Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 70bff9f

Browse files
yelevinyelevin
committedAug 17, 2021
Added REST-API template
1 parent 1677f1e commit 70bff9f

File tree

4 files changed

+123
-81
lines changed

4 files changed

+123
-81
lines changed
 

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25744,6 +25744,11 @@
2574425744
"redirect_url": "/azure/sentinel/connect-common-event-format",
2574525745
"redirect_document_id": false
2574625746
},
25747+
{
25748+
"source_path_from_root": "/articles/sentinel/connect-symantec.md",
25749+
"redirect_url": "",
25750+
"redirect_document_id": false
25751+
},
2574725752
{
2574825753
"source_path_from_root": "/articles/service-bus/index.md",
2574925754
"redirect_url": "/azure/service-bus-messaging/index",

‎articles/sentinel/connect-rest-api-template.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
title: Connect your data source to Azure Sentinel's REST-API to ingest data | Microsoft Docs
3+
description: Learn how to connect external systems to Azure Sentinel's Data Collector API to ingest their log data to custom logs in your workspace.
4+
services: sentinel
5+
documentationcenter: na
6+
author: yelevin
7+
manager: rkarlin
8+
editor: ''
9+
10+
ms.service: azure-sentinel
11+
ms.subservice: azure-sentinel
12+
ms.devlang: na
13+
ms.topic: how-to
14+
ms.tgt_pltfrm: na
15+
ms.workload: na
16+
ms.date: 08/17/2021
17+
ms.author: yelevin
18+
19+
---
20+
# Connect your data source to Azure Sentinel's REST-API to ingest data
21+
22+
[!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)]
23+
24+
API integrations built by third-party vendors pull data from their products' data sources and connect to Azure Sentinel's [Azure Monitor Data Collector API](../azure-monitor/logs/data-collector-api.md) to push the data into custom log tables in your Azure Sentinel workspace.
25+
26+
For the most part, you can find all the information you need to configure these data sources to connect to Azure Sentinel in each vendor's documentation.
27+
28+
Check your product's section in the [data connectors reference](data-connectors-reference) page for any extra instructions that may appear there, and for the links to your vendor's instructions.
29+
30+
> [!NOTE]
31+
> Data will be stored in the geographic location of the workspace on which you are running Azure Sentinel.
32+
33+
## Prerequisites
34+
35+
- You must have read and write permissions on the Azure Sentinel workspace.
36+
37+
- You must have read permissions to shared keys for the workspace.
38+
39+
## Configure and connect your data source
40+
41+
1. In the Azure Sentinel portal, click **Data connectors** on the navigation menu.
42+
43+
1. Select your product's entry from the data connectors gallery, and then click the **Open connector page** button.
44+
45+
1. Follow any steps that appear on the connector page, or any links to vendor instructions that appear there.
46+
47+
1. When asked for the Workspace ID and the Primary Key, copy them from the data connector page and paste them into the configuration as directed by your vendor's instructions. See the example below.
48+
49+
:::image type="content" source="media/connect-rest-api-template/workspace-id-primary-key.png" alt-text="Workspace ID and Primary Key":::
50+
51+
## Find your data
52+
53+
After a successful connection is established, the data appears in **Logs** under the **CustomLogs** section. See your product's section in the [data connectors reference](data-connectors-reference) page for the table names.
54+
55+
To query the data from your product, use those table names in your query.
56+
57+
It may take up to 20 minutes before your logs start to appear in Log Analytics.
58+
59+
## Next steps
60+
61+
In this document, you learned how to connect external data sources to Azure Sentinel's Data Collector API. To take full advantage of the capabilities built in to these data connectors, click on the **Next steps** tab on the data connector page. There you'll find some ready-made sample queries, workbooks, and analytics rule templates so you can get started finding useful information.
62+
63+
To learn more about Azure Sentinel, see the following articles:
64+
65+
- Learn how to [get visibility into your data and potential threats](get-visibility.md).
66+
- Get started [detecting threats with Azure Sentinel](detect-threats-built-in.md).
67+
- [Use workbooks](monitor-your-data.md) to monitor your data.

