"}],"version-history":[{"count":57,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/54630\/revisions"}],"predecessor-version":[{"id":55420,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/54630\/revisions\/55420"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=54630"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=54630"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=54630"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}