Ingest Microsoft Sentinel Security Alerts into Dynatrace

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook will ingest Microsoft Sentinel Security Alerts into Dynatrace.

Attribute	Value
Type	Playbook
Solution	Dynatrace
Source	View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azuresentinel`	Managed	1	0
`keyvault`	Managed	1	1
`http`	Built-in	0	1

Action parameters (URLs, paths, function IDs)

`keyvault` (Managed)

Action	Method	Endpoint	Other
Get_Dynatrace_Access_Token	get	`/secrets/@{encodeURIComponent('DynatraceAccessToken')}/value`	—

`http` (Built-in)

Action	Method	Endpoint	Other
Ingest_Dynatrace_Log_Entries	POST	`https://@{parameters('Tenant')}/api/v2/logs/ingest`	—

Additional Documentation

📄 Source: Ingest-DynatraceMSSentinelSecurityAlerts/readme.md

Ingest-DynatraceMSSentinelSecurityAlerts

author: Dynatrace

This playbook will Report all Microsoft Sentinel Security Alerts to Dynatrace. You need a valid Dynatrace tenant with Application Security enabled, you will also need to install the relevant Microsoft Sentinel Connectors which would generated security alerts consumed by this playbook. To learn more about the Dynatrace platform Start your free trial

** Prerequisites **

Follow these instructions to generate a Dynatrace access token, the token should have Ingest logs (logs.ingest) scope.
[Important step]Store the Dynatrace Access Token as a secret in Azure Key vault and provide the key vault name during playbook deployment, by convention the secret name should be 'DynatraceAccessToken'.

** Post Install Notes:**

The Logic App uses a Managed System Identity (MSI).

Assign RBAC 'Microsoft Sentinel Reader' role to the Logic App at the Resource Group level of the Log Analytics Workspace.

Assign access policy on key vault for Playbook to fetch the secret key

Initial Setup

A Microsoft Sentinel playbook is utilized by automation rules, therefore to automatically trigger this playbook you must setup a new automation rule. If you have not set permissions yet, review here

Basic steps for setup of the playbook and automation rule are as follows :

Go to the Automation blade in Microsoft Sentinel.
Create a new playbook from the 'Ingest Microsoft Sentinel Security Alerts into Dynatrace' playbook template

KeyvaultName: The name of the keyvault created as pre-requisite
DynatraceTenant: xyz.dynatrace.com

Create a new automation rule

Name : Ingest Microsoft Sentinel Security Alerts into Dynatrace
Trigger : When alert is created
Conditions : If Analytic rule name contains 'Dynatrace Application Security - Attack detection'
Actions : Run playbook IngestDynatraceSentinelSecurityAlerts