Microsoft Azure Sentinel

The Tenable integration for Microsoft Azure Sentinel combines Tenable's Cyber Exposure insights with Sentinel's collection, detection, and investigation capabilities. This integration supports Tenable Vulnerability Management and exports asset and vulnerability data from Tenable Vulnerability Management directly to Microsoft Sentinel.

Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM), and security orchestration automated response (SOAR) solution. For more information about Microsoft Sentinel, see the Microsoft documentation.

Required User Role: Administrator. For more information, see API Permissions.

Note: The Microsoft Azure Sentinel integration does not export fixed vulnerabilities.

Before you begin:

  • You must have a Logs Analytics Workspace with Microsoft Sentinel enabled in your Azure subscription.
  • For assistance with launching Microsoft Sentinel, see the Microsoft Sentinel quick start guide.

  1. Navigate to Microsoft Sentinel within the Microsoft Azure Portal and click Create Microsoft Sentinel.

    The workspace homepage appears:

  2. Add a workspace for Microsoft Sentinel. Click Create a new workspace.

  3. To create the Log Analytics workspace, you must first create a new Resource Group. Click Create new under Resource Group Connector.

  4. Input a Name for the instance detail and select the appropriate Azure Region from the drop-down menu.

    Click Review + Create.

    The settings are finalized and the page updates:

  5. Click Create.

    The workspace homepage appears with your new Microsoft Sentinel workspace:

    The Log Analytics Workplace for Microsoft Sentinel has been created.

  1. Go to the Content Hub and perform a search for "Tenable."

  2. Select Tenable App. In the bottom-right corner click Install.

  3. Once installed, in the bottom-right corner, click Manage.

  1. In your newly created Tenable App, click Tenable.io Vulnerability Management (using Azure Function) in the content list.

  2. Select the name of the connector and in the bottom-right corner, click Open connector page.

  3. Deploy the ARM template by clicking Deploy to Azure.

  4. Select the Resource Group and populate the remaining four fields.

    Note: The Tenable export schedule is set for every 24 hours (1440 minutes) by default. This can be adjusted to suit the requirements needed to gather asset and vulnerability data in a timely manner.

  5. Once all fields have been populated, click Review + create.

  6. The fields are finalized. Click Create.

  1. Once the deployment has been completed, click Go to Resource Group to see the resources that have been created.

  2. The app populates the following resources:

    Note: The app may take up to ten minutes to populate the resources.

  3. In the Function App, verify that you can see the listed functions: