Microsoft Sentinel with Firebox Cloud Integration Guide

Microsoft Sentinel is a scalable, cloud-native security information event management (SIEM) and security orchestration, automation, and response (SOAR) solution. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise and provides a single solution for alert detection, threat visibility, proactive hunting, and threat response.

This document describes the steps to integrate Microsoft Sentinel with your WatchGuard Firebox Cloud.

Platform and Software

The hardware and software used to complete the steps outlined in this document include:

  • Microsoft Sentinel Cloud
  • Microsoft Sentinel Agent
  • Rsyslog Server
    • v8.32.0
  • WatchGuard Firebox Cloud
    • Fireware v12.8

Test Topology

Screen shot of the Topology diagram

Before You Begin

Before you begin these procedures, make sure that:

  • You have the resource group and workspace configured in Microsoft Sentinel
  • You have created a virtual network in the Azure portal
  • You have created and configured the rsyslog server
  • Your rsyslog server can receive WatchGuard Firebox Cloud logs
  • You have a WatchGuard Firebox Cloud deployed on Azure (see Deploy Firebox Cloud on Microsoft Azure)

Set Up Microsoft Sentinel

  1. Log in to the Azure portal with your Microsoft Azure account credentials.
  2. Search for and click Microsoft Sentinel.

Screenshot of the Microsoft Sentinel search result in the Azure portal

  1. Select your workspace.
  2. Select Configuration > Data connectors.
  3. Search for and select the WatchGuard Firebox connector.

Screenshot of the Data Connectors page in Microsoft Azure

  1. Click Open connector page.
  2. Select the Instructions tab.
  3. In the Configuration section, expand Install agent on Azure Linux Virtual Machine.
  4. Click Download & install agent for Azure Linux Virtual machines.

Screenshot of the WatchGuard Firebox configuration in Microsoft Azure

  1. Select your rsyslog server, and click Connect.
  2. After a successful connection to your rsyslog server, go back to the WatchGuard Firebox connector page.
  3. Click Open your workspace agents configuration.
  4. Select the Syslog tab.
  5. Click Add facility to add the facilities you need (for example, local0 to local7, kern, and syslog).

Screenshot of the Agents Configuration page in the Azure portal

  1. Click Apply.
  2. Go back to the WatchGuard Firebox connector page, and in the Configuration section, click Follow these steps.
  3. Copy the values from the WatchGuard syslog Parser page. You need this information in Step 20.
  4. Close the WatchGuard syslog Parser page, and go back to your Microsoft Sentinel workspace page.
  5. Select General > Logs.
  6. Follow the WatchGuard syslog Parser page description, and paste the values from the WatchGuard syslog Parser page into the logs query window.

Screenshot of the Logs query window in the Azure portal

  1. Select Save > Save as function.
  2. In the Function name text box, type WatchGuardFirebox.
  3. In the Legacy category text box, type WatchGuardFirebox.

Screenshot of the Logs query window save function

  1. Click Save.

Set Up Firebox Cloud

  1. Log in to Fireware Web UI (https://<Eth0_public_IP>:8080).
  2. Select System > Logging.
    The Logging page opens.
  3. Select the Syslog Server tab.
  4. Select the Send log messages to these syslog servers check box.
  5. Click Add.
    The Syslog Server dialogue box opens.
  6. In the IP Address text box, type the IP address of your Microsoft Sentinel Agent.
  7. In the Port text box, type 514.
  8. From the Log Format drop-down list, select Syslog.
  9. Select the syslog facility you need (for example, default settings).

Screenshot of the Syslog Server dialog box in Firebox Cloud

  1. Click OK.
  2. Click Save.

You can configure logging in many locations in the Firebox Cloud configuration, such as policies and proxies. Make sure you select Send a log message when you want the Firebox Cloud to generate a log message for an event.

Screenshot of the Logging dialog box in Firebox Cloud

Test the Integration

  1. After Firebox Cloud begins to send log to Microsoft Sentinel Agent, on the WatchGuard Firebox connector page, select the Next steps tab.

Screenshot of the WatchGuard Firebox Next Steps tab in the Azure portal

  1. Select the first query sample. Click Run.
    Information about the query appears.

Screenshot of the Run query in the Logs section of the WatchGuard workspace in the Azure portal

Filter Logs

Information from sources other than the Firebox Cloud can sometimes appear in syslog data. For example, in the query results shown in the Test the Integration section of this document, Ubuntu events are not related to Firebox Cloud. To run a query that returns events from only Firebox Cloud, you can filter the query by host name or computer.

An example query that only includes events from the host name Firebox:

Screenshot of the filtered Logs page in the Azure portal