‎articles/sentinel/data-connectors-reference.md

Lines changed: 51 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -485,8 +485,6 @@ Configure eNcore to stream data via TCP to the Log Analytics Agent. This should
485485

486486
## Cognni (Preview)
487487

488-
The Cognni data connector offers a quick and simple integration to Azure Sentinel. You can use Cognni to autonomously map previously unclassified important information and detect related incidents. Cognni helps you recognize risks to your important information, understand the severity of the incidents, and investigate the details you need to remediate, fast enough to make a difference.
489-
490488
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
491489
| --- | --- |
492490
| **Log Analytics table(s)** | |
@@ -506,12 +504,10 @@ The Cognni data connector offers a quick and simple integration to Azure Sentine
506504

507505
## Cyberpion Security Logs (Preview)
508506

509-
The Cyberpion Security Logs data connector ingests logs from the Cyberpion system directly into Azure Sentinel. For more information, see [Azure Sentinel](https://www.cyberpion.com/resource-center/integrations/azure-sentinel/) in the Cyberpion documentation.
510-
511507
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
512508
| --- | --- |
513509
| **Log Analytics table(s)** | |
514-
| **Vendor documentation/<br>installation instructions** | |
510+
| **Vendor documentation/<br>installation instructions** | [Azure Sentinel](https://www.cyberpion.com/resource-center/integrations/azure-sentinel/) |
515511
| **Supported by** | Cyberpion |
516512
|
517513

@@ -554,8 +550,6 @@ The Cyberpion Security Logs data connector ingests logs from the Cyberpion syste
554550

555551
## ESET Security Management Center (SMC) (Preview)
556552

557-
The ESET SMC data connector ingests ESET SMC threat events, audit logs, firewall events, and website filters into Azure Sentinel. For more information, see [Syslog server](https://help.eset.com/esmc_admin/70/en-US/admin_server_settings_syslog.html) in the ESET SMC documentation.
558-
559553
**Data ingestion method:** [Log Analytics Agent custom logs](connect-data-sources.md#custom-logs).
560554

