You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/infoblox-cloud-data-connector.md
+13-10Lines changed: 13 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -88,10 +88,12 @@ InfobloxCDC
88
88
## Vendor installation instructions
89
89
90
90
91
-
>**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called **InfobloxCDC** which is deployed with the solution.
91
+
> [!IMPORTANT]
92
+
> This data connector depends on a parser based on a Kusto Function to work as expected called **InfobloxCDC** which is deployed with the solution.
92
93
93
94
94
-
>**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Cloud Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Cloud Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements.
95
+
> [!IMPORTANT]
96
+
> This Microsoft Sentinel data connector assumes an Infoblox Cloud Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Cloud Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements.
95
97
96
98
1. Linux Syslog agent configuration
97
99
@@ -101,7 +103,7 @@ Install and configure the Linux agent to collect your Common Event Format (CEF)
101
103
102
104
1.1 Select or create a Linux machine
103
105
104
-
Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Microsoft Sentinel or other clouds.
106
+
Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-premises environment, Microsoft Sentinel or other clouds.
105
107
106
108
1.2 Install the CEF collector on the Linux machine
107
109
@@ -118,9 +120,10 @@ Install the Microsoft Monitoring Agent on your Linux machine and configure the m
118
120
2. Configure Infoblox BloxOne to send Syslog data to the Infoblox Cloud Data Connector to forward to the Syslog agent
119
121
120
122
Follow the steps below to configure the Infoblox CDC to send BloxOne data to Microsoft Sentinel via the Linux Syslog agent.
121
-
2. Navigate to **Manage > Data Connector**.
122
-
3. Click the **Destination Configuration** tab at the top.
123
-
4. Click **Create > Syslog**.
123
+
124
+
1. Navigate to **Manage > Data Connector**.
125
+
1. Click the **Destination Configuration** tab at the top.
126
+
1. Click **Create > Syslog**.
124
127
-**Name**: Give the new Destination a meaningful **name**, such as **Microsoft-Sentinel-Destination**.
125
128
-**Description**: Optionally give it a meaningful **description**.
126
129
-**State**: Set the state to **Enabled**.
@@ -129,13 +132,13 @@ Follow the steps below to configure the Infoblox CDC to send BloxOne data to Mic
129
132
-**Port**: Leave the port number at **514**.
130
133
-**Protocol**: Select desired protocol and CA certificate if applicable.
131
134
- Click **Save & Close**.
132
-
5. Click the **Traffic Flow Configuration** tab at the top.
133
-
6. Click **Create**.
135
+
1. Click the **Traffic Flow Configuration** tab at the top.
136
+
1. Click **Create**.
134
137
-**Name**: Give the new Traffic Flow a meaningful **name**, such as **Microsoft-Sentinel-Flow**.
135
138
-**Description**: Optionally give it a meaningful **description**.
136
139
-**State**: Set the state to **Enabled**.
137
140
- Expand the **CDC Enabled Host** section.
138
-
-**On-Prem Host**: Select your desired on-prem host for which the Data Connector service is enabled.
141
+
-**On-Prem Host**: Select your desired on-premises host for which the Data Connector service is enabled.
139
142
- Expand the **Source Configuration** section.
140
143
-**Source**: Select **BloxOne Cloud Source**.
141
144
- Select all desired **log types** you wish to collect. Currently supported log types are:
@@ -146,7 +149,7 @@ Follow the steps below to configure the Infoblox CDC to send BloxOne data to Mic
146
149
- Expand the **Destination Configuration** section.
0 commit comments