Forum Discussion
Quest Change Auditor (https://www.quest.com/change-auditor ) integration with Sentinel
Hi All, Hope you are well. Just wanted to know if anyone has integrated Quest Change Auditor with Sentinel please? If yes, wha was the method used . Regards, Maxou
Rod_Trent
Microsoft
MicrosoftMaxou I worked with a customer recently to get Edgewise configured for ingestion with Sentinel and Change Auditor seems very similar in function.
Does Change Auditor have the ability to export data? If so, you can use the Log Analytics agent to deliver the data to a custom table in the Azure Sentinel Log Analytics Workspace.
Ask Quest if this is possible, or if they have instructions for integrating their product with other SIEMS.
- Hi Rod_Trent, Thanks for coming back to me. On their website they say they integrate with Arcsight, Splunk and Qradar for SIEM but there was no mention of Sentinel.
I will probably have to get in touch with them to see if CEF or Syslog can be something of use for integrating their logs with Sentinel.- Rod_Trent
Maxou Definitely let me know what comes of it. Very interested.
The methods Quest uses for the other SIEMs would be very similar to how we do it. We still have customers that run other SIEMs side-by-side with Sentinel - either long term, or as a migration path.
We can even import csv and JSON data files, btw.
