Supplier Risk Microsoft Sentinel Integration

The Censys Supplier Risk Microsoft Sentinel integration sends risk events to your Log Analytics workspace for correlation and use in incident workflows. It also adds a workbook dashboard with visualizations you can use to filter and review your supply chain risks.

Use this integration to centralize data in Sentinel so your team can effectively understand and take action to remediate risks in your supply chain.

Prerequisites

• A Log Analytics workspace with Microsoft Sentinel enabled.

  • The workspace name, resource group, and location (for example, eastus)for your workspace. Obtain this information from the Overview page for your Log Analytics workspace.
  • The resource ID for your workspace. It is located under Overview > Settings > Properties and uses the following format.
    Text

    /subscriptions/<subscription-id>/resourceGroups/<resource-group>
    /providers/Microsoft.OperationalInsights/workspaces/<workspace-name>

• An Azure subscription with contributor access to the resource group of your Microsoft Sentinel workspace.

• An Azure user with Owner or User Access Administrator on your resource group to handle role assignment access.

• Permission to register an app in Microsoft Entra ID.

• The deployment template file (mainTemplate.json). Obtain this from Censys.

• Your Censys Platform organization ID.

  • To obtain your organization ID:

    1. Open the Platform web console and ensure that your organization account is selected. Go to Settings > Account Management > Personal Access Tokens.

    2. The ID for your organization is shown in the "Current Organization" box. Click Copy to copy it to your clipboard.

       

• A Censys Platform Personal Access Token (PAT). Instructions on how to create and manage PATs are available in the API documentation.

  • The user associated with the PAT must have access to the Supplier Risk module.

1. Install the Supplier Risk template in Azure

First, deploy the integration in Azure using the template file provided by Censys.

1. Sign in to the Azure portal.
2. In the search box, type "Deploy a custom template" and select it.
3. Select Build your own template in the editor.
4. Select Load file, choose mainTemplate.json, and select Save.
5. On the next page, set the following values.

   Field	Value
   Subscription	The subscription of your workspace.
   Resource group	The resource group of your workspace.
   Region	The region of the resource group.
   Workspace	The name of your Log Analytics workspace.
   Workspace-location	The location of your workspace, for example eastus.
   Workbook1-name	Leave the default Censys Supplier Risk value.
   Location	Leave the default value.

6. Select Review + create, then select Create.
7. Wait until the page shows "your deployment is complete."

Check your installation

1. Open Microsoft Sentinel and select your workspace.
2. Go to Content management > Content hub.
3. Filter by Status: Installed and search for "Censys Supplier Risk."
4. Confirm that the integration is listed.

2. Register the Supplier Risk Entra ID application

1. In the Azure portal, open Microsoft Entra ID.
2. Go to App registrations > New registration.
3. Enter a name, for example "Censys Supplier Risk," and select Register.
4. On the Overview page, copy and save the Application (client) ID and the Directory (tenant) ID.
5. Go to Certificates & secrets > Client secrets > New client secret.
6. Enter a description, select an expiration, and select Add.
7. Copy and save your new secret in a secure location. The value is shown only once.
8. Go back to Microsoft Entra ID and select Enterprise applications.
9. Search for your application by name and open it.
10. On the Overview page, copy and save the Object ID.

3. Deploy the data connector in Azure

1. Open Microsoft Sentinel and select your workspace.
2. Select Configuration > Data connectors.
3. Search for and select Censys Supplier Risk (using Azure Functions).
4. Select Open connector page.
5. Scroll to "Option 1 - Azure Resource Manager (ARM) Template."
6. Select Deploy to Azure.
7. On, the custom deployment page, select the Subscription and the Resource group of your workspace.
8. Enter the following values from the following table.

   Field	Value
   Censys SR Function Name	A name prefix of up to 10 characters. Default: CensysSR.
   Censys Api Key	Your Censys Platform PAT.
   Censys Organization Id	Your Censys Platform organization ID.
   Censys Start Date Time	Optional. Start time in UTC, for example 2026-10-01T00:00:00Z. Leave empty to collect all available events.
   Censys Supplier Names	Optional. Supplier names separated by *, for example Censys*ExampleCo. Leave empty for all suppliers.
   Censys Risk Names	Optional. Risk names separated by *, for example Exposed SMTP Service*Self-Signed Certificate. Leave empty for all risks.
   Censys Change Types	Optional. Risk change status. Any of opened, resolved, and reopened, separated by commas. Leave empty for all.
   Censys Severity	Optional. Risk severity. Any of LOW, MEDIUM, HIGH, and CRITICAL, separated by commas. Leave empty for all.
   Censys Rapid Response	Optional. true for Censys ARC Rapid Response risks only, false to exclude them. Leave empty for both.
   Azure_Client_Id	Your application (client) ID.
   Azure_Client_Secret	Your client secret value.
   Azure_Tenant_Id	Your directory (tenant) ID.
   Azure_Entra_Object_Id	The object ID of your enterprise application.
   WorkspaceName	The name of your workspace.
   Location	The location of your workspace. Default: the location of the resource group.
   Censys Risk Events Table Name	Leave the default CensysRiskEvents_CL.
   Censys Risk Events Collection Schedule	Leave the default 0 */10 * * * * (every 10 minutes)
   Censys Supplier and Risk List Refresh Schedule	Leave the default 0 */30 * * * * (every 30 minutes)
   AppInsightsWorkspaceResourceID	The workspace Resource ID described in the prerequisites section of this document.
   Censys SR Function Log Level	Leave the default INFO.

