Integrate Tresorit with Microsoft Sentinel

Available for ☑️
Plan: Enterprise
Role: Owner

Prerequisites

• An Azure subscription with sufficient quota to create Log Analytics resources.
• Permission to create an Entra ID app registration (typically the Application Developer role or higher).
• Owner or User Access Administrator role on the resource group where the Data Collection Rule (DCR) will be created. This is required to complete the role assignment.
• The Tresorit-provided DCR schema document or sample event JSON.

Additional information and limitations

• Tresorit events are provided in a custom format, not ASIM.
• Some actions may be performed by Tresorit Support at the customer's request. In these cases, the ActorUserEmail field is set to support@tresorit.com, while all other actor-related fields are left empty.
• Tresorit does not store these logs long-term. We recommend storing them in Microsoft Sentinel or another dedicated log management solution.

1. Create a Log Analytics workspace

1. Azure portal → search for Log Analytics workspaces → Create
2. Fill in:

   • Subscription and Resource group: Any

     ℹ️ Consider using a dedicated resource group (e.g. rg-tresorit-siem) so your SIEM resources are easy to manage as a unit.

   • Name: For example, ws-tresorit-siem

   • Region: Choose the region you'll use for all resources.

     ⚠️ Choose an Azure region up front and use it for every resource created below (workspace, DCE, DCR, and custom table). Cross-region setups either fail outright (DCE ↔ DCR) or add latency.

3. Click Review + create → Create
4. Wait for the deployment to complete.

2. Enable Microsoft Sentinel on the Log Analytics workspace

1. Azure portal → search for Microsoft Sentinel → Create (or Add)
2. Select the ws-tresorit-siem workspace you created.
3. Click Add.
4. Queries against TresoritEvents_CL are available in both the workspace's Logs view and Microsoft Sentinel's hunting and analytics tools.

3. Create a Data Collection Endpoint (DCE)

The DCE is the public ingestion endpoint that Tresorit sends events to.

1. Azure portal → Monitor → Data Collection Endpoints → Create
2. Fill in:
   • Subscription and Resource group: For example, rg-tresorit-siem
   • Endpoint name: For example, dce-tresorit-siem
   • Region: Use the same region as in Step 1
3. Click Review + create → Create

4. Open the DCE → Overview

   • Capture #1: DCE URI, shown as Logs Ingestion under the Endpoints section.

   ℹ️ Example: https://dce-tresorit-siem-abc1.westeurope-1.ingest.monitor.azure.com

4. Create a custom table and a Data Collection Rule (DCR)

The portal creates the custom table and the Data Collection Rule (DCR) together.

1. Open the Log Analytics workspace → Tables
2. Click Create → New custom log (DCR-based)
3. Table name: TresoritEvents (Azure auto-appends _CL, giving final name TresoritEvents_CL)
4. Data collection rule → select Create new data collection rule
   • Name: For example, dcr-tresorit-siem
   • Subscription / Resource group / Region: Use the same values as in Step 1
5. Data collection endpoint: Select the DCE created in Step 3 (dce-tresorit-siem)

6. Click Next, then upload a sample JSON payload that matches the Tresorit event schema. The portal uses the sample to infer the initial schema:

   [   {     "EventSubType": "SIEMEnable",     "TimeGenerated": "1970-01-01T00:00:00.0000000+00:00",     "SchemaVersion": "2.0.0",     "ActorUserEmail": "email@example.com",     "ActorUserIsExternal": false,     "ActorDetails": {},     "EventType": "AdminActivity",     "EventTimestamp": "1970-01-01T00:00:00.0000000+00:00",     "EventResult": "Success",     "EventData": {},     "Location": {}   } ]
7. Adjust the inferred schema if needed:
   • The table must include a TimeGenerated column (datetime).
     If the sample has TimeCreatedIso8601, add a transformation: source | extend TimeGenerated = todatetime(TimeCreatedIso8601).
   • Verify all expected event fields are present (e.g. EventType, EventSubType, ActorUserEmail, etc.).
8. Click Create.
   • Capture #2: Custom table name, TresoritEvents_CL

5. Capture the DCR stream name and immutable ID

Extract the following values from the DCR.

1. Open the DCR → in the upper-right corner, click JSON View

2. Find the properties.dataFlows[].streams array and the properties.streamDeclarations keys. Both reference the stream name.

   ℹ️ Example: Custom-TresoritEvents (or Custom-TresoritEvents_CL depending on how it was created)

3. Find properties.immutableId.

   ℹ️ Example: dcr-1a2b3c4d5e6f7g8h9i0j...

   • Capture #3: Stream Name, without the Custom- prefix
   • Capture #4: DCR Immutable ID, the dcr-... string

6. Register an Entra ID application

Tresorit uses this app to authenticate when sending events.

1. Azure portal → Microsoft Entra ID → App registrations → New registration
2. Fill in:
   • Name: For example, Tresorit SIEM Integration
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI: Leave blank (not needed for the client-credentials flow used by Tresorit)
3. Click Register.
4. On the Overview page of the new application:
   • Capture #5: Tenant ID, labeled Directory (tenant) ID
   • Capture #6: Client ID, labeled Application (client) ID

7. Generate a client secret

1. Open the App registrations → Certificates & secrets → Client secrets → New client secret
2. Description: For example, Tresorit SIEM <current_year>

3. Expires: Select the longest available duration (24 months is the current portal maximum)

   ⚠️ Set a calendar reminder for 30 days before the secret expires. When it expires, log delivery stops until you replace it.

4. Click Add.
5. Copy the Value (not the Secret ID) immediately. It is shown only once, and if you don't copy it now, you'll need to create a new client secret.
   • Capture #7: Client Secret, the Value

8. Assign the Monitoring Metrics Publisher role on the DCR

Assign the role on the DCR, not on the workspace, resource group, or subscription.

1. Open the DCR → form the left menu, select Access control (IAM)
2. Click Add → Add role assignment
3. Role tab: select Monitoring Metrics Publisher
4. Members tab:
   • Assign access to: User, group, or service principal
   • Click Select members, then select your app registration.
5. Click Review + assign → Assign

ℹ️ Role assignments can take up to 5 minutes to take effect. If you receive a 403 error, see Troubleshooting.

9. Enter the captured values in Tresorit Admin Center

1. Tresorit Admin Center → Settings → SIEM integration → Enable

2. Enter the following values:

   Field in Tresorit	Capture
   Data Collection Endpoint	#1 (DCE URI)
   Data Collection Rule ID	#4 (DCR Immutable ID)
   Stream Name	#3
   Tenant ID	#5
   Client ID	#6
   Client Secret	#7

3. Select the event groups to forward, then click Save.

4. Tresorit sends a probe event to verify the configuration. A success message should appear within a few seconds.

   ℹ️ If the verification fails, see Troubleshooting.

10. Verify in Microsoft Sentinel

1. Open the Log Analytics workspace → Logs

2. Run:

   TresoritEvents_CL
   | where TimeGenerated > ago(15m)
   | take 50

3. The probe event should appear, along with any events generated after the configuration is complete.

   ℹ️ Ingestion typically takes 2-5 minutes end-to-end. If no events appear after 10 minutes, check the SIEM settings in your Tresorit Admin Center.

Troubleshooting