Apps
Microsoft Sentinel
Interpres Application - Microsoft Sentinel
- Type: SIEM/Data Lake
- Vendor: Microsoft
This app integrates with Microsoft Sentinel to get Detections, Alerts, and Telemetry
- Search for App registrations

- Click + New registration

- Enter "Interpres" for the app name. Leave the other defaults (Single-tenant, no Redirect URI). Click "Register".

- Copy the application (client) ID and the Directory (tenant) ID over to the Interpres integration setup page

- Click API permissions then Add a permission

- Click APIs my organization uses then search Log Analytics and select Log Analytics API

- Select Application Permissions then Data.Read and Add permission

- Click Grant admin consent for YOUR_TENANT

- Click Certificates & Secrets then New client secret

- Enter "Interpres" for the description and choose "12 months".

- Copy the client secret "Value" over to the Interpres integration setup.
- Go to your Microsoft Sentinel workspace, click Settings then click Workspace settings

- Copy the Subscription ID, Resource Group, and Workspace Name to the Interpres integration setup.

- Click Access control (IAM) then Role assignments and click Add

- Click Role assignment then select Reader and click Next

- Select User, group, or service principal then click Select members

- Choose the app you created in step 4, click Select , then Next, and finally Review + assign
- Tenant ID: Tenant ID
- Client ID: Client ID
- Client Secret: Client Secret
- Subscription ID: Subscription ID
- Resource Group Name: Resource Group Name
- Workspace Name: Workspace Name
Check there is connectivity (green light) in the integration created.
- Get Available Telemetry: Returns a list of telemetry identifiers with their current status. It reads MS Sentinel tables by querying LogAnalytics using the following query:
If CommonSecurityLog is found this query will also be excecuted to get Vendor/Product
- Get Detections: Returns a list of detections (MS Sentinel Rules). When you create detection rules in Sentinel you can map them to MITRE techniques, Interpres will read those mappings when pulling the alerts. See Sentinel docs on how to map techniques to rules: https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom#analytics-rule-wizardgeneral-tab
- Get Alerts: Gets the latest alerts (MS Sentinel incidents)