Quest Change Auditor (https://www.quest.com/change-auditor ) integration with Sentinel

[Maxou]

Hi All,

Hope you are well. Just wanted to know if anyone has integrated Quest Change Auditor with Sentinel please? If yes, wha was the method used .

Regards,

Maxou

[#2]

@Maxou I worked with a customer recently to get Edgewise configured for ingestion with Sentinel and Change Auditor seems very similar in function.

Does Change Auditor have the ability to export data? If so, you can use the Log Analytics agent to deliver the data to a custom table in the Azure Sentinel Log Analytics Workspace.

Ask Quest if this is possible, or if they have instructions for integrating their product with other SIEMS.

[#3]

Hi @Rod_Trent, Thanks for coming back to me. On their website they say they integrate with Arcsight, Splunk and Qradar for SIEM but there was no mention of Sentinel.

I will probably have to get in touch with them to see if CEF or Syslog can be something of use for integrating their logs with Sentinel.

[#4]

@Maxou Definitely let me know what comes of it. Very interested.

The methods Quest uses for the other SIEMs would be very similar to how we do it. We still have customers that run other SIEMs side-by-side with Sentinel - either long term, or as a migration path.

We can even import csv and JSON data files, btw.

[#5]

@Rod_Trent  Okay then. Will see what they if they come back to me. Thanks again.