Forum Discussion

gabormicskei's avatar
gabormicskei
Brass Contributor
Apr 15, 2020

on perm fileserver delete logs to cloud app security

Hi all,

 

Is there any way to send the delete file logs from on perm fileserver to CAS ?

 

Thanks.


Gabor

2 Replies

  • Joe Stocker's avatar
    Joe Stocker
    Bronze Contributor
    May 11, 2020
    I think what you are asking is if it is possible to monitor and alert when someone clears the security event log (Event ID 517 and 1102).
    Cloud App Security won't do that for you, but Azure Sentinel or Azure Log Analytics will:
    https://docs.microsoft.com/en-us/azure/sentinel/connect-windows-security-events

Resources