Introduction

This guide is part of the support provided by Utimaco. Additional documentation produced to support your Utimaco Enterprise Secure Key Manager (ESKM) product can be found in the utimaco ESKM product documentation.

All Utimaco product documentation is available from Utimaco's website at https://utimaco.com/.

About This Guide

This guide describes how to integrate Utimaco Enterprise Secure Key Manager (ESKM)
with Microsoft Sentinel, using the official Utimaco ESKM solution published in the Microsoft Sentinel Content Hub. The Utimaco ESKM solution ingests KMIP server logs from the ESKM management API into a Microsoft Sentinel Log Analytics workspace using the Codeless Connector Framework (CCF) RestApiPoller. Once data is flowing, the solution provides analytic rules, hunting queries, and a workbook for operational visibility and threat detection over key management activity.

Target Audience

This guide is intended for Microsoft Sentinel administrators and Utimaco ESKM administrators
responsible for deploying and operating the integration.

Purpose of the Integration

The integration of Utimaco ESKM with Microsoft Sentinel serves a critical role in enhancing the security and compliance posture of cryptographic key management operations. By forwarding KMIP server logs to Sentinel, security operations teams gain:

• Centralized visibility into all KMIP operations, authentication events, and state changes.

• Automated detection of anomalous behavior such as brute-force authentication attempts, privilege escalation probing, and mass key destruction.

• Proactive threat hunting capabilities to identify rare users, new source IPs, high-volume key retrievals, and after-hours activity.

• An operational dashboard (workbook) for day-to-day monitoring of the KMIP plane.

Scope of the Integration

This integration enables monitoring and visibility of ESKM KMIP activity through Microsoft Sentinel by ingesting KMIP server logs from the ESKM management API. The solution provides real-time monitoring, automated threat detection, and proactive threat hunting capabilities for key management operations and security events.

Abbreviations

Abbreviations

Document Conventions

The following conventions are used in this guide:

Document conventions

We use special icons to highlight the most important notes and information.