Microsoft Sentinel - High-Risk User API Integration Using Logic Apps and RSA OAuth Client - RSA Ready Implementation Guide
10 days ago
Originally Published: 2020-10-15

This article describes the high-risk user API integration using Logic Apps and RSA OAuth Client.

    

Configure RSA

Generate API Key (Using Legacy API Keys)

  1. Sign in to Cloud Administration Console and go to Platform > API Access Management.
  2. Under the Legacy API Keys section, expand Administration API Keys and click ADD.
  3. In the Administrator Role list, select Super Administrator and click Save & Download.
  4. Download the RSA ID Plus Admin Rest API Download file (v2.8.0 and later).
  5. Use the function in GenerateJWTFromAdminApiKeySample class to generate the Legacy API Access token with the help of the downloaded API Key file.
  6. Use the JWT as bearer token in the requests.
    For more details, refer to Authentication for the Cloud Administration APIs.

  

Generate API Key (Using OAuth API Client)

  1. Click Platform > API Access Management.
  2. Click Add API Client against OAuth Clients.
  3. In the Client Type list, choose Admin API and click Next.
  4. Click Generate Key Pair.
    The Key Pair Generator window appears.
  5. In the Public Key section, click Autofill.
  6. Click Download and Finish.
  7. In the Access Token Lifetime field, enter a value in minutes and click Next Step.
  8. On the Permissions page, expand the Audit section and select the rsa.audit.admin and rsa.audit.user checkboxes.
  9. Click Save and Finish and click Publish Changes.
  10. Download the RSA ID Plus Admin Rest API Download file (v2.8.0 and later).
  11. Install the Python app (version 3.14) and add the location of Python to the environment path.
  12. Execute/install the following prerequisites (in cmd prompt).

Pip install setuptools
Python.exe  -m pip install  --upgrade pip
cd \rsa-securidaccess-rest-client-sdk-2.8.0\src\main\python\admin_api_cli
pip install python-jose
pip install python-dateutil
pip3 install requests

  1. Execute the following command to generate the token.

python.exe admin_api_cli -oauth -f <local path to downloaded key> -o generateToken -oiurl <oauth issue URL> -ocid <oauth client ID>   -ocp "rsa.user.risky.manage,rsa.user.risky.read"

    • local path to downloaded key: Local path to the downloaded jwk key file
    • oauth issue URL: Copied from the CAS console
    • oauth client ID: Copied from the CAS console

Note: Run python admin_api_cli –help from \rsa-securidaccess-rest-client-sdk-2.8.0\src\main\python\admin_api_cli for more information on the options available.

  1. Use the token generated as the bearer token for the requests. 


          


Create Access Policy for High-Risk Users


  1. Navigate to Access > Policies.
  2. Click Add a Policy.
  3. Give a name to the policy and click Next Step.
  4. Select the identity source for the users and click Next Step.
  5. Enable or disable primary authentication, and then click Next Step.
  6. Under Access Details, select Conditional and click Add.
  7. In the Attributes drop-down list, select High-Risk User List and select the Value as True. 
  8. Select an Action of your choice. 
  9. Click Save and click Save and Finish.
  10. Click Publish Changes.


          


Configure Microsoft


Perform the following steps to configure Microsoft Sentinel as a High-Risk User API client to CAS.


     


Custom Tables


Create a custom table by following the steps in the Microsoft Sentinel as SIEM for RSA Admin Logs Using Logic Apps - RSA Ready Implementation Guide. Make changes to the columns as per your requirement. For more details, refer to the Microsoft documentation. 


    


Logic App


  1. Log in to the Microsoft Azure tenant and select Logic Apps.
  2. Click Create and add the following details (We have selected the Consumption Multi-tenant plan) and click Review + create > create.

    1. Resource Group: Select the resource group.
    2. Region: Select your region (We have selected East US, and we use the same region across our deployments. For multi-region deployments, refer to the Microsoft documentation to confirm any changes.)
    3. Enable log Analytics: Select Yes.
    4. Log Analytics workspace: Select your log analytics workspace.
    5. Workflow Type: Stateful
    

  3. Select the Logic App and then go to Development Tools > Logic app designer in the left pane.
  4. Design a workflow based on your requirements. We have designed a workflow as follows:

    1. Initialize the variable action.

      1. We have used an array to store the query result of the custom table.
      2. Multiple string variables: We use multiple string variables, which will be used to process the query result list. We need user emails followed by a comma(,) in the final processed string.
      3. Use a string variable named addActionJSONString with the initial value as follows:
      

    





{"action": "add",




"users": [


  1. 

    1. Run query and list results action of Azure Monitor Logs. In the Query field, provide your query.
      AdminUserName returns a list of user emails that will be added to the high-risk user list. 
    2. For each action, append the query result to the array. 
    3. Process the array using the String and the replace function. 
    4. Append the final list of user emails separated by a comma (,) to addActionJSONString and append ” ]} “ to this.
    5. (Optional) Use the Compose action for logging purposes.
    6. Create an HTTP action and provide the following values:

      1. URL: https://<CAS tenant URL>/AdminInterface/restapi/v1/users/highrisk
      2. Method: PUT
      3. Headers:

        • Content-Type: application/json
        • Authorization :Bearer <token generated from RSA>
        

      4. Body: json(variables(‘addActionJSONString’)) where addActionJSONString is the string variable storing the processed final string.

        This populates the body with the JSON equivalent of the final processed string.
      

    

  2. Save the workflow and run it for testing. After a successful run, the High-Risk User attribute for users must be updated to Yes in CAS.




Note: If you are using the workflow to remove users from the high-risk user list, change the initial value of addActionJSONString to have remove instead of add. For more information, refer to Cloud Administration Add/Remove High-Risk User API.
To get the list of high-risk users, refer to Cloud Administration Retrieve High-Risk User List API Version 2. 




 


The configuration is complete.
Related Articles
Trending Articles
Don't see what you're looking for?