Delinea Platform Native Microsoft Sentinel Solution
The Delinea Platform integration is a native Microsoft Sentinel solution. It pulls audit events directly into Microsoft Sentinel and pairs the data with ready-to-use security content. The solution installs entirely from the Microsoft Sentinel Content hub.
A Codeless Connector Framework (CCF) poll connector queries the Delinea Platform Audit API on a 5-minute window and writes the events to the DelineaAuditEvents_CL table in your Log Analytics workspace. The events include secret access, authentication, session activity, and configuration changes.
The solution is a complete SOC package: 4 workbooks (including Secret Server Vault Activity), 6 analytic rules with baseline-driven detections, 10 hunting queries, and an automated-response playbook.
The Delinea Platform also integrates with Microsoft Sentinel by using webhooks, which send events to Microsoft Sentinel as they occur. For more information, see Integrating Microsoft Sentinel with the Delinea Platform Webhooks.
Use Cases
This integration supports the following use cases:
-
Monitor Delinea Platform privileged access activity in Microsoft Sentinel.
-
Detect unusual secret access, including bulk secret retrieval, access volume above an account's own baseline, and a sensitive secret opened by a user who has not accessed it before.
-
Detect authentication attacks, such as a burst of failed sign-ins against a single account.
-
Detect privilege escalation and Delinea Platform configuration changes.
-
Investigate activity on demand by using the included workbooks and hunting queries, without writing queries.
-
Add context to bulk secret access incidents automatically by using the included playbook.
For more information about this integration, see the following topics:
