## Microsoft Sentinel

Microsoft Sentinel is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis.

Note that this is different from Microsoft 365/Microsoft Defender.

The Dropzone platform integrates with the [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/) security SIEM. Many customers ingest other alert sources into Microsoft Sentinel (e.g. IDPs) and integrate Dropzone into Microsoft Sentinel rather than the source systems.

### Integration Overview

To enable these integrations you will perform the following actions:

- Register a new application in Microsoft Entra Admin
- Locate your Client ID, Tenant ID, and create a Client Secret
- Assign necessary API permissions to the application
- Assign roles to the application in Microsoft Sentinel
- Locate your Workspace Name and Workspace ID

See the [Microsoft Integrations](https://docs.dropzone.ai/integrations/data/ms_data) page for instructions on how to register a new application, locate your Client ID and Tenant ID, and to create a Client Secret.

### Set Application Permissions

General instructions on how to assign API permissions to the application can be found in the [Microsoft Integrations](https://docs.dropzone.ai/integrations/data/ms_data) page.

Enabling MS Sentinel will require the following APIs and permissions:

| API                  | Permissions               |
|----------------------|---------------------------|
| Log Analytics        | `Data.Read`              |
| Microsoft Graph      | `SecurityEvents.Read.All` |

To add the Log Analytics API, do the following:

- In the API permissions page, click "Add a permission"
- Navigate to "APIs my organization uses"
- In the search bar, input "Log Analytics API," and select it

Select Log Analytics API

- Click "Application permissions"
- In the search bar, input "Data.Read" and select it. Click "Add permissions"

- Once back in the Application API permissions page, click "Grant admin consent for [mycompany.net]"

If your integration requires access to security alerts via Microsoft Graph, do the following:

- In the API permissions page, click "Add a permission"
- Under the Microsoft API header, select "Microsoft Graph"
- Click "Application permissions"
- Check the permission "SecurityEvents.Read.All," then click "Add permissions"

- Once back in the Application API permissions page, click "Grant admin consent for [mycompany.net]"

### Assign Roles in Microsoft Sentinel

To allow the application to access Microsoft Sentinel data, you must assign the application roles based on your desired access level.

- Navigate to [your Azure portal](https://portal.azure.com/)
- Under the "Azure Services" heading, navigate to Microsoft Sentinel
- Select the Log Analytics Workspace you wish to analyze
- Navigate to Configuration > Settings
- Click on "Workspace settings"
- Navigate to "Access control (IAM)"
- Select Add > Add role assignment

Select a [role](https://learn.microsoft.com/en-us/azure/sentinel/roles) based on your desired access level:

- Read-only access: Log Analytics Reader or Microsoft Sentinel Reader
- Read and write access: Microsoft Sentinel Responder or Microsoft Sentinel Contributor

If you wish to enable Ticket Sync, you must assign the application a Read and write access role.

For the purpose of this documentation, the Log Analytics Reader role has been selected.

- Once you have selected your role, click "Members"
- Next to "Assign access to," select "User, group, or service principal"
- Click "Select members"
- Search for your application (such as Dropzone AI Sentinel Integration) and click "Select"
- In the bottom left hand corner, click "Review + assign" twice

### Workspace IDs

To obtain your Workspace Name and Workspace ID, do the following:

- Navigate to [your Azure portal](https://portal.azure.com/)
- Under the "Azure Services" heading, navigate to Microsoft Sentinel
- Select the Workspace you wish to analyze
- In the left sidebar, navigate to Configuration > Settings
- Click on "Workspace Settings"
- Copy the Workspace ID, Subscription ID, and Resource Group shown for use later in the Dropzone UI

## Enable Microsoft Sentinel

To enable the Data Source integration, you will need the following information:

| Dropzone Field      | Source                     |
|---------------------|----------------------------|
| Client ID           | The Application ID copied earlier        |
| Tenant ID           | The Directory ID copied earlier           |
| Client Secret       | The Client Secret Value copied earlier    |
| Workspace ID        | The Workspace ID copied earlier           |
| Subscription ID     | The Subscription ID copied earlier        |
| Resource Group      | The Resource group copied earlier         |

To enable the Data Source integration, do the following:

- Navigate to your Dropzone AI tenant home page e.g. https://_mycompany_.dropzone.app
- In the bottom right corner, navigate to Settings > Integrations
- Click "Available"
- In the Search bar, search Microsoft Sentinel, then click "Configure"
- Under the Data Source heading, input the Client ID, Tenant ID, and Client Secret
- Under the Workspaces heading, click "Add item." Input the details of your workspace, then click "Add item" again
- Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.