|
1 | 1 | # Sentinel Triage AssistanT (STAT) :hospital: - MSSP / Multi Tenant Deployments |
2 | 2 |
|
3 | 3 | > [!NOTE] |
4 | | -> STAT documentation is being relocated to the builin [Wiki](https://github.com/briandelmsft/SentinelAutomationModules/wiki) |
5 | | -
|
6 | | -With the introduction of STAT v2 we have added support for Multi Tenant Service Principal Authentication to enable MSSP and other organizations with multiple tenants to run STAT in a centralized location, while accessing services in another Azure Ad tenant. |
7 | | - |
8 | | -## Prerequisites |
9 | | - |
10 | | -* Create a Multi tenant Service Principal in the central tenant |
11 | | -* Run the GrantPermissions.ps1 against this service principal |
12 | | -* Grant consent in the customer/other tenants to this Service Principal |
13 | | -* Deploy STAT v2 (Preview build 1.5.0 or later) using the Service Principal as the Identity type during the deployment |
14 | | - |
15 | | -## Identify the AAD tenant to run STAT against |
16 | | - |
17 | | -By default STAT will execute its API calls against the tenant where it is installed. However, if you are using Azure Lighthouse to execute a logic app in your MSSP tenant from a customer tenant you will need to add some additional configuration. You, must come up with a way to identify the source tenant of the incident such that you can pass the tenant id to STAT. This could be accomplished by a watchlist in your source tenant, which looks up the workspace id or subscription id against a watchlist to determine the originating tenant, or it could be done through any other means. Ultimately, STAT cannot make the determination of which tenant to execute against, so you will need to provide this information. Additionally, to use the MDCA module you will also be able to lookup the customers MDCA API endpoint and provide this information as well. This can be stored and looked up in a similiar fashion as the tenant id. |
18 | | - |
19 | | -## Provide AAD Tenant Details to STAT |
20 | | - |
21 | | -The Base Module has a new optional parameter called *MultiTenantConfig*. In a multi tenant configuration, this parameter will need to be passed to the base module. The parameter is expecting a JSON object containing the multi tenant configuration. |
22 | | - |
23 | | -### Example 1 - All APIs are located in the Customer Tenant / STAT Deployed in MSSP Tenant |
24 | | - |
25 | | -```json |
26 | | -{ |
27 | | - "TenantId": "CustomerTenantGUID", |
28 | | - "MDCAUrl": "customer.region.portal.cloudappsecurity.com" |
29 | | -} |
30 | | -``` |
31 | | - |
32 | | -### Example 2 - The Sentinel Incidents and STAT are in MSSP Tenant / All other data in the Customer Tenant |
33 | | - |
34 | | -```json |
35 | | -{ |
36 | | - "ARMTenantId": "MSSPTenantGUID", |
37 | | - "TenantId": "CustomerTenantGUID", |
38 | | - "MDCAUrl": "customer.region.portal.cloudappsecurity.com" |
39 | | -} |
40 | | -``` |
41 | | - |
42 | | -## Advanced Configuration |
43 | | - |
44 | | -STAT v2 allows for an API by API level of control against which tenant the authentication occurs, so for other scenarios you can customize this further. To do so, the *MultiTenantConfig* accepts all of these properties. |
45 | | - |
46 | | -|Property|Description| |
47 | | -|---|---| |
48 | | -|TenantId|The default tenant id to use for any APIs not explicitly specified. Setting a service specific tenant id overrides this value for that service.| |
49 | | -|ARMTenantId|The tenant id to use when accessing the Azure Resource Manager API. This API is primarily used for updating incidents.| |
50 | | -|MSGraphTenantId|The tenant id to use when accessing the Microsoft Graph API.| |
51 | | -|LogAnalyticsTenantId|The tenant id to use when access the Log Analytics API to run KQL queries.| |
52 | | -|M365DTenantId|The tenant id to use when accessing Microsoft 365 Defender APIs| |
53 | | -|MDETenantId|The tenant id to use when accessing Microsoft Defender for Endpoint APIs| |
54 | | -|MDCAUrl|The tenant specific API endpoint to use when accessing MDCA (MDCA module only). Do not include *https://*| |
55 | | - |
56 | | - |
57 | | ---- |
58 | | -[Documentation Home](readme.md) |
| 4 | +> STAT documentation is now located in the built-in [Wiki](https://github.com/briandelmsft/SentinelAutomationModules/wiki/MSSP) |
0 commit comments