561555
| **Supported by** | [ESET](https://support.eset.com/en)
@@ -677,10 +671,6 @@ Configure Eset Logs using BSD style and JSON format.
677671
678672
## ExtraHop Reveal(x)
679673
680-
The ExtraHop Reveal(x) data connector connects your Reveal(x) system to Azure Sentinel. Azure Sentinel integration requires the ExtraHop Detection SIEM Connector. To install the SIEM Connector on your Reveal(x) system, follow the instructions at .
681-
682-
For more information about connecting to Azure Sentinel, see [Connect ExtraHop Reveal(x) to Azure Sentinel](connect-extrahop.md).
683-
684674
| Data ingestion method: | [Common Event Format (CEF)](connect-common-event-format.md) over Syslog |
685675
| --- | --- |
686676
| **Log Analytics table(s)** | CommonSecurityLog |
@@ -730,14 +720,10 @@ For more information about connecting to Azure Sentinel, see [Connect ExtraHop R
730720
731721
## Forcepoint Data Loss Prevention (DLP) (Preview)
732722
733-
The Forcepoint DLP data connector automatically exports DLP incident data from Forcepoint DLP into Azure Sentinel in real time. For more information, see [Forcepoint Data Loss Prevention and Azure Sentinel](https://forcepoint.github.io/docs/dlp_and_azure_sentinel/).
734-
735-
For more information about connecting to Azure Sentinel, see [Connect Forcepoint DLP to Azure Sentinel](connect-forcepoint-dlp.md).
736-
737723
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
738724
| --- | --- |
739725
| **Log Analytics table(s)** | |
740-
| **Vendor documentation/<br>installation instructions** | |
726+
| **Vendor documentation/<br>installation instructions** | [Forcepoint Data Loss Prevention and Azure Sentinel](https://forcepoint.github.io/docs/dlp_and_azure_sentinel/) |
741727
| **Supported by** | [Forcepoint](https://support.forcepoint.com/) |
742728
|
743729
@@ -770,6 +756,23 @@ For more information about connecting to Azure Sentinel, see [Connect Forcepoint
770756
| **Supported by** | [Fortinet](https://support.fortinet.com/) |
771757
|
772758
759+
### Send Fortinet logs to the log forwarder
760+
761+
Open the CLI on your Fortinet appliance and run the following commands:
762+
763+
```Console
764+
config log syslogd setting
765+
set status enable
766+
set format cef
767+
set port 514
768+
set server <ip_address_of_Forwarder>
769+
end
770+
```
771+
772+
- Replace the server **ip address** with the IP address of the log forwarder.
773+
- Set the **syslog port** to **514** or the port set on the Syslog daemon on the forwarder.
774+
- To enable CEF format in early FortiOS versions, you might need to run the command set **csv disable**.
775+
773776
## GitHub Enterprise Cloud Audit Log - Polling (Preview)
774777
775778
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
@@ -933,46 +936,33 @@ Add http://localhost:8081/ under **Authorised redirect URIs** while creating [We
933936
934937
## NXLog Basic Security Module (BSM) macOS (Preview)
935938
936-
The NXLog BSM macOS data connector uses the Sun BSM Auditing API to capture audit events directly from the kernel on the macOS platform. This data connector can efficiently export macOS audit events to Azure Sentinel in real time. For more information, see the [NXLog Azure Sentinel User Guide](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html).
937-
938939
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
939940
| --- | --- |
940941
| **Log Analytics table(s)** | |
941-
| **Vendor documentation/<br>installation instructions** | |
942-
| **Supported by** | |
942+
| **Vendor documentation/<br>installation instructions** | [NXLog Azure Sentinel User Guide](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html) |
943+
| **Supported by** | [NXLog](https://nxlog.co/community-forum) |
943944
|
944945
945-
| **Supported by** | [NXLog](https://nxlog.co/community-forum)
946946
947947
## NXLog DNS Logs (Preview)
948948
949-
The NXLog DNS Logs data connector uses Event Tracing for Windows (ETW) to collect both audit and analytical DNS server events. For maximum efficiency, the NXLog im_etw module reads event tracing data directly, without having to capture the event trace into an *.etl* file. This REST API connector can forward DNS server events to Azure Sentinel in real time. For more information, see the [NXLog Azure Sentinel User Guide](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html).
950-
951-
For more information about connecting to Azure Sentinel, see [Connect NXLog (Windows) DNS Logs to Azure Sentinel](connect-nxlog-dns.md).
952-
953949
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
954950
| --- | --- |
955951
| **Log Analytics table(s)** | |
956-
| **Vendor documentation/<br>installation instructions** | |
957-
| **Supported by** | |
952+
| **Vendor documentation/<br>installation instructions** | [NXLog Azure Sentinel User Guide](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html) |
953+
| **Supported by** | [NXLog](https://nxlog.co/community-forum) |
958954
|
959955
960-
| **Supported by** | [NXLog](https://nxlog.co/community-forum)
961956
962957
## NXLog LinuxAudit (Preview)
963958
964-
