CloudGuard CSPM Webhook Forwarder for Microsoft Sentinel

Table of Contents

1. Overview
2. Prerequisites
3. Deploy
4. Test notifications from CSPM to Sentinel

Overview

This is an Azure function app that serves as a webhook forwarder. It will allow users to send notifications from Check Point CloudGuard CSPM to Microsoft Sentinel. This repo will deploy the webhook forwarder as an Azure function app.

For more information see:

CloudGuard CSPM Notification

Microsoft Sentinel Data Collector API

Azure Functions Overview

Prerequisites

1. You must have read and write permissions on the Microsoft Sentinel workspace.

2. You must have read permissions to shared keys for the workspace.

   Learn more about workspace keys.

Deploy

1. Get Microsoft Sentinel Workspace ID and Primary Key

   a. From Azure Portal -> Microsoft Sentinel Workspace -> Settings -> Workspace settings -> Agents management

   b. Copy Workspace ID and the Primary Key

   

2. Launch Template

   

3. Fill template details

   

4. Obtain function app endpoint URL

   

5. Configure Cloudguard CSPM notification

   a. Login to Check Point CloudGuard CSPM portal

   b. Settings -> Notifications -> Add Notification

   c. Fill in the details

   d. Endpoint url - make sure to include the following at end of function URL "/api/forwarder/"

   e. Select "Basic" Authentication Type

   f. Input CSPM username and password from step 3 above

   g. Test endpoint

   h. Save notification policy

   Example:

   

6. Assign notification policy to a security bundle

   a. From CloudGuard CSPM portal

   b. Posture Management -> Continous Posture -> Select bundle

   c. Edit bundle notiifcation policy

   

   d. Select notification policy and Save settings

   

Test notifications

1. From CloudGuard CSPM portal

2. Posture Management -> Continous Posture -> Select bundle

3. Select "Send all alerts"

   

4. Select notification policy and Send

   

5. From Microsoft Sentinel Workspace -> Select CloudguardCSPM_CL or user specified log_type name for CloudGuard CSPM.

   

   Note: Microsoft Sentinel Data Collector API appends "_CL" to all ingested data fields.

6. Filter events

   a. Filter by:

    - rule_severity_s
    - rule_ruleId_s
    - rule_name_s
    - entity_region_s
    - entity_name_s
    - rule_description_s
    - rule_remediation_s
    - entity_id_s
   

   example: