sentinel

2 Topics

Cloud Discovery Data Import - Sentinel vs Cloud App Sec
Hi, Proxy logs benefit both Sentinel and Cloud App Security Cloud Discovery. What is the most sensible way of getting proxy log data into both with least amount of moving parts? For example, ZScaler emits CEF which can be consumed by Azure Log Forwarder into Sentinel, but then Cloud App Security cannot pick up from Sentinel.
truekonrads
Jan 18, 2021 Place Microsoft Defender for Cloud Apps
1.8KViews
0likes
3Comments
Linux Connectors - MCAS & Sentinel
Just checking – as we are looking at trying to get more info feeding in to the solution and there is a Bluecoat Proxy + Cisco ASA transferring to Palo Alto. As there is no “connector” listed for Bluecoat in Sentinel, but there is one listed in MCAS, would it make sense to simply ingest the Bluecoat into MCAS and then have MCAS alerts feed into Sentinel? While this might not be ideal that Sentinel does not have the raw data, at least it will have the Alerts, and by aggregating the data it will reduce the storage needs in Sentinel? Would I be correct in thinking that it’s not possible to run a single Linux Connector that can run various tasks in a PoC scenario?So for the Cisco ASA & the Palo Alto we’d likely need two separate Linux Connectors, one for each task?
Solved
David Caddick
Aug 05, 2019 Place Microsoft Defender for Cloud Apps
1.7KViews
0likes
3Comments