The NXLog LinuxAudit data connector supports custom audit rules and collects logs without using AuditD or other user software. The connector resolves IP addresses and group/user IDs to their respective names, making Linux audit logs more intelligible. This REST API connector can export Linux security events to Azure Sentinel in real time. For more information, see the [NXLog Azure Sentinel User Guide](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html).
965-
966-
For more information about connecting to Azure Sentinel, see [Connect NXLog LinuxAudit to Azure Sentinel](connect-nxlog-linuxaudit.md).
967-
968959
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
969960
| --- | --- |
970961
| **Log Analytics table(s)** | |
971-
| **Vendor documentation/<br>installation instructions** | |
972-
| **Supported by** | |
962+
| **Vendor documentation/<br>installation instructions** | [NXLog Azure Sentinel User Guide](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html) |
963+
| **Supported by** | [NXLog](https://nxlog.co/community-forum) |
973964
|
974965
975-
| **Supported by** | [NXLog](https://nxlog.co/community-forum)
976966
977967
## Okta Single Sign-On (Preview)
978968
@@ -1024,18 +1014,13 @@ For more information about connecting to Azure Sentinel, see [Connect NXLog Linu
10241014
10251015
## Orca Security (Preview)
10261016
1027-
The Orca Security Alerts connector automatically exports Alerts logs to Azure Sentinel. For more information, see [Azure Sentinel integration](https://orcasecurity.zendesk.com/hc/en-us/articles/360043941992-Azure-Sentinel-configuration).
1028-
1029-
For more information about connecting to Azure Sentinel, see [Connect Orca Security to Azure Sentinel](connect-orca-security-alerts.md).
1030-
10311017
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
10321018
| --- | --- |
10331019
| **Log Analytics table(s)** | |
1034-
| **Vendor documentation/<br>installation instructions** | |
1035-
| **Supported by** | |
1020+
| **Vendor documentation/<br>installation instructions** | [Azure Sentinel integration](https://orcasecurity.zendesk.com/hc/en-us/articles/360043941992-Azure-Sentinel-configuration) |
1021+
| **Supported by** | [Orca Security](http://support.orca.security/) |
10361022
|
10371023
1038-
| **Supported by** | [Orca Security](http://support.orca.security/)
10391024
10401025
## OSSEC (Preview)
10411026
@@ -1061,19 +1046,13 @@ For more information about connecting to Azure Sentinel, see [Connect Orca Secur
10611046
10621047
## Perimeter 81 Activity Logs (Preview)
10631048
1064-
The Perimeter 81 Activity Logs data connector connects Perimeter 81 activity logs to Azure Sentinel. For more information, see the Perimeter 81 [Azure Sentinel](https://support.perimeter81.com/docs/360012680780) documentation.
1065-
1066-
For more information about connecting to Azure Sentinel, see [Connect Perimeter 81 logs to Azure Sentinel](connect-perimeter-81-logs.md).
1067-
10681049
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
10691050
| --- | --- |
10701051
| **Log Analytics table(s)** | |
1071-
| **Vendor documentation/<br>installation instructions** | |
1072-
| **Supported by** | |
1052+
| **Vendor documentation/<br>installation instructions** | [Perimeter 81 documentation](https://support.perimeter81.com/docs/360012680780) |
1053+
| **Supported by** | [Perimeter 81](https://support.perimeter81.com/) |
10731054
|
10741055
1075-
| **Supported by** | [Perimeter 81](https://support.perimeter81.com/)
1076-
10771056
10781057
## Proofpoint On Demand (POD) Email Security (Preview)
10791058
@@ -1249,18 +1228,13 @@ Follow the instructions to obtain the credentials.
12491228
12501229
## Sophos Cloud Optix (Preview)
12511230
1252-
The Sophos Cloud Optix data connector connects your Sophos Cloud Optix logs to Azure Sentinel. For more information, in your Cloud Optix settings, see the Azure Sentinel [integrations page](https://optix.sophos.com/#/integrations/sentinel).
1253-
1254-
For more information about connecting to Azure Sentinel, see [Connect Sophos Cloud Optix to Azure Sentinel](connect-sophos-cloud-optix.md).
1255-
12561231
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
12571232
| --- | --- |
12581233
| **Log Analytics table(s)** | |
1259-
| **Vendor documentation/<br>installation instructions** | |
1260-
| **Supported by** | |
1234+
| **Vendor documentation/<br>installation instructions** | [Azure Sentinel integrations page](https://optix.sophos.com/#/integrations/sentinel) |
1235+
| **Supported by** | [Sophos](https://secure2.sophos.com/en-us/support.aspx) |
12611236
|
12621237
1263-
| **Supported by** | [Sophos](https://secure2.sophos.com/en-us/support.aspx)
12641238
12651239
## Sophos XG Firewall (Preview)
12661240
@@ -1275,18 +1249,13 @@ For more information about connecting to Azure Sentinel, see [Connect Sophos Clo
12751249
12761250
## Squadra Technologies secRMM
12771251
1278-
The Squadra Technologies secRMM data connector pushes USB removable storage security event data into Azure Sentinel. For more information, see the [secRMM Azure Sentinel Administrator Guide](https://www.squadratechnologies.com/StaticContent/ProductDownload/secRMM/9.9.0.0/secRMMAzureSentinelAdministratorGuide.pdf).
1279-
1280-
For more information about connecting to Azure Sentinel, see [Connect Squadra Technologies secRMM to Azure Sentinel](connect-squadra-secrmm.md).
