How to integrate to Microsoft Sentinel

Question

How to integrate to Microsoft Sentinel

Ferenc Margl

Updated November 10, 2023 15:29

Accepted Answer

This feature is available ✔️ for:
Role: Subscription Owner
Plan: Enterprise

In this article, we cover the following topics:

📝 Note: Before you enable the SIEM integration in your Tresorit subscription you need to sign the Data Processing Agreement, which you can find under the Billing tab in your Admin Center.

With the integration to SIEM providers our approach is to forward a selected set of events to the dedicated provider of our customer. The events can be selected during the configuration flow on the Setting tab of your Admin Center. The required events can be modified.

The currently available event groups:

User Activity (e.g. login & logout related events)
Admin Activity (e.g. integration setups, policy modifications)
User Management (e.g. invite, suspend, delete actions)

See the detailed information regarding events in the documentation below.

Additional information and limitations

We are not providing the logs in ASIM format, but in a custom format which is documented in the last section of this article.
Certain actions can be performed by Tresorit Support on the customer’s request. In that case the event’s ActorUserEmail field has the support@tresorit.com value and all other actor user related fields are empty.
These logs are not stored long-term on the storage servers used by Tresorit. We advise to store this data in Sentinel or at any dedicated third party.

Setup steps

You will need to sign-in to your Microsoft account to be able provide the Workspace ID of your Sentinel and a shared key to create the integration.

1. Login with subscription owner to your Tresorit account and visit the Settings tab of the Admin Center.

2. Click Enable in the SIEM integration section.

3. In case the DPA is not signed yet in your account, you will be prompted to start the signing process on the Billing tab.

4. You will need two specific values to set up the integration with your Sentinel workspace: Workspace ID and Shared Key.

Open the Log Analytics workspace used by Sentinel, go to Agents Management, you will find the Workspace ID, Primary and Secondary keys under Log Analytics agent instructions. You can use any of those keys as your Shared key value.

5. Select the required events from the list of available events. Find the detailed event documentation below.

Event documentation

Key value pairs

The possible values of the keys which are displayed during the setup of the integrations are documented in the following tables.

User Activity Events

Option during the setup	Value
`LoginLogout`	`Login` `Logout`
`DeviceRegisterRevoke`	`DeviceRegister` `DeviceRevoke`
`Signup`
`PasswordChange`	`Passwordchange`
`TwoFactorSettings`	`TwoFactorEnable` `TwoFactorDisable` `TwoFactorOptionConfig`
`DomainInviteResponse`	`DomainInviteAccept` `DomainInviteDecline`
`AdvancedControlAccept`	`AdvancedControlAccept`

Domain User Management Events

Option during the setup	Values
`DomainUserAddRemove`	`UserInvite` `UserAutoAdd` `UserRemove` `UserWipe`
`DataOwnershipTransfer`	`DataOwnershipTransfer`
`DomainUserSuspension`	`UserSuspend` `UserUnsuspend`
`DomainUserRoleChange`	`RoleChange`
`PolicyAssign`	`PolicyAssign`
`PasswordReset`	`PasswordReset`
`DomainUserTwoFactorSettings`	`TwoFactorDisable`
`DomainUserDeviceRevoke`	`DeviceRevoke`

Admin Activity Events

Option during the setup	Values
`AdvancedControlSettings`	`AdvancedControlEnable` `AdvancedControlDisable`
`SSOSettings`	`SSOEnable` `SSODisable`
`SCIMSettings`	`SCIMEnable` `SCIMDisable`
`CompanyNameEdit`	`CompanyNameEdit`
`DomainCustomization`	`DomainCustomization`
`ADConnectorApiKeyManagement`	`GenerateADConnectorAPIKey` `RemoveADConnectorAPIKey`
`EmailDomainVerificationSettings`	`AddVerifiedEmailDomain` `RemoveVerifiedEmailDomain` `SetVerifiedEmailDomainRule`
`PolicySettings`	`NewPolicyTemplate` `DeletePolicyTemplate` `ModifyPolicyTemplate`
`SubscriptionChange`	`ModifySubscription`
`CustomDomainLinkSettings`	`EnableCustomDomainLinks` `DisableCustomDomainLinks`

Common event fields

Fields that appear in the table below are common to all Tresorit event schemas. Any guideline specified in the exact subschemas (e.g. Authentication) overrides the Common event schema for the field. For example, a field might be optional in general, but mandatory for a specific schema.

