log ingestion, analytic rules creation for sentinel (trend micro, Forcepoint DLP ,UpGuard BreachSit

Copper Contributor

Hi Community , need help in log ingestion and  analytic use case creation for sentinel for below devices.

 

VPN DevicesCisco FTD
WLCCisco
Email Logs iron portCisco 
Trend Micro XDRTrend Micro ApexOne/CloudOne
DLP ServerForcepoint Endpoint
UpGuard LogsUpGuard BreachSight
1 Reply

@Victor1989

 

Trend Apex One comes with Rules to try:

Clive_Watson_0-1673624018187.png


The Forcepoint DLP Solution in Sentinel, doesn't have any Rules but there is a Workbook, so I'd look at the queries it uses as a starting point Azure-Sentinel/ForcepointDLP.json at ea0af641f3bd9aafea98d373e4346d1cbd5833c1 · Azure/Azure-Sentinel...

This is an area I'd love to see Microsoft and the vendors improve, I think the minimum requirement should be one Analytic Rule, to get a Solution accepted into Sentinel (unless the data source supports a released ASIM parser).

For the others I'd typically look for a similar product that has Use cases and adapt those.