Entra Identity Logs from Azure Active Directory

cisagov / LME

Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution serving all organizations.

https://www.cisa.gov/resources-tools/services/logging-made-easy

Other

763 stars 59 forks source link

Entra Identity Logs from Azure Active Directory #246

Open rgbrow1949 opened 2 months ago

rgbrow1949 commented 2 months ago

Identity logs are valuable and in LME 2.0, the rearchitecture will allow us to bring in new logs from Azure Active Directory.

We should look into ways to collect Entra logs and what infrastructure changes would we need to make to LME to do it.

Available tools:

Ethan Bowen's Export-AAD tool: https://github.com/25004/Export-AAD.git
Untitled Good Tool: https://github.com/cisagov/untitledgoosetool

rgbrow1949 commented 2 months ago

The untitled goose tool contains PowerShell scripts we can use to get AAD logs from the tenant. Question: Does the current LME setup automatically configure AAD for auditing? Or will it need to be activated? AAD logs can be moved to Elk Stack with Filebeat.

safiuddinr commented 1 month ago

Adding @rgbrow1949 as a watcher.

ddiabe commented 2 weeks ago

There are 4 steps ; 1) Entra logs (AAD) require Powershell modules to run a powershell script to extract logs. 2) After modules are installed, script will be ran to export logs. (Logs will be in Json file) 3) Logs will later be exported via filebeat to elasticsearch in LS1. 4) Logs will be visualized using dashboards in Kibana.