Microsoft Sentinel Integration¶

Deploy WitFoo detection rules and dashboards to Microsoft Sentinel using ARM templates.

Prerequisites¶

• Microsoft Sentinel workspace (Log Analytics)
• WitFoo Conductor with artifact-exporter configured to send to Sentinel
• Azure CLI or portal access with Contributor role on the resource group
• Data flowing to WitFoo_CL custom log table

Architecture¶

graph LR
    A[WitFoo<br/>Conductor] -->|Data Connector<br/>or Log Analytics API| B[Log Analytics<br/>Workspace]
    B --> C[WitFoo_CL<br/>Custom Table]
    C --> D[Analytics Rules<br/>55 KQL rules]
    C --> E[Workbooks<br/>3 ARM templates]

The artifact-exporter sends events to a Log Analytics workspace. Sentinel applies the _CL suffix to the custom table and field suffixes based on type: _s (string), _d (double), _t (datetime), _b (boolean).

Step 1: Deploy Analytics Rules¶

The 55 scheduled analytics rules are packaged as a single ARM template.

az deployment group create \
  --resource-group <your-rg> \
  --template-file sentinel/analytics_rules.json \
  --parameters workspaceName=<your-workspace>

New-AzResourceGroupDeployment `
  -ResourceGroupName <your-rg> `
  -TemplateFile sentinel/analytics_rules.json `
  -workspaceName <your-workspace>

All 55 rules are deployed disabled by default. Enable rules individually:

1. Navigate to Sentinel → Analytics → Active rules
2. Filter by prefix WitFoo -
3. Select rules to enable → Enable

Rule Properties¶

Step 2: Deploy Workbooks¶

Three workbooks provide operational dashboards:

Deploy each workbook:

az deployment group create \
  --resource-group <your-rg> \
  --template-file sentinel/workbooks/witfoo_network_overview.json \
  --parameters workspaceName=<your-workspace>

az deployment group create \
  --resource-group <your-rg> \
  --template-file sentinel/workbooks/witfoo_security_alerts.json \
  --parameters workspaceName=<your-workspace>

az deployment group create \
  --resource-group <your-rg> \
  --template-file sentinel/workbooks/witfoo_attack_coverage.json \
  --parameters workspaceName=<your-workspace>

KQL Field Naming¶

Sentinel appends type suffixes to custom log fields. Map WitFoo's camelCase fields to their Sentinel equivalents:

WitFoo_CL
| extend techniques = parse_json(attackTechniqueIDs_s)
| mv-expand techniques
| summarize count() by tostring(techniques)

KQL Query Examples¶

Recent High-Severity Alerts¶

WitFoo_CL
| where severity_s in ("high", "critical")
| where TimeGenerated > ago(1h)
| project TimeGenerated, streamName_s, clientIP_s, serverIP_s, severity_s, artifactName_s
| order by TimeGenerated desc
| take 100

Top ATT&CK Techniques¶

WitFoo_CL
| where isnotempty(attackTechniqueIDs_s)
| extend techniques = parse_json(attackTechniqueIDs_s)
| mv-expand techniques
| summarize count() by tostring(techniques)
| order by count_ desc
| take 25

Network Traffic by Protocol¶

WitFoo_CL
| where isnotempty(protocol_s)
| summarize
    TotalBytes = sum(totalBytes_d),
    Connections = count()
    by protocol_s
| order by TotalBytes desc

Troubleshooting¶

WitFoo_CL
| take 10