9. Select Review + create then select Create.
10. Wait until the page shows "your deployment is complete."

4. Verify Supplier Risk data is present

Data appears about 10 to 15 minutes after deployment. A large organization may need several runs. Each run collects part of the data, and the next run continues from where the previous run stopped.

1. Open Microsoft Sentinel and select Logs.
2. Run the following query and confirm that it returns rows.
   Text

   CensysRiskEvents
   | take 10

3. Run the following query to see the number of events.
   Text

   CensysRiskEvents
   | summarize Events = count(), LastEvent = max(IngestedAt)

4. Open Data connectors, select Censys Supplier Risk (using Azure Functions), and confirm that the status is "Connected."

Additionally, check the function app using the following process:

1. In the Azure portal, open the resource group and select the Function App that was created.
2. Select Functions and confirm that these two functions are listed:
   • CensysSRRiskEvents
   • CensysSRSuppliersAndRisks
3. Select a function, then Invocations, and confirm that recent runs show "Success."

5. Create the analytic rule

1. Open Microsoft Sentinel and go to Configuration > Analytics.
2. Select the Rule templates tab.
3. Search for and select Censys SR - Risk State Change.
4. Select Create rule.
5. On the "General" tab, keep the default values and ensure that "Status" is set to Enabled.
6. On the "Set rule logic" tab, keep the default query and schedule. The rule runs every hour and looks back one day.
7. On the "Incident settings" tab, keep "Create incidents from alerts triggered by this analytics rule" enabled. Keep "alert grouping" enabled with the grouping by "RiskInstanceId" and a lookback of 24 hours.
8. Select Next: Automated response, then Next: Review + create.
9. Select Save.

By default, the rule creates an alert for each event that is opened or reopened with CRITICAL or HIGH severity. Alerts of the same risk instance are grouped into one incident.

View the results:

1. Wait until the rule has run. The rule runs every hour.
2. Open Threat management > Incidents.
3. Search for "Censys" to see incidents.

Change what the rule alerts on (optional)

The query of the rule contains lines that start with //. You can turn them on.

1. Select Configuration > Analytics > Active rules.
2. Select the rule Censys SR - Risk State Change then select Edit.
3. On the "Set rule logic" tab, find the filter you want in the query.
4. Remove the two // at the start of the line.
5. Select Next: Incident settings, continue to Review + create, and select Save.

To follow the whole life of a risk, including resolved events and reopened events of every severity, follow the instructions in the comments at the top of the query. Additionally, set the query period and the incident grouping lookback to seven days.

6. Use the Censys Supplier Risk workbook dashboard

To save and open the workbook:

1. Open Microsoft Sentinel and select Threat management > Workbooks.
2. Select the Templates tab.
3. Search for and select Censys Supplier Risk.
4. Select Save, choose a location, and select OK.
5. Select View saved workbook.

The workbook contains the following panels:

• Open Risk Count by Severity
• Risk Events by Category
• Opened vs. Closed Risks
• Top 10 Risks by Open Risk Count
• Supplier Risk Ranking
• Rapid Response Events

To see details, select a slice of a pie chart, a point of the line chart, or a row of a table. A table with the matching events opens below the panel.

7. Modify connector settings (optional)

You can modify the following connector settings.

To modify a setting:

1. In the Azure portal, open the Function App of the connector.
2. Select Settings > Environment variables.
3. Select the setting you want to change, enter the new value, and select Apply.
4. Select Apply and confirm to save. The app restarts with the new values.

Read connector log messages

To read the log messages of the connector:

1. In the Azure portal, open the Function App.
2. Go to Monitoring > Logs and run the following query.
   Text

   traces
   | where message has "CensysSR"
   | project timestamp, message
   | order by timestamp desc