You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/migration-arcsight-automation.md
+18-11Lines changed: 18 additions & 11 deletions
Original file line number
Diff line number
Diff line change
@@ -9,12 +9,12 @@ ms.date: 05/03/2022
9
9
10
10
# Migrate ArcSight SOAR automation to Microsoft Sentinel
11
11
12
-
Microsoft Sentinel provides Security Orchestration, Automation, and Response (SOAR) capabilities with [automation rules](automate-incident-handling-with-automation-rules.md) to automate incident handling and response, and [playbooks](tutorial-respond-threats-playbook.md) to run predetermined sequences of actions to response and remediate threats. This article discusses how to identify SOAR use cases, and how to migrate your ArcSight SOAR automation to Microsoft Sentinel.
12
+
Microsoft Sentinel provides Security Orchestration, Automation, and Response (SOAR) capabilities with [automation rules](automate-incident-handling-with-automation-rules.md) to automate incident handling and response, and [playbooks](tutorial-respond-threats-playbook.md) to run predetermined sequences of actions to respond to and remediate threats. This article discusses how to identify SOAR use cases, and how to migrate your ArcSight SOAR automation to Microsoft Sentinel.
13
13
14
14
Automation rules simplify complex workflows for your incident orchestration processes, and allow you to centrally manage your incident handling automation.
15
15
16
16
With automation rules, you can:
17
-
- Perform simple automation tasks without necessarily using playbooks. For example, you can assign, tag, incidents, change status, and close incidents.
17
+
- Perform simple automation tasks without necessarily using playbooks. For example, you can assign, tag incidents, change status, and close incidents.
18
18
- Automate responses for multiple analytics rules at once.
19
19
- Control the order of actions that are executed.
20
20
- Run playbooks for those cases where more complex automation tasks are necessary.
@@ -37,10 +37,10 @@ This section shows how key SOAR concepts in ArcSight translate to Microsoft Sent
37
37
|Step (in diagram) |ArcSight |Microsoft Sentinel |
38
38
|---------|---------|---------|
39
39
|1 |Ingest events into Enterprise Security Manager (ESM) and trigger correlation events. |Ingest events into the Log Analytics workspace. |
40
-
|2 |Automatically filter alerts for case creation. |Use [analytics rules](detect-threats-built-in#use-built-in-analytics-rules.md) to trigger alerts. Enrich alerts using the [custom details feature](surface-custom-details-in-alerts.md) to create dynamic incident names. |
41
-
|3 |Classify cases |Use [automation rules](automate-incident-handling-with-automation-rules.md). With automation rules, Microsoft Sentinel treats incidents according to the analytics rule that triggered the incident, and the incident properties that match defined criteria. |
42
-
|4 |Consolidate cases |You can consolidate several alerts to a single incident according to properties such as matching entities, alert details, or creation timeframe, using the alert grouping feature. |
43
-
|5 |Dispatch cases |Assign incidents to specific analysts using [an integration](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/automate-incident-assignment-with-shifts-for-teams/ba-p/2297549) between Microsoft Teams, Azure Logic Apps, and Microsoft Sentinel automation rules. |
40
+
|2 |Automatically filter alerts for case creation. |Use [analytics rules](detect-threats-built-in.md#use-built-in-analytics-rules) to trigger alerts. Enrich alerts using the [custom details feature](surface-custom-details-in-alerts.md) to create dynamic incident names. |
41
+
|3 |Classify cases.|Use [automation rules](automate-incident-handling-with-automation-rules.md). With automation rules, Microsoft Sentinel treats incidents according to the analytics rule that triggered the incident, and the incident properties that match defined criteria. |
42
+
|4 |Consolidate cases.|You can consolidate several alerts to a single incident according to properties such as matching entities, alert details, or creation timeframe, using the alert grouping feature. |
43
+
|5 |Dispatch cases.|Assign incidents to specific analysts using [an integration](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/automate-incident-assignment-with-shifts-for-teams/ba-p/2297549) between Microsoft Teams, Azure Logic Apps, and Microsoft Sentinel automation rules. |
44
44
45
45
## Map SOAR components
46
46
@@ -62,10 +62,10 @@ While most of the playbooks that you use with Microsoft Sentinel are available i
62
62
You typically build your custom logic app using the Azure Logic App Designer feature. The logic apps code is based on [Azure Resource Manager (ARM) templates](../azure-resource-manager/templates/overview.md), which facilitate development, deployment and portability of Azure Logic Apps across multiple environments. To convert your custom playbook into a portable ARM template, you can use the [ARM template generator](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/export-microsoft-sentinel-playbooks-or-azure-logic-apps-with/ba-p/3275898).
63
63
64
64
Use these resources for cases where you need to build your own playbooks either from scratch or from existing templates.
65
-
-[Automate incident handling in Azure Sentinel](automate-incident-handling-with-automation-rules.md)
66
-
-[Automate threat response with playbooks in Azure Sentinel](automate-responses-with-playbooks.md)
67
-
-[Tutorial: Use playbooks with automation rules in Azure Sentinel](tutorial-respond-threats-playbook.md)
68
-
-[How to use Azure Sentinel for Incident Response, Orchestration and Automation](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397)
65
+
-[Automate incident handling in Microsoft Sentinel](automate-incident-handling-with-automation-rules.md)
66
+
-[Automate threat response with playbooks in Microsoft Sentinel](automate-responses-with-playbooks.md)
67
+
-[Tutorial: Use playbooks with automation rules in Microsoft Sentinel](tutorial-respond-threats-playbook.md)
68
+
-[How to use Microsoft Sentinel for Incident Response, Orchestration and Automation](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397)
69
69
-[Adaptive Cards to enhance incident response in Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-microsoft-teams-adaptive-cards-to-enhance-incident/ba-p/3330941)
70
70
71
71
## SOAR post migration best practices
@@ -75,4 +75,11 @@ Here are best practices you should take into account after your SOAR migration:
75
75
- After you migrate your playbooks, test the playbooks extensively to ensure that the migrated actions work as expected.
