Log Export and SIEM Integration
Many customers forward PKI events to a Security Information and Event Management (SIEM) platform such as Microsoft Sentinel, Splunk or QRadar. This page describes which logs exist and how they can be brought into a SIEM.
Log sources
| Log | Held by | How the customer gets it |
|---|---|---|
| Portal activity logs (user, certificate, approval, administration, system) | Portal | Filter and export to CSV from Auditing and Logs; the exported logs can be imported into the customer's SIEM |
| Enrollment Gateway and CEP logs | Customer servers | Forward with the customer's own agent (for example Windows Event Forwarding or the SIEM agent) |
| NDES and IIS logs | Customer servers | Forward with the customer's own agent |
Recommended detections
- Repeated failed portal sign-ins for one account.
- Revocations with reason Key Compromise.
- Changes to roles, users, departments, policies or CAs.
- Certificates approved by the same person who requested them.
- A sudden rise in failed enrollment requests (often a template, permission or network problem).
- Issuance from templates that are rarely used, such as code signing.
Retention
Portal logs are kept by EC for the retention period defined in the subscription agreement. Customers that must keep logs longer export them regularly or stream them to their SIEM.