1281-
12821252
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
12831253
| --- | --- |
12841254
| **Log Analytics table(s)** | |
1285-
| **Vendor documentation/<br>installation instructions** | |
1286-
| **Supported by** | |
1255+
| **Vendor documentation/<br>installation instructions** | [secRMM Azure Sentinel Administrator Guide](https://www.squadratechnologies.com/StaticContent/ProductDownload/secRMM/9.9.0.0/secRMMAzureSentinelAdministratorGuide.pdf) |
1256+
| **Supported by** | [Squadra Technologies](https://www.squadratechnologies.com/Contact.aspx) |
12871257
|
12881258
1289-
| **Supported by** | [Squadra Technologies](https://www.squadratechnologies.com/Contact.aspx)
12901259
12911260
## Squid Proxy (Preview)
12921261
@@ -1302,18 +1271,13 @@ For more information about connecting to Azure Sentinel, see [Connect Squadra Te
13021271
13031272
## Symantec Integrated Cyber Defense Exchange (ICDx)
13041273
1305-
The Symantec ICDx data connector connects Symantec security solutions logs to Azure Sentinel. For more information, see [Connect your Symantec ICDx appliance](connect-symantec.md).
1306-
1307-
For more information about connecting to Azure Sentinel, see [Connect Symantec ICDx to Azure Sentinel](connect-symantec.md).
1308-
13091274
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
13101275
| --- | --- |
1311-
| **Log Analytics table(s)** | |
1312-
| **Vendor documentation/<br>installation instructions** | |
1313-
| **Supported by** | |
1276+
| **Log Analytics table(s)** | SymantecICDx_CL |
1277+
| **Vendor documentation/<br>installation instructions** | [Configuring Microsoft Azure Sentinel (Log Analytics) Forwarders](https://techdocs.broadcom.com/us/en/symantec-security-software/integrated-cyber-defense/integrated-cyber-defense-exchange/1-4-3/Forwarders/configuring-forwarders-v131944722-d2707e17438.html) |
1278+
| **Supported by** | [Broadcom Symantec](https://support.broadcom.com/security) |
13141279
|
13151280
1316-
| **Supported by** | [Broadcom Symantec](https://support.broadcom.com/security)
13171281
13181282
## Symantec ProxySG (Preview)
13191283
@@ -1361,10 +1325,6 @@ For more information about connecting to Azure Sentinel, see [Connect Symantec I
13611325
13621326
## Trend Micro TippingPoint (Preview)
13631327
1364-
The Trend Micro TippingPoint data connector connects TippingPoint SMS IPS events to Azure Sentinel.
1365-
1366-
For more information about connecting to Azure Sentinel, see [Connect Trend Micro TippingPoint to Azure Sentinel](connect-trend-micro-tippingpoint.md).
1367-
13681328
| Data ingestion method: | [Common Event Format (CEF)](connect-common-event-format.md) over Syslog, with a Kusto function parser |
13691329
| --- | --- |
13701330
| **Log Analytics table(s)** | CommonSecurityLog |
@@ -1486,18 +1446,28 @@ For more information about connecting to Azure Sentinel, see [Connect Trend Micr
14861446
14871447
## Zimperium Mobile Thread Defense (Preview)
14881448
1489-
Zimperium Mobile Threat Defense data connector connects the Zimperium threat log to Azure Sentinel to view dashboards, create custom alerts, and improve investigation. This connector gives you more insight into your organization's mobile threat landscape and enhances your security operation capabilities. For more instructions, see the [Zimperium customer support portal](https://support.zimperium.com/).
1449+
Zimperium Mobile Threat Defense data connector connects the Zimperium threat log to Azure Sentinel to view dashboards, create custom alerts, and improve investigation. This connector gives you more insight into your organization's mobile threat landscape and enhances your security operation capabilities. For more instructions, see the .
14901450
14911451
For more information about connecting to Azure Sentinel, see [Connect Zimperium to Azure Sentinel](connect-zimperium-mtd.md).
14921452
14931453
| Data ingestion method: | [REST-API](connect-rest-api-template.md) |
14941454
| --- | --- |
1495-
| **Log Analytics table(s)** | |
1496-
| **Vendor documentation/<br>installation instructions** | |
1497-
| **Supported by** | |
1455+
| **Log Analytics table(s)** | ZimperiumThreatLog_CL<br>ZimperiumMitigationLog_CL |
1456+
| **Vendor documentation/<br>installation instructions** | [Zimperium customer support portal](https://support.zimperium.com/) (login required) |
1457+
| **Supported by** | [Zimperium](https://www.zimperium.com/support) |
14981458
|
14991459
1500-
| **Supported by** | [Zimperium](https://www.zimperium.com/support)
1460+
### Configure and connect Zimperium MTD
1461+
1462+
1. In zConsole, click **Manage** on the navigation bar.
1463+
1. Click the **Integrations** tab.
1464+
1. Click the **Threat Reporting** button and then the **Add Integrations** button.
1465+
1. Create the Integration:
1466+
1. From the available integrations, select **Microsoft Azure Sentinel**.
1467+
1. Enter your *workspace ID* and *primary key*, click **Next**.
1468+
1. Fill in a name for your Azure Sentinel integration.
1469+
1. Select a **Filter Level** for the threat data you wish to push to Azure Sentinel.
1470+
1. Click **Finish**.
15011471
15021472
## Zoom Reports (Preview)
15031473

0 commit comments

Comments
 (0)
Please sign in to comment.