Azure Sentinel

This template is designed to monitor Microsoft Azure Sentinel by HTTP.

Available solutions

Zabbix version 8.0
Download

Azure Sentinel by HTTP

Overview

This template is designed to monitor Microsoft Azure Sentinel by HTTP. It works without any external scripts and uses the script item.

Requirements

Zabbix version: 8.0 and higher.

Tested versions

This template has been tested on:

  • Microsoft Azure workspaces with Sentinel

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

  1. Create an Azure service principal via the Azure command-line interface (Azure CLI) for your subscription.

    az ad sp create-for-rbac --name zabbix --role reader --scope /subscriptions/<subscription_id>

See Azure documentation for more details.

  1. Give the created principal the "Microsoft Sentinel Reader" role via the Azure command-line interface (Azure CLI).

    az role assignment create --assignee "zabbix" --role "Microsoft Sentinel Reader" --scope /subscriptions/<subscription_id>

  2. Link the template to a host.

  3. Configure the macros: {$AZURE.APP.ID}, {$AZURE.PASSWORD}, {$AZURE.TENANT.ID}, {$AZURE.SUBSCRIPTION.ID}, and {$AZURE.RESOURCE.ID}.

Macros used

Name Description Default
{$AZURE.SUBSCRIPTION.ID}

Microsoft Azure subscription ID.
{$AZURE.TENANT.ID}

Microsoft Azure tenant ID.
{$AZURE.APP.ID}

The App ID of Microsoft Azure.
{$AZURE.PASSWORD}

Microsoft Azure password.
{$AZURE.RESOURCE.ID}

Microsoft Azure scale set ID.
{$AZURE.DATA.TIMEOUT}

API response timeout.

 15s
{$AZURE.PROXY}

Sets the HTTP proxy value. If this macro is empty, then no proxy is used.
{$HTTP.TLS.VERIFY}

TLS certificate verification for script items: "none" - disabled, "peer" - verify the certificate chain and expiration, "full" - full verification. Any other value enables full verification. To override the setting for this template only, define the macro with the context "Azure Sentinel", e.g. {$HTTP.TLS.VERIFY:"Azure Sentinel"}.

 full
{$AZURE.SENTINEL.PERIOD}

The number of days during which to retrieve modified entities (incidents, alert rules, automation rules).

 30
{$AZURE.SENTINEL.INTERVAL}

The update interval for the script items that retrieve data from the API.

 10m
{$AZURE.SENTINEL.INCIDENTS.NEW}

The threshold for new incidents during the interval defined in the {$AZURE.SENTINEL.INTERVAL} macro. Can be used with context if needed (check the context values in relevant items).

 1
{$AZURE.SENTINEL.INCIDENTS.NEW:info}

The threshold for new informational severity incidents during the interval defined in the {$AZURE.SENTINEL.INTERVAL} macro.

 10
{$AZURE.SENTINEL.INCIDENTS.NEW:low}

The threshold for new low-severity incidents during the interval defined in the {$AZURE.SENTINEL.INTERVAL} macro.

 5
{$AZURE.SENTINEL.INCIDENTS.NEW:medium}

The threshold for new medium-severity incidents during the interval defined in the {$AZURE.SENTINEL.INTERVAL} macro.

 1
{$AZURE.SENTINEL.INCIDENTS.NEW:high}

The threshold for new high-severity incidents during the interval defined in the {$AZURE.SENTINEL.INTERVAL} macro.

 1

Items

Name Description Type Key and additional info
Get data

Gathers data from Azure Sentinel.

 Script azure.sentinel.data.get
Incidents: Total number

The total number of incidents.

 Dependent item azure.sentinel.incidents.total

Preprocessing

  • JSON Path: $.metrics.incidents.length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: Informational severity

The number of informational severity incidents.

 Dependent item azure.sentinel.incidents.info

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: Low severity

The number of low-severity incidents.

 Dependent item azure.sentinel.incidents.low

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: Medium severity

The number of medium-severity incidents.

