Entra Identity Logs from Azure Active Directory

[rgbrow1949]

Identity logs are valuable and in LME 2.0, the rearchitecture will allow us to bring in new logs from Azure Active Directory.

We should look into ways to collect Entra logs and what infrastructure changes would we need to make to LME to do it.

Available tools:

• Ethan Bowen's Export-AAD tool: https://github.com/25004/Export-AAD.git
• Untitled Good Tool: https://github.com/cisagov/untitledgoosetool

[rgbrow1949]

The untitled goose tool contains PowerShell scripts we can use to get AAD logs from the tenant. Question: Does the current LME setup automatically configure AAD for auditing? Or will it need to be activated? AAD logs can be moved to Elk Stack with Filebeat.

[safiuddinr]

Adding @rgbrow1949 as a watcher.

[ddiabe]

There are 4 steps ;

1. Entra logs (AAD) require Powershell modules to run a powershell script to extract logs.
2. After modules are installed, script will be ran to export logs. (Logs will be in Json file)
3. Logs will later be exported via filebeat to elasticsearch in LS1.
4. Logs will be visualized using dashboards in Kibana.