Microsoft Azure Sentinel: Integration Guide

This guide provides instructions for installing and configuring the Bitsight–Microsoft (MS) Azure Sentinel integration.

Access to and use of the Bitsight for Microsoft Sentinel Connector is subject to the Bitsight for Microsoft Sentinel Connector Terms of Service (the “Bitsight Terms”) and any other terms of service or use noted herein.

Navigation

• Installing the Bitsight Integration
• Installing the Data Connector
• Installing Parsers
• Viewing the Bitsight Workbook
• Installing Analytic Rules

Installing the Bitsight Integration

1. Log in to the Azure portal and search Microsoft Sentinel.
2. Select your workspace, then open the Content Hub and search for Bitsight. 
3. Select Bitsight from the results to open a side panel
4. Select Install.
5. On the next screen, select Create.
6. Select a workspace and resource group, then select Review + create.
7. Review your selections, then select Create. This installs the Bitsight integration in your instance of MS Sentinel.

Installing the Data Connector

1. Open the Content Hub and search for Bitsight.
2. Select Bitsight, then select the Manage button. This opens a list of data connectors, workbooks, playbooks, analytic rules, and parsers included in the connector.
3. Select the data connector, then select Open connector page.
4. Review the instructions, then select Deploy to Azure. This opens the custom deployment page.
5. Fill in the required Project and Instance details. This includes information such as:
   1. Resource group
   2. Workspace ID
   3. Workspace Key
   4. Your Bitsight API_token
6. Select the Review + create button.
7. Select the Create button. Your custom template is now deployed; you can check its status from the Custom deployment page.

Installing Parsers

1. Select the parser you want to deploy. This opens a side panel.
2. Select Load the function code to open the Log Analytics Workspace.
3. Save the parser as a function.
   1. Locate the table name (highlighted below).
   2. Select the Save dropdown, then select Save as function
   3. Enter the function name that corresponds to your current parser’s table name. Table names and function name equivalents are listed below.
      • BitSightAlerts Parser → BitSightAlerts
      • BitSightBreaches Parser → BitSightBreaches
      • BitSightCompanyDetails Parser → BitSightCompanyDetails
      • BitSightCompanyRatings Parser → BitSightCompanyRatings
      • BitSightDiligenceHistoricalStatistics Parser → BitSightDiligenceHistoricalStatistics
      • BitSightDiligenceStatistics Parser → BitSightDiligenceStatistics
      • BitSightFindingsData Parser → BitSightFindingsData
      • BitSightFindingsSummary Parser → BitSightFindingsSummary
      • BitsightGraphData Parser → BitSightGraphData
      • BitSightIndustrialStatistics Parser → BitSightIndustrialStatistics
      • BitSightObservationStatistics Parser → BitSightObservationStatistics
      • BitSightWorkFromHome Parser → BitSightWorkFromHome
   4. Enter a legacy category. You may enter whatever you choose as a legacy category, but the field must not be empty.
   5. Select the Save button. 
4. Repeat this process for all parsers.

Viewing the Bitsight Workbook

Workbooks provide a flexible canvas for data analysis and the creation of rich visual reports within the Azure portal.

1. Open Microsoft Sentinel.
2. Open the Workspace where the Bitsight solution is installed.
3. In the Threat Management section, select Workbooks.
4. Select the Templates tab.
5. Select the Bitsight Workbook. This opens a side panel.
6. Scroll to the bottom of the side panel and select View Template.

Installing Analytic Rules

The Bitsight connector includes ten analytic rules users can install to:

• Search for specific events or sets of events across your environment.
• Alert you when certain even thresholds or conditions are reached.
• Generate incidents in Sentinel.

The Bitsight connector includes the following analytic rules that can be installed:

• Alert when there is a drop of 10% or more.
• Alert when there is a new alert from Bitsight.
• Alert whenever there is a Compromised Systems finding in Bitsight.
• Alert whenever there is a Diligence finding in Bitsight.
• Alert whenever there is a drop in the headline rating.
• Alerts for a new breach.
• Alerts when there are new Bad Open Ports discovered.
• Alerts when there are new Botnet Infections.
• Alerts when there is a new finding for Patching Cadence.

1. Open the Content Hub and search for Bitsight.
2. Select Bitsight, then select the Manage button.
3. Select the rule you want to deploy, then select the Configuration button.
4. On the next screen, select the Rule templates tab.
5. Select the rule you want to deploy, then select Create rule.