You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/braodcom-symantec-dlp.md
+12-15Lines changed: 12 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,25 +1,23 @@
1
1
---
2
-
title: "Braodcom Symantec DLP connector for Microsoft Sentinel"
3
-
description: "Learn how to install the connector Braodcom Symantec DLP to connect your data source to Microsoft Sentinel."
2
+
title: "Broadcom Symantec DLP connector for Microsoft Sentinel"
3
+
description: "Learn how to install the connector Broadcom Symantec DLP to connect your data source to Microsoft Sentinel."
4
4
author: cwatson-cat
5
5
ms.topic: how-to
6
-
ms.date: 02/23/2023
6
+
ms.date: 03/25/2023
7
7
ms.service: microsoft-sentinel
8
8
ms.author: cwatson
9
9
---
10
10
11
-
# Braodcom Symantec DLP connector for Microsoft Sentinel
11
+
# Broadcom Symantec DLP connector for Microsoft Sentinel
12
12
13
-
The [Broadcom Symantec Data Loss Prevention (DLP)](https://www.broadcom.com/products/cyber-security/information-protection/data-loss-prevention) connector allows you to easily connect your Symantec DLP with Azure Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s information, where it travels, and improves your security operation capabilities.
13
+
The [Broadcom Symantec Data Loss Prevention (DLP)](https://www.broadcom.com/products/cyber-security/information-protection/data-loss-prevention) connector allows you to easily connect your Symantec DLP with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s information, where it travels, and improves your security operation capabilities.
14
14
15
15
## Connector attributes
16
16
17
17
| Connector attribute | Description |
18
18
| --- | --- |
19
-
|**Kusto function alias**| SymantecDLP |
20
-
|**Kusto function url**|https://aka.ms/sentinel-symantecdlp-parser|
>This data connector depends on a parser based on a Kusto Function to work as expected. [Follow the steps](https://aka.ms/sentinel-symantecdlp-parser) to use the Kusto function alias, **SymantecDLP**
47
+
**NOTE:**This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SymantecDLP and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Broadcom%20SymantecDLP/Parsers/SymantecDLP.txt). The function usually takes 10-15 minutes to activate after solution installation/update.
51
48
52
49
1. Linux Syslog agent configuration
53
50
54
-
Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Azure Sentinel.
51
+
Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.
55
52
56
53
> Notice that the data from all regions will be stored in the selected workspace
57
54
58
55
1.1 Select or create a Linux machine
59
56
60
-
Select or create a Linux machine that Azure Sentinel will use as the proxy between your security solution and Azure Sentinel this machine can be on your on-prem environment, Azure or other clouds.
57
+
Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds.
61
58
62
59
1.2 Install the CEF collector on the Linux machine
63
60
64
-
Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Azure Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.
61
+
Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.
65
62
66
63
> 1. Make sure that you have Python on your machine using the following command: python –version.
67
64
@@ -73,7 +70,7 @@ Install the Microsoft Monitoring Agent on your Linux machine and configure the m
73
70
74
71
2. Forward Symantec DLP logs to a Syslog agent
75
72
76
-
Configure Symantec DLP to forward Syslog messages in CEF format to your Azure Sentinel workspace via the Syslog agent.
73
+
Configure Symantec DLP to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.
77
74
1.[Follow these instructions](https://help.symantec.com/cs/DLP15.7/DLP/v27591174_v133697641/Configuring-the-Log-to-a-Syslog-Server-action?locale=EN_US) to configure the Symantec DLP to forward syslog
78
75
2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address.
79
76
@@ -106,4 +103,4 @@ Make sure to configure the machine's security according to your organization's s
106
103
107
104
## Next steps
108
105
109
-
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-broadcomsymantecdlp?tab=Overview) in the Azure Marketplace.
106
+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-broadcomsymantecdlp?tab=Overview) in the Azure Marketplace.
0 commit comments