Configure the Tenable Identity Exposure Syslog Collector App

The TIE syslog collector allows you to send TIE syslog messages to Microsoft Azure Sentinel for centralized alerting and reporting.

Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM), and security orchestration automated response (SOAR) solution. For more information about Microsoft Sentinel, see the Microsoft documentation.

Note: This data connector depends on afad_parser based on a Kusto function to work as expected. This is deployed with the Microsoft Sentinel solution.

Required User Role: Basic User

Note: The Tenable integration with Microsoft Azure Sentinel works with a Basic User if that user is assigned Can View permissions on the assets they are to export, along with Can Use permissions on tags the assets are assigned. Without the Can Use tag permissions, the assets return undefined or the integration fails to export vulnerabilities if a tag filter is used. For more information on Tenable Vulnerability Management permissions and user roles, refer to Permissions in the Tenable Developer Portal.

Before you begin:

Note: You need a Linux Syslog server that TenableIE can send logs to. Typically, you can run rsyslog on Ubuntu. You can then configure this server as you wish, but Tenable recommends that you ensure that you are able to output TenableIE logs in a separate file.

Configure rsyslog to accept logs from your Tenable IE IP address by running the following commands:

  1. Set TenableIE source IP address:

    ```shell sudo -i # Set TenableIE source IP address export TENABLE_IE_IP={Enter your IP address}

  2. Create rsyslog configuration file:

    # Create rsyslog configuration file cat > /etc/rsyslog.d/80-tenable.conf << EOF \$ModLoad imudp \$UDPServerRun 514 \$ModLoad imtcp\n\\$InputTCPServerRun 514 \$AllowedSender TCP, 127.0.0.1, $TENABLE_IE_IP \$AllowedSender UDP, 127.0.0.1, $TENABLE_IE_IP \$template MsgTemplate,\"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\ \" \$template remote-incoming-logs, \"/var/log/%PROGRAMNAME%.log\" *.* ?remote-incoming-logs;MsgTemplate EOF

  3. Restart rsyslog:

    # Restart rsyslog\nsystemctl restart rsyslog ``` ```shell sudo -i

  4. Set Tenable IE source IP:

    # Set Tenable IE source IP address\nexport TENABLE_IE_IP={Enter your IP address}

  5. Create the rsyslog configuration:

    # Create rsyslog configuration file\ncat > /etc/rsyslog.d/80-tenable.conf << EOF $ModLoad imudp $UDPServerRun 514 $ModLoad imtcp $AllowedSender TCP, 127.0.0.1, $TENABLE_IE_IP $AllowedSender UDP, 127.0.0.1, $TENABLE_IE_IP $template MsgTemplate,\"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\ "\$template remote-incoming-logs, \"/var/log/%PROGRAMNAME%.log\" *.* ?remote-incoming-logs;MsgTemplate EOF

  6. Restart rsyslog:

    # Restart rsyslog systemctl restart rsyslog ```

Note: The OMS agent receives the TenableIE syslog events and publish them in Microsoft Sentinel instructions.

  1. Choose where to install the agent:

    1. Install agent on Azure Linux Virtual Machine

      1. Select the machine to install the agent on and then click Connect.

      2. Find this URL: InstallAgentOnLinuxVirtualMachine

    2. Install agent on a non-Azure Linux Machine

      1. Download the agent on the relevant machine and follow the instructions

      2. Find this URL: InstallAgentOnLinuxNonAzure

```shell tail -f /var/opt/microsoft/omsagent/log/omsagent.log ```

  1. In your TenableIE portal, go to System > Configuration > Syslog.

  2. Create a new Syslog alert toward your Syslog server.

  3. Check that the logs are correctly gathered on your server in a separate file (you can use the Test the configuration button in the Syslog alert configuration in TenableIE).

    Note: If you used the Quickstart template, the Syslog server listens by default on port 514 in UDP and 1514 in TCP, without TLS.

  1. In Microsoft Sentinel, go to Configuration > Settings > Workspace settings > Custom logs.

  2. Click Add custom log.

  3. Upload a sample TenableIE.log Syslog file from the Linux machine running the Syslog server.

  4. Click Next.

  5. Set the record delimiter to New Line (if not already set).

  6. Click Next.

  7. Select Linux and enter the file path to the Syslog file and click the + icon.

  8. Click Next.

    Note: The default location of the file is /var/log/TenableIE.log if you have a Tenable version <3.1.0, you must also add this Linux file location /var/log/AlsidForAD.log.

  9. Set the Name to Tenable_IE_CL.

    Note: Azure automatically adds "_CL" at the end of the name. There must be only one addition, so make sure the name is not Tenable_IE_CL_CL.

  10. Click Next.

  11. Click Create.