Secure WRIKE using AZURE SENTINEL

Wrike is a product management software, widely used in various industries like Health Care, Information Technology and even Finance. It is one of the top rated PMS with excellent security handling. To bolster its security even more we have a custom solution to monitor the various activities happening within the Wrike environment using Azure Sentinel. With the variety of contents provided, we can have a bird's eye view as well as a granular control over Wrike security.

Inspiration

Wrike is not just restricted to one sector instead it has users from Siemens, Walmart, Capgemini, Nickelodeon, Sony Pictures and many more. Now along with the capabilities of Azure Sentinel we can provide a much more in-depth security analysis and overview to the SOC team.

What it does?

One of the beautiful features of Azure Sentinel is its ability to ingest different types of logs using multiple methods and the integration of Sentinel along with Azure Defender gives a cross-domain view within the cloud environment. Our project consists of :

• Data Connector
• Analytic Rules
• Threat Hunting Queries
• Parser
• Playbook
• Workbook

Project Architechture

Steps for generating Wrike API Key

• Open your Wrike Workspace
• Go to Apps & Integrations at the top-right of your workspace
• Then go to API at the top-left of your screen.
• Enter an API name and then click on Create.
• Open your App and the scroll down to Create Token.
• Enter your Wrike workspace password.
• Then click on Copy Token to copy the Permanent Access Token for further use.

Steps to log data into Azure Sentinel

• Create your Azure Sentinel Workspace and then obtain the WORKSPACEID and PRIMARY/SECONDARY KEY.
• Clone the git repository in your local computer.
  git clone https://github.com/ParanjoyG/Secure_WRIKE_using_AZURE_SENTINEL.git
• Go to the follwing path
  .../Secure_Wrike_using_AZURE_SENTINEL/DataConnector_Manual/
• Install the required dependencies
  pip install -r requirements.txt
• Run the program complete.py
• Provide the required inputs - WorksspaceID, Primary Key, Wrike Access Token
• Your data will be logged in a custom log table with the name AuditLog_CL

Brief Overview of the solution

• Parser : Used to normalise the ingested data. Save this KQL query in the log analytics worksapce as a function as WrikeAudit
• Analytic Rules : Use these to create alerts and incidents for various threat tactics which you can investigate further.
• Threat Hunting : Queries to proactively hunt for threat in your Wrike environment.
• Workbook : Visualise trends in your data.
• Playbook : Performing SOAR against various threats.