Jul 28 2019 05:50 PM
Just checking – as we are looking at trying to get more info feeding in to the solution and there is a Bluecoat Proxy + Cisco ASA transferring to Palo Alto.
As there is no “connector” listed for Bluecoat in Sentinel, but there is one listed in MCAS, would it make sense to simply ingest the Bluecoat into MCAS and then have MCAS alerts feed into Sentinel?
While this might not be ideal that Sentinel does not have the raw data, at least it will have the Alerts, and by aggregating the data it will reduce the storage needs in Sentinel?
Would I be correct in thinking that it’s not possible to run a single Linux Connector that can run various tasks in a PoC scenario? So for the Cisco ASA & the Palo Alto we’d likely need two separate Linux Connectors, one for each task?
Jul 28 2019 11:49 PM
SolutionHi @David Caddick ,
We have plans on streaming MCAS Discovery data directly to Sentinel for investigation.
If you would like to get more details, please contact Danny.Kadyshevitch@microsoft.com and Adam.Zamri@microsoft.com directly.
Best,
Boris Kacevich
Aug 05 2019 03:15 AM
Hi @David Caddick ,
You may also connect Syslog data into Azure Sentinel: https://docs.microsoft.com/en-us/azure/sentinel/connect-syslog.
In case you have any questions regarding our plan on streaming MCAS Discovery data directly to Azure Sentinel, feel free to reach out.
Thanks,
Adam
Jul 28 2019 11:49 PM
SolutionHi @David Caddick ,
We have plans on streaming MCAS Discovery data directly to Sentinel for investigation.
If you would like to get more details, please contact Danny.Kadyshevitch@microsoft.com and Adam.Zamri@microsoft.com directly.
Best,
Boris Kacevich