Forum Discussion
Karen McGregor
Microsoft
MicrosoftSentinel and data from GSuite, custom logs?
Is there any plan to integrate authentication/activity data from GSuite into Sentinel?
And - what's the plan to add custom log data (eg., LOB application logs) into Sentinel?
CliveWatsonMicrosoft
MicrosoftI cant answer part 1, but Log Analytics already has a Custom log feature https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-custom-logs you can enable that for the Log Analytics workspace Sentinel is using. There is also a CEF and Syslog connector in Sentinel.
Karen McGregorMicrosoft
MicrosoftThanks!
- If you have Cloud App Security you can pull logs with their setup ( https://docs.microsoft.com/en-us/cloud-app-security/connect-google-apps-to-microsoft-cloud-app-security) and then should be able to pull that into Sentinel via https://docs.microsoft.com/en-us/azure/sentinel/connect-cloud-app-security . It would be nice if they gave us a way to do it directly, though.
