Skip to content

Commit 0bdfc23

Browse files
cdparkcdpark
committed
Revert dupe files
1 parent 7801cab commit 0bdfc23

File tree

2 files changed

+165
-0
lines changed

2 files changed

+165
-0
lines changed

‎articles/sentinel/data-connectors/blackberry-cylanceprotect.md

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
title: "Blackberry CylancePROTECT connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector Blackberry CylancePROTECT to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 04/26/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# Blackberry CylancePROTECT connector for Microsoft Sentinel
13+
14+
The [Blackberry CylancePROTECT](https://www.blackberry.com/us/en/products/blackberry-protect) connector allows you to easily connect your CylancePROTECT logs with Microsoft Sentinel. This gives you more insight into your organization's network and improves your security operation capabilities.
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Log Analytics table(s)** | Syslog (CylancePROTECT)<br/> |
23+
| **Data collection rules support** | [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal) |
24+
| **Supported by** | [Microsoft Corporation](https://support.microsoft.com) |
25+
26+
## Query samples
27+
28+
**Top 10 Event Types**
29+
30+
```kusto
31+
CylancePROTECT​
32+
33+
| summarize count() by EventName
34+
35+
| top 10 by count_
36+
```
37+
38+
**Top 10 Triggered Policies**
39+
40+
```kusto
41+
CylancePROTECT​
42+
43+
| where EventType == "Threat"
44+
45+
| summarize count() by PolicyName
46+
47+
| top 10 by count_
48+
```
49+
50+
51+
52+
## Prerequisites
53+
54+
To integrate with Blackberry CylancePROTECT make sure you have:
55+
56+
- **CylancePROTECT**: must be configured to export logs via Syslog.
57+
58+
59+
## Vendor installation instructions
60+
61+
62+
> [!NOTE]
63+
> This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias CyclanePROTECT and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Blackberry%20CylancePROTECT/Parsers/CylancePROTECT.txt), on the second line of the query, enter the hostname(s) of your CyclanePROTECT device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.
64+
65+
1. Install and onboard the agent for Linux
66+
67+
Typically, you should install the agent on a different computer from the one on which the logs are generated.
68+
69+
> Syslog logs are collected only from **Linux** agents.
70+
71+
72+
2. Configure the logs to be collected
73+
74+
Configure the facilities you want to collect and their severities.
75+
76+
1. Select the link below to open your workspace **agents configuration**, and select the **Syslog** tab.
77+
2. Select **Add facility** and choose from the drop-down list of facilities. Repeat for all the facilities you want to add.
78+
3. Mark the check boxes for the desired severities for each facility.
79+
4. Click **Apply**.
80+
81+
82+
3. Configure and connect the CylancePROTECT
83+
84+
[Follow these instructions](https://docs.blackberry.com/) to configure the CylancePROTECT to forward syslog. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address.
85+
86+
87+
88+
## Next steps
89+
90+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-blackberrycylanceprotect?tab=Overview) in the Azure Marketplace.

‎articles/sentinel/data-connectors/cisco-application-centric-infrastructure.md

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
title: "Cisco Application Centric Infrastructure connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector Cisco Application Centric Infrastructure to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 04/26/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# Cisco Application Centric Infrastructure connector for Microsoft Sentinel
13+
14+
[Cisco Application Centric Infrastructure (ACI)](https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/solution-overview-c22-741487.html) data connector provides the capability to ingest [Cisco ACI logs](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/all/syslog/guide/b_ACI_System_Messages_Guide/m-aci-system-messages-reference.html) into Microsoft Sentinel.
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Log Analytics table(s)** | Syslog (CiscoACIEvent)<br/> |
23+
| **Data collection rules support** | [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal) |
24+
| **Supported by** | [Microsoft Corporation](https://support.microsoft.com) |
25+
26+
## Query samples
27+
28+
**Top 10 Resources (DstResourceId)**
29+
30+
```kusto
31+
CiscoACIEvent
32+
33+
| where notempty(DstResourceId)
34+
35+
| summarize count() by DstResourceId
36+
37+
| top 10 by count_
38+
```
39+
40+
41+
42+
## Vendor installation instructions
43+
44+
45+
> [!NOTE]
46+
> This data connector depends on a parser based on a Kusto Function to work as expected [**CiscoACIEvent**](https://aka.ms/sentinel-CiscoACI-parser) which is deployed with the Microsoft Sentinel Solution.
47+
48+
49+
> [!NOTE]
50+
> This data connector has been developed using Cisco ACI Release 1.x
51+
52+
1. Configure Cisco ACI system sending logs via Syslog to remote server where you will install the agent.
53+
54+
[Follow these steps](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/basic-config/b_ACI_Config_Guide/b_ACI_Config_Guide_chapter_010.html#d2933e4611a1635) to configure Syslog Destination, Destination Group, and Syslog Source.
55+
56+
2. Install and onboard the agent for Linux or Windows
57+
58+
Install the agent on the Server to which the logs will be forwarded.
59+
60+
> Logs on Linux or Windows servers are collected by **Linux** or **Windows** agents.
61+
62+
63+
64+
65+
3. Check logs in Microsoft Sentinel
66+
67+
Open Log Analytics to check if the logs are received using the Syslog schema.
68+
69+
>**NOTE:** It may take up to 15 minutes before new logs will appear in Syslog table.
70+
71+
72+
73+
## Next steps
74+
75+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscoaci?tab=Overview) in the Azure Marketplace.

0 commit comments

Comments
 (0)