Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Sentinel and data from GSuite, custom logs?

Microsoft

Is there any plan to integrate authentication/activity data from GSuite into Sentinel?

 

And - what's the plan to add custom log data (eg., LOB application logs) into Sentinel?

3 Replies

I cant answer part 1, but Log Analytics already has a Custom log feature https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-custom-logs you can enable that for the Log Analytics workspace Sentinel is using.  There is also a CEF and Syslog connector in Sentinel.

If you have Cloud App Security you can pull logs with their setup ( https://docs.microsoft.com/en-us/cloud-app-security/connect-google-apps-to-microsoft-cloud-app-secur...) and then should be able to pull that into Sentinel via https://docs.microsoft.com/en-us/azure/sentinel/connect-cloud-app-security . It would be nice if they gave us a way to do it directly, though.