76
76
- Periodically review your automations to explore ways to further simplify or enhance your SOAR. Microsoft Sentinel constantly adds new connectors and actions that can help you to further simplify or increase the effectiveness of your current response implementations.
77
77
- Monitor the performance of your playbooks using the [Playbooks health monitoring workbook](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-monitoring-your-logic-apps-playbooks-in-azure/ba-p/1873211).
78
-
- Use managed identities and service principals to authenticate against various Azure services within your Logic Apps, store the secrets in Azure Key Vault, and obscure the flow execution output. we also recommend that you [monitor the activities of these service principals](https://techcommunity.microsoft.com/t5/azure-sentinel/non-interactive-logins-minimizing-the-blind-spot/ba-p/2287932).
78
+
- Use managed identities and service principals to authenticate against various Azure services within your Logic Apps, store the secrets in Azure Key Vault, and obscure the flow execution output. we also recommend that you [monitor the activities of these service principals](https://techcommunity.microsoft.com/t5/azure-sentinel/non-interactive-logins-minimizing-the-blind-spot/ba-p/2287932).
79
+
80
+
## Next steps
81
+
82
+
In this article, you learned how to map your SOAR automation from ArcSight to Microsoft Sentinel.
83
+
84
+
> [!div class="nextstepaction"]
85
+
> [Export your historical data](migration-arcsight-historical-data.md)
:::image type="content" source="media/migration-arcsight-detection-rules/rule-5-sample.png" alt-text="Diagram illustrating a sample correlation rule (matching).":::
229
229
230
230
### Correlation (matching) example: KQL
231
231
@@ -250,7 +250,7 @@ Best practices:
250
250
251
251
Here is a sample ArcSight rule that defines a condition against a set of base events, using the `Matching Event` statement, and uses the `Wait time` filter condition.
Copy file name to clipboardExpand all lines: articles/sentinel/migration-arcsight-historical-data.md
+7-8Lines changed: 7 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -5,33 +5,32 @@ author: limwainstein
5
5
ms.author: lwainstein
6
6
ms.topic: how-to
7
7
ms.date: 05/03/2022
8
-
ms.custom: ignite-fall-2021
9
8
---
10
9
11
10
# Export historical data from ArcSight
12
11
13
12
This article describes how to export your historical data from ArcSight. After you complete the steps in this article, you can [select a target platform](migration-ingestion-target-platform.md) to host the exported data, and then [select an ingestion tool](migration-ingestion-tool.md) to migrate the data.
14
13
15
-
:::image type="content" source="media/migration-export-ingest/export-data.png" alt-text="Diagram illustrating steps involved in export and ingestion." lightbox="media/migration-export-ingest/export-data.png":::
14
+
:::image type="content" source="media/migration-export-ingest/export-data.png" alt-text="Diagram illustrating steps involved in export and ingestion.":::
16
15
17
16
You can export data from ArcSight in several ways. Your selection of an export method depends on the data volumes and the deployed ArcSight environment. You can export the logs to a local folder on the ArcSight server or to another server accessible by ArcSight.
18
17
19
18
To export the data, use one of the following methods:
20
-
-[ArcSight Event Data Transfer Tool](#arcsight-event-data-transfer-tool-arcsight-esm-version-7x): Use this option for large volumes of data, namely terabytes (TB).
19
+
-[ArcSight Event Data Transfer Tool](#arcsight-event-data-transfer-tool): Use this option for large volumes of data, namely terabytes (TB).
21
20
-[lacat tool](#lacat-utility): Use for volumes of data smaller than a TB.
22
21
23
-
## ArcSight Event Data Transfer tool (ArcSight ESM version 7.x)
22
+
## ArcSight Event Data Transfer tool
24
23
25
-
Use the Event Data Transfer tool to export data from ArcSight Enterprise Security Manager (ESM). To export data from ArcSight Logger, use the [lacat utility](#lacat-utility).
24
+
Use the Event Data Transfer tool to export data from ArcSight Enterprise Security Manager (ESM) version 7.x. To export data from ArcSight Logger, use the [lacat utility](#lacat-utility).
26
25
27
-
The tool you retrieves event data from ESM, which allows you to combine analysis with unstructured data, in addition to the CEF data. The Event Data Transfer tool exports ESM events in three formats: CEF, CV, and key-value pairs.
26
+
The Event Data Transfer tool retrieves event data from ESM, which allows you to combine analysis with unstructured data, in addition to the CEF data. The Event Data Transfer tool exports ESM events in three formats: CEF, CSV, and key-value pairs.
28
27
29
28
To export data using the Event Data Transfer tool:
30
29
31
30
1.[Install and configure the Event Transfer Tool](https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.6/ESM_AdminGuide/#ESM_AdminGuide/EventDataTransfer/EventDataTransfer.htm).
32
31
1. Configure the logs export to use a CSV format. For example, this command exports data recorded between 15:45 and 16:45 on May 4, 2016 to a CSV file:
0 commit comments