 Dependent item azure.sentinel.incidents.medium

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: High severity

The number of high-severity incidents.

 Dependent item azure.sentinel.incidents.high

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: New

The number of new incidents.

 Dependent item azure.sentinel.incidents.new

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: Active

The number of active incidents.

 Dependent item azure.sentinel.incidents.active

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Incidents: Closed

The number of closed incidents.

 Dependent item azure.sentinel.incidents.closed

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Total number

The number of alert rules.

 Dependent item azure.sentinel.alert_rules.total

Preprocessing

  • JSON Path: $.metrics.alertRules.length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Enabled

The number of enabled alert rules.

 Dependent item azure.sentinel.alert_rules.enabled

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Disabled

The number of disabled alert rules.

 Dependent item azure.sentinel.alert_rules.disabled

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Informational severity

The number of informational severity alert rules.

 Dependent item azure.sentinel.alert_rules.info

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Low severity

The number of low-severity alert rules.

 Dependent item azure.sentinel.alert_rules.low

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Medium severity

The number of medium-severity alert rules.

 Dependent item azure.sentinel.alert_rules.medium

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: High severity

The number of high-severity alert rules.

 Dependent item azure.sentinel.alert_rules.high

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Microsoft security incident creation

The number of Microsoft security incident creation alert rules.

 Dependent item azure.sentinel.alert_rules.creation

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Scheduled

The number of scheduled alert rules.

 Dependent item azure.sentinel.alert_rules.scheduled

Preprocessing

  • JSON Path: $.metrics.alertRules[?(@.kind == "Scheduled")].length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Alert rules: Fusion

The number of fusion alert rules.

 Dependent item azure.sentinel.alert_rules.fusion

Preprocessing

  • JSON Path: $.metrics.alertRules[?(@.kind == "Fusion")].length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Automation rules: Total

The total number of automation rules.

 Dependent item azure.sentinel.automation_rules.total

Preprocessing

  • JSON Path: $.metrics.automationRules.length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Automation rules: On incidents

The number of automation rules that are triggered on incidents.

 Dependent item azure.sentinel.automation_rules.incidents

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Automation rules: On alerts

The number of automation rules that are triggered on alerts.

 Dependent item azure.sentinel.automation_rules.alerts

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Automation rules: Modify properties

The number of automation rules that modify an object's properties.

 Dependent item azure.sentinel.automation_rules.modify

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Automation rules: Run playbook

The number of automation rules that run a playbook on an object.

 Dependent item azure.sentinel.automation_rules.playbook

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Automation rules: Add incident task

The number of automation rules that add a task to an incident object.

 Dependent item azure.sentinel.automation_rules.add_incident

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Data connectors: Total

The total number of data connectors.

 Dependent item azure.sentinel.data_connectors.total

Preprocessing

  • JSON Path: $.metrics.dataConnectors.length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Data connectors: Enabled

The number of enabled data connectors.

 Dependent item azure.sentinel.data_connectors.enabled

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Data connectors: Disabled

The number of disabled data connectors.

 Dependent item azure.sentinel.data_connectors.disabled

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: Total

The total number of watchlists.

 Dependent item azure.sentinel.watchlist.total

Preprocessing

  • JSON Path: $.metrics.watchlists.length()

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: Canceled

The number of canceled watchlists.

 Dependent item azure.sentinel.watchlist.canceled

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: Failed

The number of failed watchlists.

 Dependent item azure.sentinel.watchlist.failed

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: Succeeded

The number of succeeded watchlists.

 Dependent item azure.sentinel.watchlist.succeeded

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: Deleting

The number of watchlists being deleted.

 Dependent item azure.sentinel.watchlist.deleting

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: Uploading

The number of watchlists being uploaded.

 Dependent item azure.sentinel.watchlist.uploading

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: In progress

The number of watchlists in progress.

 Dependent item azure.sentinel.watchlist.progress

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h
Watchlists: New

The number of new watchlists.

