1"use strict";(self.webpackChunkphdocs3=self.webpackChunkphdocs3||[]).push([["897"],{5428(e,n,s){s.r(n),s.d(n,{metadata:()=>t,default:()=>h,frontMatter:()=>c,contentTitle:()=>a,toc:()=>l,assets:()=>o});var t=JSON.parse('{"id":"passhub-business/Audit","title":"Audit","description":"Internal Logs","source":"@site/docs/passhub-business/72-Audit.md","sourceDirName":"passhub-business","slug":"/passhub-business/Audit","permalink":"/doc/passhub-business/Audit","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":72,"frontMatter":{"sidebar_label":"Audit","sidebar_position":72},"sidebar":"tutorialSidebar","previous":{"title":"PassHub for Business","permalink":"/doc/passhub-business/passhub-business"},"next":{"title":"Azure Passhub Deployment","permalink":"/doc/azure-passhub"}}'),i=s(4848),r=s(8453);let c={sidebar_label:"Audit",sidebar_position:72},a="Audit",o={},l=[{value:"Internal Logs",id:"internal-logs",level:2},{value:"Microsoft Sentinel SIEM",id:"microsoft-sentinel-siem",level:2},{value:"1. Register your Passhub Application",id:"1-register-your-passhub-application",level:3},{value:"2. Define data flow and custom table",id:"2-define-data-flow-and-custom-table",level:3},{value:"Create the Data Collection Endpoint (DCE)",id:"create-the-data-collection-endpoint-dce",level:4},{value:"Create custom table (DCR-based)",id:"create-custom-table-dcr-based",level:4},{value:"Get the stream name",id:"get-the-stream-name",level:4},{value:"3. Configure Passhub",id:"3-configure-passhub",level:3},{value:"CrowdStrike Next-Gen SIEM",id:"crowdstrike-next-gen-siem",level:2},{value:"1. Customize Next-Gen SIEM",id:"1-customize-next-gen-siem",level:3},{value:"Create the HEC / HTTP Connector",id:"create-the-hec--http-connector",level:4},{value:"Create the Custom Parser",id:"create-the-custom-parser",level:4},{value:"2. Configure Passhub",id:"2-configure-passhub",level:3}];function d(e){let n={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",hr:"hr",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"audit",children:"Audit"})}),"\n",(0,i.jsx)(n.h2,{id:"internal-logs",children:"Internal Logs"}),"\n",(0,i.jsxs)(n.p,{children:["To access Passhub event logs, click the ",(0,i.jsx)(n.code,{children:"Audit"})," link on the admin page."]}),"\n",(0,i.jsx)(n.p,{children:"You can use filters to view a particular user or event type, and to define the time window. You can also sort records by any column."}),"\n",(0,i.jsx)(n.h2,{id:"microsoft-sentinel-siem",children:"Microsoft Sentinel SIEM"}),"\n",(0,i.jsx)(n.p,{children:"If your company relies on a centralized SIEM (Security Information and Event Management), you may connect the Passhub instance to the company's Sentinel."}),"\n",(0,i.jsx)(n.p,{children:"Here are the main steps to configure the Passhub to Sentinel connection:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsx)(n.li,{children:"Azure: Register an external app in the Azure tenant"}),"\n",(0,i.jsx)(n.li,{children:"Azure: Define the information flow and set the data exchange format"}),"\n",(0,i.jsx)(n.li,{children:"Passhub: Add the connection parameters obtained in the above steps to the Passhub configuration"}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"You may already be familiar with the first two steps (provided you already use Sentinel). If so, skip the next two sections."}),"\n",(0,i.jsx)(n.p,{children:"Please note that the steps described in the following text may change over time, as Azure evolves."}),"\n",(0,i.jsx)(n.h3,{id:"1-register-your-passhub-application",children:"1. Register your Passhub Application"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["From Azure Home select ",(0,i.jsx)(n.strong,{children:"App Registration > New Registration"})]}),"\n",(0,i.jsxs)(n.li,{children:['Set the name of the app (e.g. "myPasshub SIEM connector") and check that "Single tenant only" is set in the account type, click ',(0,i.jsx)(n.strong,{children:"Register"})," button"]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"You will be presented with a set of the following constants"}),"\n",(0,i.jsx)(n.hr,{}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Display name"}),": myPasshub SIEM Connector"]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Application (client) ID:"})," cccccccc-cccc-cccc-cccc-cccccccccccc"]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Directory (tenant) ID:"})," tttttttt-tttt-tttt-tttt-tttttttttttt"]}),"\n",(0,i.jsx)(n.p,{children:"Client credentials: Add a certificate or secret"}),"\n",(0,i.jsx)(n.p,{children:"....."