There are 2 delegations of access an operational security team would need to assist a customer with managing their security events and detection rules. Our customer offerings below have been constructed around the type of ongoing access and assistance required:
- Tier 0 - Advisor: Ability for automation accounts to read security incidents, alerts, identity and device information, event data, and azure subscription resources.
- Microsoft 365 Tenant (Azure AD) Role: Global Reader
- Azure Subscription Role: Reader
- Tier 1 - Monitor: Increased access for analysts to work on security incidents and detection rules ontop of Tier 0.
- Microsoft 365 Tenant (Azure AD) Roles: Global Reader, Security Operator
- Azure Subscription Roles: Reader, Microsoft Sentinel Contributor, Security Admin
- Optional configuration of Azure AD Privileged Identity Management (PIM) for elevated access to resources during critical incident response or service configuration activities (required under Tier 2).
As part of onboarding, the WA SOC will send the customer a prefilled Azure Lighthouse ARM Deployment that can be installed as an Service provider offer to initiate an Azure Lighthouse connection between the customer Azure Subscription and the WA SOC Tenant. Once completed the WA SOC can delegate relevant permissions to analysts and automation processes via privileged groups in the WA SOC tenant, allowing it to service the customers Azure subscription. This process needs to be undertaken for each subscription the customer would like to delegate access to.
As part of onboarding, the WA SOC will send the customer a list of analysts (in csv format) to be delegated specific access in the customers Azure AD Tenant. This process needs to be undertaken for each Azure AD Tenant the customer would like to delegate access to.
- Global Admin permission required for the Azure AD Tenant and associated Azure Subscriptions.
- Access to Service provider offers in the Azure Portal
- Access to Azure Active Directory Groups in the Azure Portal
- List of agency Azure AD Identities (as emails) that will require access to the WA SOC Incident Reporting Portal for collaboration on cyber security incidents.
The below Azure AD group and Defender for Endpoint roles grant permissions required from the customer tenant to the WA SOC analysts. Once you have reviewed the roles themselves please implement using the 2.2.3. Group and role assignment walkthrough.
Note that the Defender for Endpoint role assignment is only required if you have enabled Manage portal access using role-based access control in Defender for Endpoint.
Create an Azure AD group as follows. Any future changes to membership will be requested by the WA SOC.
- Group type: Security
- Group name: WASOC-T0-Advisor
- Group description: WASOC Tier 0 Advisor Access (Global Reader)
- Azure AD roles can be assigned: Yes
- Members: Each email address imported from
wasoc-automation-invites.csv - Roles: Global Reader
Create a Defender for Endpoint role as follows. This will inherit from the above group to ensure membership changes stay in sync.
- Role Name: WASOC-T0-Advisor
- Permissions: View Data (all)
- Assigned user groups: WASOC-T0-Advisor
Create an Azure AD group as follows. Any future changes to membership will be requested by the WA SOC.
- Group type: Security
- Group name: WASOC-T1-Monitor
- Group description: WASOC Tier 1 Monitor Access (Security Operator)
- Azure AD roles can be assigned: Yes
- Members: Each email address imported from
wasoc-analyst-invites.csv - Roles: Global Reader and Security Operator
Create a Defender for Endpoint role as follows. This will inherit from the above group to ensure membership changes stay in sync.
- Role Name: WASOC-T1-Monitor
- Permissions: View Data (all), Active remediation actions (all), Alerts investigation
- Assigned user groups: WASOC-T1-Monitor
The group names and role names below can be set to anything you prefer, however for consistency we recommend using the templated names above.
- Invite the
wasoc-...-invites.csvinto your Azure AD directory.
- Create a single Azure AD Group with the above invited automation accounts / analysts as members and documented Azure AD roles assigned.
- Assign the Defender for Endpoint roles to the above group to add Defender for Endpoint access if you have enabled role based access control.
The Azure subscription access can be delegated via the Azure Portal.
Navigate to the Azure Lighthouse - Service Providers page in the Azure portal, and select the arrow next to Add offer, and then select Add via template.
Browse for the template provided, and click Upload. This can be customised to removed unused groups if desired for the customers Tier - please inform the WA SOC of any changes prior to deployment to allow documentation to be updated.
Review the custom deployment details and ensure the location is Australia East, then click Review and create then click Create.
Once the template phase has completed, cusotmers can confirm the onboarding process has finalised by navigating to the Azure Lighthouse - Service Providers page and confirming you can see the WA SOC - Security Insights service offer.