 Dependent item azure.sentinel.watchlist.new

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 1h

Triggers

Name Description Expression Severity Dependencies and additional info
Azure Sentinel: Informational severity incident total has increased.

The number of informational severity incidents has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.incidents.info)>={$AZURE.SENTINEL.INCIDENTS.NEW:info} and change(/Azure Sentinel by HTTP/azure.sentinel.incidents.total)>0 Info Manual close: Yes
Azure Sentinel: Low-severity incident total has increased.

The number of low-severity incidents has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.incidents.low)>={$AZURE.SENTINEL.INCIDENTS.NEW:low} and change(/Azure Sentinel by HTTP/azure.sentinel.incidents.total)>0 Warning Manual close: Yes
Azure Sentinel: Medium-severity incident total has increased.

The number of medium-severity incidents has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.incidents.medium)>={$AZURE.SENTINEL.INCIDENTS.NEW:medium} and change(/Azure Sentinel by HTTP/azure.sentinel.incidents.total)>0 Average Manual close: Yes
Azure Sentinel: High-severity incident total has increased.

The number of high-severity incidents has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.incidents.high)>={$AZURE.SENTINEL.INCIDENTS.NEW:high} and change(/Azure Sentinel by HTTP/azure.sentinel.incidents.total)>0 High Manual close: Yes
Azure Sentinel: New incident total has increased.

The number of new incidents has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.incidents.new)>={$AZURE.SENTINEL.INCIDENTS.NEW} and change(/Azure Sentinel by HTTP/azure.sentinel.incidents.total)>0 Info Manual close: Yes
Azure Sentinel: Incident become active.

The number of active incidents has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.incidents.active)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.incidents.total)=0 Info Manual close: Yes
Azure Sentinel: Alert rule total has changed.

The number of alert rules has changed.

 change(/Azure Sentinel by HTTP/azure.sentinel.alert_rules.total)<>0 Warning Manual close: Yes
Azure Sentinel: Alert rule was enabled.

The number of enabled alert rules has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.alert_rules.enabled)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.alert_rules.total)=0 Warning Manual close: Yes
Azure Sentinel: Alert rule was disabled.

The number of disabled alert rules has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.alert_rules.disabled)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.alert_rules.total)=0 Warning Manual close: Yes
Azure Sentinel: Automation rule total has changed.

The number of automation rules has changed.

 change(/Azure Sentinel by HTTP/azure.sentinel.automation_rules.total)<>0 Warning Manual close: Yes
Azure Sentinel: Data connector total has changed.

The number of data connectors has changed.

 change(/Azure Sentinel by HTTP/azure.sentinel.data_connectors.total)<>0 Warning Manual close: Yes
Azure Sentinel: Data connector was enabled.

The number of enabled data connectors has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.data_connectors.enabled)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.data_connectors.total)=0 Warning Manual close: Yes
Azure Sentinel: Data connector was disabled.

The number of disabled data connectors has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.data_connectors.disabled)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.data_connectors.total)=0 Warning Manual close: Yes
Azure Sentinel: Watchlist total has changed.

The number of watchlists has changed.

 change(/Azure Sentinel by HTTP/azure.sentinel.watchlist.total)<>0 Warning Manual close: Yes
Azure Sentinel: Watchlist was disabled.

The number of canceled watchlists has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.watchlist.canceled)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.watchlist.total)=0 Warning Manual close: Yes
Azure Sentinel: Watchlist has failed.

The number of failed watchlists has increased.

 change(/Azure Sentinel by HTTP/azure.sentinel.watchlist.failed)>0 and change(/Azure Sentinel by HTTP/azure.sentinel.watchlist.total)=0 Warning Manual close: Yes

Articles and documentation

+ Propose new article

Não encontrou a integração que vocá precisa?

Request custom integration

Zabbix integration team will develop custom integration based on your requirements and Zabbix best practices.

Request

Propose integration

Have you already developed high quality integration and want to submit to Zabbix integration repository?

Propose