Sentinel and data from GSuite, custom logs?

[Karen McGregor]

Is there any plan to integrate authentication/activity data from GSuite into Sentinel?

And - what's the plan to add custom log data (eg., LOB application logs) into Sentinel?

[#2]

I cant answer part 1, but Log Analytics already has a Custom log feature https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-custom-logs you can enable that for the Log Analytics workspace Sentinel is using.  There is also a CEF and Syslog connector in Sentinel.

[#3]

Thanks!

[#4]

If you have Cloud App Security you can pull logs with their setup ( https://docs.microsoft.com/en-us/cloud-app-security/connect-google-apps-to-microsoft-cloud-app-secur...) and then should be able to pull that into Sentinel via https://docs.microsoft.com/en-us/azure/sentinel/connect-cloud-app-security . It would be nice if they gave us a way to do it directly, though.