StealthTalk Anomalous Authentication

STEP 1 - Auto-deployed ingestion infrastructure (review only)

When the Solution is installed via the Microsoft Sentinel Content Hub, the following resources are deployed automatically into the workspace's resource group: 1. **Custom log table** `StealthTalkAnomalousAuth_CL` (21-field stream). 2. **Data Collection Endpoint** `StealthTalk-Sentinel-DCE`. 3. **Data Collection Rule** `StealthTalk-Sentinel-DCR` with `Custom-StealthTalkAnomalousAuth_CL` stream declaration and a one-to-one transform. 4. **ASIM Authentication 0.1.3 parsers** as workspace saved-search functions: `vimAuthenticationStealthTalk` (filtering) and `ASimAuthenticationStealthTalk` (non-filtering). 5. **`imAuthentication` extension parser** that registers the StealthTalk source in the workspace ASIM Authentication union (overrides Microsoft's `imAuthentication` saved-search to include the StealthTalk vim parser). 6. **`ASimDisabledParsers` watchlist** + Microsoft Sentinel onboarding state (idempotent). No user action is required at this step beyond installing the Solution. The remaining steps configure StealthTalk to push events into the deployed DCR. Pre-requisite: Microsoft's `FullDeploymentAuthentication.json` ASIM Authentication parser pack must be deployed in the workspace before this Solution is installed.

STEP 2 - Capture the DCE endpoint and DCR Immutable ID

In the Azure portal, open the Data Collection Endpoint and Data Collection Rule resources deployed in Step 1: - From the **Data Collection Endpoint** properties, copy the **Logs Ingestion endpoint URI** (looks like `https://stealthtalk-sentinel-dce-<suffix>.<region>.ingest.monitor.azure.com`). - From the **Data Collection Rule** Overview, copy the **Immutable ID** (looks like `dcr-<guid>`). You will paste both values into the StealthTalk admin console in Step 5.

STEP 3 - Create a Microsoft Entra App Registration for StealthTalk

Create a new App Registration in your Microsoft Entra tenant. Generate a client secret (or use a certificate). Note the **Tenant ID**, **App (client) ID** and **Client secret**. StealthTalk uses this service principal to authenticate to the Logs Ingestion API via OAuth.

STEP 4 - Grant the App Registration the Monitoring Metrics Publisher role on the DCR

Open the Data Collection Rule deployed in Step 1 -> **Access control (IAM)** -> **+ Add role assignment**. - Role: **Monitoring Metrics Publisher** - Assign access to: **User, group, or service principal** - Select the App Registration from Step 3 RBAC role assignments cannot be performed by the Solution install template, so this step is manual.

STEP 5 - Configure StealthTalk to send events

In the StealthTalk admin console, configure the Microsoft Sentinel/Log Analytics integration with the values captured in Steps 2 and 3: - **DCE endpoint** - the Logs Ingestion endpoint URI from Step 2 - **DCR Immutable ID** - from Step 2 - **Stream name** - `Custom-StealthTalkAnomalousAuth_CL` - **Tenant ID, App (client) ID, Client secret** - from Step 3 Save and trigger a test event. The StealthTalk console reports success/failure of the OAuth handshake and the first event delivery.

STEP 6 - Verify ingestion and ASIM normalisation

Run the **Sample queries** above in **Logs**. All must return rows within a few minutes of test events: - Raw `StealthTalkAnomalousAuth_CL` table populated. - ASIM union view via `imAuthentication() | where EventVendor == 'StealthTalk'` returns the same events normalised to the ASIM Authentication schema. If the raw table is empty: verify the StealthTalk console reports successful OAuth and event delivery, and confirm the App Registration has the **Monitoring Metrics Publisher** role on the DCR (Step 4). If the raw table has rows but ASIM union is empty: re-check that Microsoft's `FullDeploymentAuthentication.json` parser pack is deployed.

STEP 7 - Enable analytic rules, hunting queries, workbook, and playbook

In the Microsoft Sentinel **Content hub**, open the **StealthTalk Anomalous Authentication** Solution and click **Manage**. Enable the four Analytic Rule templates, the three Hunting Query templates, the Workbook, and the Microsoft Teams Playbook. For the Playbook, after deployment, grant its system-assigned managed identity the **Microsoft Sentinel Responder** role on the workspace, and grant the **Azure Security Insights** service principal the **Microsoft Sentinel Automation Contributor** role on the playbook's resource group. Then create an **Automation Rule** in Microsoft Sentinel that runs the playbook on incidents from the four StealthTalk analytic rules.