azureazure-sentinel

Does using Azure Whois api needs microsoft sentinel to be set up or it can be used stand alone

I just need whois information of domains and came across azure whois api. Do I need to set up azure sentinel or can I use api directly?. I have multiple virtual machines on azure. If I need to set up sentinel what will it cost since we won't be feeding it any logs .

Solution

  • Initially, register one Entra ID application and create one client secret in it like this:

    enter image description here

    Now, I assigned Reader role to above service principal under Azure subscription:

    enter image description here

    To generate access token, I used client credentials flow with below parameters via Postman:

    POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token
grant_type:client_credentials
client_id:appID
client_secret:secret
scope: https://management.azure.com/.default

    Response:

    enter image description here

    When I used this token to call Domain Whois API, I got the response successfully as below:

    GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.SecurityInsights/enrichment/domain/whois/?api-version=2024-01-01-preview&domain={domain}

    Response:

    enter image description here