Field	Class	Type	Possible values / Format	Description
EventSchemaVersion	Mandatory	String	`{major}.{minor}.{patch}`	We use SemVer for versioning schema variants. Each time a schema is edited, a new version is created, but the original schema remains intact for future use. example: `1.0.0`
EventType	Mandatory	Enumerated	`Authentication` `DomainUserManagement` `UserActivity` `AdminActivity`	Describes the operation reported by the record.
EventSubType	Mandatory	Enumerated (defined for each event type)	Value depends on the EventType field.	Describes a subdivision of the operation reported in the `EventType` field. Each event type schema (based on the `EventType` field) documents the list of values valid for this field.
EventTimestamp	Mandatory	Datetime	`{ISO-8601 formatted timestamp}`	The time the event was generated by the reporting device. example: `2020-03-17T23:49:31.000Z`
EventResult	Mandatory	Enumerated	`Success` `Failure` `Partial`	Result of the event.
EventResultDetails	Recommended	Dynamic (defined for each event type)		Each schema (based on the `EventSubType` and `EventResult` field) documents the list of values valid for this field.
ActorUserId	Recommended	String	`{uuid_v4}`	Unique identifier of the user. example: `1747c909-dd63-468d-aeb4-4ba5a70173a2`
ActorUserEmail	Mandatory	String	`{email address}`	Email of the user. example: `eve.barrows@tresorit.com` (Contains support@tresorit.com if action was performed by Tresorit Support. In this case all other actor user related fields are empty.)
ActorUserFirstName	Recommended	String	`{first name}`	First name of the user. example: `Eve`
ActorUserLastName	Recommended	String	`{last name}`	Last name of the user. example: `Barrows`
ActorUserRole	Recommended	Enumerated	`Owner` `Co-Owner` `Administrator` `Member`	Set of permissions for actions available for the actor user.
ActorSessionId	Recommended	String	`[a-z0-9]{64}`	The logged in user’s unique session identifier. `SHA256("TresoritSIEM" + {SessionId})` example: `SHA256("TresoritSIEM" + "RpIs6SFt72x46p48Nb1YtRA1Rc8NuLdW12yrjEgZpp2u7NidEZ1yVI2BiSE7FarZ")` = `25ba12ad6de1f7eda632e03ad6854646d01e688c00f25d20a24ed126e74cf27d`
ActorUserDomainId	Recommended	String	`{uuid_v4}`	Domain GUID
ActorUserDomainName	Recommended	String		Organisation name of the subscription domain.
ActorUserIsExternal	Mandatory	Bool	`true` `false`	`true` if the user is not part of the subscription domain to which the SIEM event log belongs
ActorDeviceName	Recommended	String	`{device name}`	Name of the device or web session from which the event originates. examples: `bp1-mobosx-4159` `Chrome on Mac`
ActorDeviceId	Recommended	String	`[a-zA-Z0-9]{32}`	The unique identifier of the device. example: `wQeJ7fGGrIb3DyZhlha3rtw29hdakv88`
ActorDeviceType	Recommended	Enumerated	`Web` `NativeDesktop` `NativeMobile`	Event originates from: `Web`: https://web.tresorit.com `NativeDesktop`: Tresorit for Windows Tresorit for MacOs Tresorit for Linux `NativeMobile`: Tresorit for Android Tresorit for iOS
ActorDevicePlatform	Recommended	Enumerated	Device OS: `Windows` `macOS` `iOS` `Android` `Linux`	Platform name of the device which from the event originates.
ActorDeviceIpAddress	Recommended	IP address	`{ipv4}`	IP address of the device from which the event originates. Example: `45.21.42.12`
ClientAgent	Recommended	String	`{ClientVersionNumber}({ClientType}; {ClientId})`	Tresorit specific client agent information. Parameters: `ClientVersionNumber`: `A.B.C.D` `ClientType`: `Web-Client-JS-Release` `Linux-Desktop-x64-Release` etc. ClientId: `[A-Z0-9]{40}` examples: `3.16.302.0 (Web-Client-JS-Release; 038AB8D5A77B6821125B7DE360F1A5A8CA9CDF31)` `4.10.8.3220 (Linux-Desktop-x64-Release; 038AB8D5A77B6821125B7DE360F1A5A8CA9CDF31)`
HttpUserAgent	Recommended	String	`User-Agent: {BrowserInformation} ({SystemInformation}) {platform} ({platform-details}) {extensions}`	HTTP user agent used in the original backed request. Web client example: `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36` Native client example: `Tresorit/3.5.2441.3270 (MacOSX-Desktop-ARM64-Release; 12FA7074ABDE9653597B8D18AA8BB8A478016343)`
GeolocationCountry	Recommended	String		Approximate location* based on IP address from which the event originates. example: `Canada` * The accuracy of geolocation may vary.
GeolocationRegion	Recommended	String		Approximate location* based on IP address from which the event originates. example: `Quebec` * The accuracy of geolocation may vary.
GeolocationCity	Recommended	String		Approximate location* based on IP address from which the event originates. example: `Montreal` * The accuracy of geolocation may vary.
GeolocationLongitude	Recommended	Longitude		Latitude and longitude are angles that uniquely define a place* on Earth. example: `19.040236` * The accuracy of geolocation may vary.
GeolocationLatitude	Recommended	Latitude		Latitude and longitude are angles that uniquely define a place* on Earth. example: `47.497913` * The accuracy of geolocation may vary.
AdditionalFields	Optional	Dynamic		Extra information about the event in custom JSON format.