}),"\n",(0,i.jsx)(n.hr,{}),"\n",(0,i.jsxs)(n.p,{children:["Now click the ",(0,i.jsx)(n.strong,{children:"Client Credentials"})," link, go to the ",(0,i.jsx)(n.strong,{children:"New client secret"})," page, and copy the ",(0,i.jsx)(n.strong,{children:"Value"})," field ssssssssssssss immediately (it is shown only once)."]}),"\n",(0,i.jsx)(n.h3,{id:"2-define-data-flow-and-custom-table",children:"2. Define data flow and custom table"}),"\n",(0,i.jsx)(n.h4,{id:"create-the-data-collection-endpoint-dce",children:"Create the Data Collection Endpoint (DCE)"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:'Search for "Data Collection Endpoints" in the Azure page\'s top search bar'}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Click ",(0,i.jsx)(n.code,{children:"+Create"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Use an existing resource group or create a new one (e.g. ",(0,i.jsx)(n.code,{children:"my-test-dce"}),") and set the resource group to ",(0,i.jsx)(n.code,{children:"Sentinel"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Click ",(0,i.jsx)(n.strong,{children:"Review + Create"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["On the next page, click ",(0,i.jsx)(n.strong,{children:"Create"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["When the new DCE appears in the DCE list, click on its link, and get the ",(0,i.jsx)(n.strong,{children:"Log ingestion"})," parameter:"]}),"\n",(0,i.jsxs)(n.p,{children:["https://",(0,i.jsx)(n.em,{children:"the-dce-name"}),"-igcm.eastus-1.ingest.monitor.azure.com"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"create-custom-table-dcr-based",children:"Create custom table (DCR-based)"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:'Search for "Log Analytics workspaces" in the Azure page\'s top search bar'}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Create a new workspace, e.g. ",(0,i.jsx)(n.code,{children:"ms-test-analytics-ws"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:"Once created, go to the resource"}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["On the left pane select ",(0,i.jsx)(n.strong,{children:"Settings -> Tables"}),'; the "Create a custom log" page opens']}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Set the name ",(0,i.jsx)(n.code,{children:"myTest"})," (Azure adds a ",(0,i.jsx)(n.code,{children:"_CL"})," suffix automatically), select the ",(0,i.jsx)(n.code,{children:"Basic"})," plan (reasonably billed), select the freshly created DCE (e.g. ",(0,i.jsx)(n.code,{children:"my-test-dce"}),"), and set the new DCR to ",(0,i.jsx)(n.code,{children:"myTestDCR"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:"Click Next -> Schema: Upload a log JSON example"}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-json",children:'{\n "TimeGenerated": "2026-07-22T17:30:37+00:00",\n "EventType": "iam_audit",\n "Source": "passhub",\n "Severity": "High",\n "Category": "identity_access_management",\n "Actor": "[email protected]",\n "Operation": "Login",\n "TargetUser": "",\n "Company": "example",\n "Group": "",\n "AccessCode": "",\n "SourceIp": "1.1.1.1",\n "UserAgent": "",\n "SessionId": "111",\n "ServerName": "phub"\n}\n'})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Get the DCR ID: ",(0,i.jsx)(n.strong,{children:"Home > Resource Groups > Sentinel"}),", select ",(0,i.jsx)(n.code,{children:"myTestDCR"}),", and copy the ",(0,i.jsx)(n.strong,{children:"Immutable ID"})," ",(0,i.jsx)(n.code,{children:"dcr-dddddddddddddddddd"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"get-the-stream-name",children:"Get the stream name"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Resource Group > Sentinel"}),": Select your DCR. On the DCR page, select ",(0,i.jsx)(n.strong,{children:"Data Sources"})," on the left, then\nswitch to the ",(0,i.jsx)(n.code,{children:"classic version"})," in the blue horizontal bar."]}),"\n",(0,i.jsx)(n.p,{children:"Read the Data Source name (starts with Custom_, ends with _CL): Custom-nnnnnnnnn_CL"}),"\n",(0,i.jsx)(n.h3,{id:"3-configure-passhub",children:"3. Configure Pass
