Using a non-Microsoft SIEM in a Microsoft shop.
We're basically all in on Microsoft, using the full Defender stack, with E5 licensing, with one exception: we use Rapid7 SIEM. Lately, I find we're turning more and more to Advanced Threat Hunting whenever we have a have an email-based attack (which is…
We're basically all in on Microsoft, using the full Defender stack, with E5 licensing, with one exception: we use Rapid7 SIEM. Lately, I find we're turning more and more to Advanced Threat Hunting whenever we have a have an email-based attack (which is basically all of them). I want to use Rapid7 as my single pane of glass, but I simply can't. Incidents and alerts are piping over to it, but it can't natively ingest Defender's KQL tables. Is anyone else using a non-Microsoft SIEM in an otherwise Microsoft-centric shop? If so, have you found any workarounds to ensure you're getting the same quality data you would see if you just spun up a Sentinel instance?
Collected discussion
We send azure/o365 events to our external SIEM. Very rarely do we need to rely on anything KQL related
Two reason so far. First and foremost, when I came into the role, Rapid7 was already here. At the time, I was a new security engineer. I'm now at a point where I feel like I have my feet under me, and can start redesigning if necessary. Secondly, we use Rapid7's managed SOC/MDR. While we could certainly put automation in place much more easily with Sentinel versus Rapid7, I'm not ready to give up MDR. I still want someone watching our feed, at night, on holidays, and while my coworker and I are unavailable. Bonus: Rapid7 gives you fixed fee retention of 13 months. I'm concerned about ballooning costs if we were to go to Sentinel. Though I understand we get some free logging with our E5 licensing. To be fair, I also realize we don't need 13 months of retention. But it sure is nice to have on occasion, since we're a very seasonal business. Being able to compare from this summer to last, for baselining, is handy.
Retention is definitely a big pain point for us, as you point out. I'm comfortable with KQL, and use Advanced Threat Hutning fairly reguarly. But 30 days of retention versus 13 months with Rapid7 is painful.
All new Sentinel deployments are in Defender now
Approximately 52,000 emails a day, with roughly 1,000 email users (we have a couple hundred more F3 users with email disabled).
With Rapid7, ingesting Defender means just ingesting alerts and incidents. If I want to see URL clicks, mail attachments opened, etc., then I'm turning to Advanced Threat Hunting.
Which SIEM do you use? Are you capturing URL clicks and the other more granular data that Advanced Threat Hunting gives you?
Yeah it's called Sentinel and I'm not a fan. I've used spline in a mixed environment before (all the E5 tools on the Wintel side) and it was painless. It's all about log ingestion and normalisation. Current employer is all in on Windows and they have PA's siem. No problems there either. Again, a focus on ingestion and normalisation have solved the issues.
100% exactly this. Rapid7 can handle everything you need. I have been using them for years.
Man R7's SIEM is pretty old. The main issue I'd see with this setup is budget. You'd be paying a premium to get data out of Microsoft, but it is possible. Am external server running custom code (ugh) to query log analytics and export it to a format that R7 can read is possible, but would require custom code. Honestly why not roll with Sentinel?
Probably because the boss(es) are whining that they paid for R7 like a decade ago and shouldn’t need anything newer. “Make it work”
Same. We use rapid7 and we pipe everything over through an Azure event hub . Rapid7 also has a MS security API integration that pulls in everything from the Security API we also get complete mail flow logs that include MDO determinations . This honestly sounds like you need to talk to your CSM and get a health check for your SIEM and make sure you have everything setup correctly.
Not sure why you need the KQL tables instead of just ingesting Defender itself.
They built sentinel straight into defender, might not be completely rolled out but you should be able to just work it from there
Just accept MS as your overlord.
What is your headcount and rough email volume (daily)
You can get the tables out, streaming API into an event hub and forward from there, but you pay egress and they land without the schema that made them worth querying. What you actually lose is the join, having device process events sitting next to email events in one query is the entire reason hunting is fast for phishing, and nothing reconstructs that cheaply on the other side. Most shops in your position stop fighting it and split the job, Microsoft stays the hunting and telemetry plane, the other SIEM does correlation and retention for everything non Microsoft, and single pane of glass quietly becomes a dashboard nobody investigates from. Check your hunting retention while you are at it, thirty days disappears fast when the investigation starts two months late.
MS Shop here about to roll Splunk right now, but previously on QRadar and then Exabeam. If you wanna see some bleeding edge tech to help with ingest and rules, check out Brava Security, they make it auto-magic.
!RemindMe 3 days
I didn't even realize Defender HAD a SIEM element. Anyway, yeah, I used Splunk for log consolidation in a Windows based environment as our only SIEM. However, the requirements passed down were never highly complex so I don't know that what I did matches what you're trying to do.
Sounds like you might need a translation layer like cribl to normalize for ya.
Our company uses a similar setup with 10+ tenants on Defender E5, combined with Rapid7 MDR + SIEM. You can ingest KQL tables (logs) into the platform via the Azure connector, but it requires an Azure Event Hub and configuring the Defender Streaming API. That said, Sentinel is probably a lot easier to work with. Rapid7 is partnering with Microsoft more and more i was told, so hopefully this integration will improve in the future.
Sentinel is fantastic if you have analysts who live in KQL. For everyone else, Defender + Huntress SIEM + Huntress ITDR is a very compelling combination. You keep Microsoft’s endpoint telemetry while getting a managed SOC and strong identity coverage without the overhead of running Sentinel yourself.
The guy getting downvoted for saying that Rapid7 is a niche product is actually correct because rapid7 insight doesn't even support your defender logs. It's a fairly bad product that gets very little love, at a company that's failing: https://docs.rapid7.com/insightidr/insightidr-event-sources/ Your options are: convince rapid7 to build an integration for the logs you want and pay them more money. migrate to another platform that supports the defender logs you want use sentinel do nothing and use two siems
What is your current mdr cost and when is your rapid7 contract up? And what features does rapid7 give you? I know it’s been said a lot but I think it’s time for a revaluation. If your having to ask this question the question keeps nagging me is what abilities and tools your missing. For example I have a logic app that runs kql queries, api calls and collects every related detail that it can. I send that to ai to review and give me an assessment. If it finds an operational review needed calls an api to generate a ServiceNow ticket. Now my mxdr provider sync sentinel to their freshdesk instance and I sync escalated alerts to my ServiceNow. Also adding more ai agents that will triage incidents in minutes. The list goes on.