Authentication event fields

Field	Class	Type	Possible values / Format	Description
EventSubType	Mandatory	Enumerated	`Login` `Logout` `DeviceRegister` `DeviceRevoke` `DomainVerifiedSignup` `SignupViaInvitation`	Describes a subdivision of the operation `Authentication`. Each schema (based on the `EventType` field) documents the list of values valid for this field.
EventResultDetails	Recommended	Enumerated	`WrongPassword` `IpPolicyConflict` `ClientLocationPolicyConflict` `ClientPlatformPolicyConflict` `UserIsDisabledByPolicy` `ServiceUnavailableInCountry` empty if EventResult is `Success`	Additional information about the result of the `Authentication` event.
LoginMethod	Optional	Enumerated	`Password` `TwoFactor` `Sso`	The authenticate method used by the user. Mandatory if the `EventSubType` is `Login`.
RevokeMode	Optional	Enumerated	`CertRevoke` `CertRevokeWithDeviceWipe` (best effort)	Whether or not to delete synchronized folders and files from the device. Mandatory if the `EventSubType` is `DeviceRevoke`.
TargetDeviceName	Optional	String		Name of the device being registered or revoked. Mandatory if the `EventSubType` is `DeviceRegister` or `DeviceRevoke`.
TargetDeviceId	Optional	String		Unique identifier of the device being registered or revoked. Mandatory if the `EventSubType` is `DeviceRegister` or `DeviceRevoke`.
TargetDeviceType	Optional	Enumerated	`Web` `NativeDesktop` `NativeMobile`	Type of the device being registered or revoked. Mandatory if the `EventSubType` is `DeviceRegister` or `DeviceRevoke`. `Web`: Web Access - Tresorit `NativeDesktop`: Tresorit for Windows Tresorit for MacOs Tresorit for Linux `NativeMobile`: Tresorit for Android Tresorit for iOS
TargetDevicePlatform	Optional	Enumerated	Device OS: `Windows` `MacOs` `IOs` `Android` `Linux`	Platform name of the target device.

UserActivity event fields

Field Class Type Possible values/Format Description

EventSubType

Mandatory

Enumerated

PasswordChange
TwoFactorEnable
TwoFactorDisable
TwoFactorOptionConfig
DomainInviteAccept
DomainInviteDecline
AdvancedControlAccept

Describes a subdivision of the operation User.

Each schema (based on the EventType field) documents the list of values valid for this field.

* These properties will not be filled in case of a normal PasswordChange: ActorDevicePlatform, ActorSessionId, ActorDeviceName, ActorDeviceId, ActorDeviceType

EventResultDetails

Recommended

String

We use the AdditionalFields field instead.

AdminActivity event fields