1hub"}),"\n",(0,i.jsx)(n.p,{children:"Add the following constants, obtained above, to the Passhub configuration file:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-php",children:"define('MS_SENTINEL_ENABLED', true);\ndefine('MS_SENTINEL_TENANT_ID',\"tttttttt-tttt-tttt-tttt-tttttttttttt\");\ndefine('MS_SENTINEL_CLIENT_ID', \"cccccccc-cccc-cccc-cccc-cccccccccccc\");\ndefine('MS_SENTINEL_CLIENT_SECRET',\"ssssssssssssssssssssssssssssssssssssssss\");\ndefine('MS_SENTINEL_DCE_ENDPOINT', \"https://*the-dce-name*-igcm.eastus-1.ingest.monitor.azure.com\");\ndefine('MS_SENTINEL_DCR_IMMUTABLE_ID', \"dcr-dddddddddddd\");\ndefine('MS_SENTINEL_STREAM_NAME','Custom-nnnnnnnnn_CL'); // Data Source Name\n"})}),"\n",(0,i.jsx)(n.p,{children:"Now, in addition to collecting events in its own database, Passhub will send each event's data to the Sentinel table."}),"\n",(0,i.jsx)(n.h2,{id:"crowdstrike-next-gen-siem",children:"CrowdStrike Next-Gen SIEM"}),"\n",(0,i.jsxs)(n.p,{children:["If you use CrowdStrike then you may connect your PassHub to the Next-Gen SIEM.\n",(0,i.jsx)("br",{}),"Here are the main steps:"]}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsx)(n.li,{children:"Make a Custom Connector and Parser inside CrowdStrike"}),"\n",(0,i.jsx)(n.li,{children:"Configure parameters for Passhub"}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"1-customize-next-gen-siem",children:"1. Customize Next-Gen SIEM"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["From the Main Page go to ",(0,i.jsx)(n.strong,{children:"Next Gen SIEM"})," then under the ",(0,i.jsx)(n.strong,{children:"Log Management"})," tab go to ",(0,i.jsx)(n.strong,{children:"Data Onboarding"})]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"create-the-hec--http-connector",children:"Create the HEC / HTTP Connector"}),"\n",(0,i.jsxs)(n.ol,{start:"2",children:["\n",(0,i.jsx)(n.li,{children:'Create a new connection and click on "Add Connection"'}),"\n",(0,i.jsxs)(n.li,{children:["Look for the ",(0,i.jsx)(n.strong,{children:"HEC / HTTP Event Connector"})," by the vendor of ",(0,i.jsx)(n.strong,{children:"Generic"})," and author of ",(0,i.jsx)(n.strong,{children:"CrowdStrike"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Then on the right, click on ",(0,i.jsx)(n.strong,{children:"Configure"}),". From this we can now configure the custom connector to work with Passhub."]}),"\n",(0,i.jsxs)(n.li,{children:["Now type in a connection name such as: ",(0,i.jsx)(n.strong,{children:"Passhub Connector"})]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"create-the-custom-parser",children:"Create the Custom Parser"}),"\n",(0,i.jsxs)(n.ol,{start:"6",children:["\n",(0,i.jsx)(n.li,{children:'Click on "Create new parser", give it a name such as: Passhub Parser.'}),"\n",(0,i.jsxs)(n.li,{children:["Now you must download the custom parser file ",(0,i.jsx)(n.a,{target:"_blank","data-noBrokenLinkCheck":!0,href:s(8282).A+"",children:"found here"}),' which tells CrowdStrike how to read Passhub Logs, then click on the arrow, choose "Import" and upload the recently installed file.']}),"\n",(0,i.jsx)(n.li,{children:'From there you can copy the "API URL" and generate an "API Key" and finally copy the CID as well.'}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"2-configure-passhub",children:"2. Configure Passhub"}),"\n",(0,i.jsx)(n.p,{children:"Add the variables that were retrieved/generated in Step 1 and input into the Config.php file"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-php",children:"define('CROWDSTRIKE_INGEST_URL', 'https://your-logscale-host/api/v1/ingest/hec/event');\ndefine('CROWDSTRIKE_HEC_TOKEN', 'your_hec_ingest_token_here');\ndefine('CROWDSTRIKE_HEC_SOURCE', 'passhub');\ndefine('CROWDSTRIKE_HEC_SOURCETYPE', 'passhub:audit');\ndefine('CROWDSTRIKE_HEC_HOST', 'passhub.company.com');\n"})}),"\n",(0,i.jsx)(n.p,{children:"Now, in addition to collecting events in its own database, Passhub will send each event's data to the CrowdStrike SIEM."})]})}function h(e={}){let{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},8282(e,n,s){s.d(n,{A:()=>t});let t=s.p+"assets/files/crowdstrikeWWPassParser-555d7b69d1de0ce4a457b9015deeb867.txt"},8453(e,n,s){s.d(n,{R:()=>c,x:()=>a});var t=s(6540);let i={},r=t.createContext(i);function c(e){let n=t.useContext(r);return t.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:c(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.