Overview of Microsoft Sentinel
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) solution built on Azure. It collects data at cloud scale across all users, devices, applications, and infrastructure (both on-premises and in multiple clouds), uses analytics and threat intelligence to detect attacks, and provides tools for threat investigation and response.
Microsoft Sentinel's Codeless Connector Framework (CCF) enables ingestion of data from external REST APIs into Log Analytics tables without requiring custom code, using polling-based data collection governed by a Data Collection Rule (DCR).
Overview of ESKM
ESKM is a centralized key management solution that securely stores, distributes, and manages encryption keys throughout their lifecycle. It supports industry standards, including the KMIP, enabling integration with various enterprise applications and storage systems.
Joint Value Proposition
The integration of Utimaco ESKM with Microsoft Sentinel combines the robust key management and audit capabilities of ESKM with the advanced threat detection and investigation features of Microsoft Sentinel. Organizations benefit from:
-
Automated log ingestion - KMIP server logs are automatically polled every 5 minutes and ingested without manual intervention.
-
Threat detection - Built-in analytic rules detect brute-force attacks, privilege probing, and mass key destruction in real time.
-
Proactive hunting - Hunting queries allow security analysts to investigate anomalous patterns before they escalate.
-
Operational dashboards - A purpose-built workbook provides at-a-glance visibility into key management activity.
Integration architecture overview
The ESKM appliance generates KMIP server logs that are polled every 5 minutes via HTTPS by the Sentinel CCF RestApiPoller using basic authentication. The raw logs are ingested into a custom stream, transformed by the DCR using KQL normalization, and written to the Log Analytics table. From there, the data flows to three detection channels: scheduled analytic rules that generate security incidents, proactive hunting queries for manual investigation, and an operational workbook for real-time dashboarding.