# CodeB -- Azure Sentinel custom-log setup

Docs: https://www.aloaha.com/siem-cookbook.html

CodeB does not push to Sentinel; the Sentinel Log Analytics agent (AMA)
tails our log files. European Digital Identity Wallet audit events land
in `codeb-oidc-*.log` and `tmp/wallet-*.log`.

## Step 1 - Install AMA on each CodeB IIS host

Use the Azure Portal or:

```powershell
Install-AzConnectedMachineExtension -ResourceGroupName rg-codeb `
  -Name AzureMonitorWindowsAgent -MachineName codeb-web-01 `
  -Location westeurope -ExtensionType AzureMonitorWindowsAgent `
  -Publisher Microsoft.Azure.Monitor -Settings @{}
```

## Step 2 - Create Data Collection Rules (DCRs)

One DCR per log stream so parsing rules stay isolated.

| Stream name | File path pattern |
| --- | --- |
| CodeBConn    | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\codeb-conn-*.log`  |
| CodeBOidc    | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\codeb-oidc-*.log`  |
| CodeBDial    | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\codeb-dial-*.log`  |
| CodeBCdr     | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\cdr\cdr-*.csv`    |
| CodeBBridge  | `C:\inetpub\wwwroot\WebPhone\tmp\codeb-bridge-*.log`              |
| CodeBWallet  | `C:\inetpub\wwwroot\WebPhone\tmp\wallet-*.log`                    |
| IISLogs      | `C:\inetpub\wwwroot\WebPhone\App_Data\weblogs\W3SVC*\*.log`     |

Each DCR sends into a custom table `CodeB_<Stream>_CL`.

## Step 3 - KQL parsers (save as functions)

```kql
CodeB_CodeBConn_CL
| extend loud_tag = extract(@"\[([A-Z][A-Z0-9\-]+)\]", 1, RawData)
| extend corr_id  = extract(@"corr=([A-Za-z0-9\-]+)", 1, RawData)
```

## Step 4 - Analytics rules

```kql
// RASP anomaly - runs every 5 minutes
CodeB_CodeBOidc_CL
| where TimeGenerated > ago(15m)
| where RawData contains "[RASP-"
| summarize count() by loud_tag = extract(@"\[(RASP-[A-Z0-9\-]+)\]", 1, RawData), Computer
| where count_ > 0
```

```kql
// Tenant isolation breach - immediate
CodeB_CodeBOidc_CL
| where TimeGenerated > ago(5m)
| where RawData contains "TENANT-ISOLATION-BREACH"
```

```kql
// mDoc verify failure - every 15 minutes
CodeB_CodeBOidc_CL
| where TimeGenerated > ago(15m)
| where RawData contains "MDOC-VERIFY"
| where RawData contains "fail" or RawData contains "denied"
```

```kql
// LOTL chain break - hourly
CodeB_CodeBOidc_CL
| where TimeGenerated > ago(1h)
| where RawData contains "LOTL-CHAIN"
| where RawData contains "broken" or RawData contains "untrusted"
```

```kql
// ACL auto-blacklist
CodeB_CodeBConn_CL
| where TimeGenerated > ago(10m)
| where RawData contains "auto-blacklist"
```

## Step 5 - Wire to incident automation

Route the RASP + tenant-breach rules to a Logic App or Sentinel playbook
that pages your on-call. Match severity to the loud tag:

- `RASP-*`, `MDOC-VERIFY` fail, `LOTL-CHAIN` broken -> High
- `TENANT-ISOLATION-BREACH` -> Critical
- ACL auto-blacklist -> Medium (informational unless burst)