Forum Discussion

Iron Contributor

Jul 29, 2019

Linux Connectors - MCAS & Sentinel

Just checking – as we are looking at trying to get more info feeding in to the solution and there is a Bluecoat Proxy + Cisco ASA transferring to Palo Alto. As there is no “connector” listed for Blu...

microsoft defender for cloud apps

Nicholas DiCola (SECURITY JEDI)

Former Employee

Jul 29, 2019

David Caddick

Hi David

It is not suggested to send bluecoat to MCAS then to Sentinel. MCAS will only get the HTTP logs it needs for discovery.

You should send bluecoat logs to a sentinel CEF collector (https://support.symantec.com/us/en/article.tech242216.html) then you would have the raw syslog data in sentinel for use.

You would not be able to run an MCAS log collector and a Sentinel CEF collector on the same box. they both listen on port 514. But for a poc you likely only need 1 sentinel connector to collect from ASA, bluecoat and PAN.

David Caddick

Iron Contributor

Jul 30, 2019

Thanks Nicholas

So maybe I haven't understood that correctly, or is it a case that I can use a single Linux Collector (in a PoC) for Sentinel and *it* can then be used to collect multiple streams (ASA, BlueCoat & Palo Alto) while it's only destined for the one Sentinel location?

If we were to try and use this for both Sentinel and MCAS this is when this breaks - we can't use a Linux Collector to stream for two different services... Is this correct?