Skip to content

Commit 50e4841

Browse files
LJSpillerLJSpiller
authored
Merge pull request #212067 from cwatson-cat/9-21-22-slns-cat
Sentinel - replace solutions list w/ link 2 mrkpl
2 parents 4eff392 + 1affc33 commit 50e4841

10 files changed

+174
-762
lines changed

‎articles/security/fundamentals/feature-availability.md

Lines changed: 110 additions & 111 deletions
Large diffs are not rendered by default.

‎articles/sentinel/data-connectors-reference.md

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,7 @@ ms.custom: ignite-fall-2021
1212

1313
This article describes how to deploy data connectors in Microsoft Sentinel, listing all supported, out-of-the-box data connectors, together with links to generic deployment procedures, and extra steps required for specific connectors.
1414

15-
> [!TIP]
16-
> Some data connectors are deployed only via solutions. For more information, see the [Microsoft Sentinel solutions catalog](sentinel-solutions-catalog.md). You can also find other, community-built data connectors in the [Microsoft Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors).
17-
>
15+
Some data connectors are deployed only via solutions. For more information, see the [Discover and deploy Microsoft Sentinel out-of-the-box content and solutions](sentinel-solutions-deploy.md). You can also find other, community-built data connectors in the [Microsoft Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors).
1816

1917
## How to use this guide
2018

@@ -418,7 +416,7 @@ See [Microsoft Defender for Cloud](#microsoft-defender-for-cloud).
418416

419417
| Connector attribute | Description |
420418
| --- | --- |
421-
| **Data ingestion method** | **Azure service-to-service integration: <br>[Diagnostic settings-based connections, managed by Azure Policy](connect-azure-windows-microsoft-services.md?tabs=AP#diagnostic-settings-based-connections)** <br><br>Also available in the [Azure SQL and Microsoft Sentinel for SQL PaaS solutions](sentinel-solutions-catalog.md#azure)|
419+
| **Data ingestion method** | **Azure service-to-service integration: <br>[Diagnostic settings-based connections, managed by Azure Policy](connect-azure-windows-microsoft-services.md?tabs=AP#diagnostic-settings-based-connections)** <br><br>Also available in the Azure SQL and Microsoft Sentinel for SQL PaaS solutions|
422420
| **Log Analytics table(s)** | SQLSecurityAuditEvents<br>SQLInsights<br>AutomaticTuning<br>QueryStoreWaitStatistics<br>Errors<br>DatabaseWaitStatistics<br>Timeouts<br>Blocks<br>Deadlocks<br>Basic<br>InstanceAndAppAdvanced<br>WorkloadManagement<br>DevOpsOperationsAudit |
423421
| **DCR support** | Not currently supported |
424422
| **Supported by** | Microsoft |
@@ -535,7 +533,7 @@ See Barracuda instructions - note the assigned facilities for the different type
535533

536534
| Connector attribute | Description |
537535
| --- | --- |
538-
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Available from the [Check Point solution](sentinel-solutions-catalog.md#check-point)|
536+
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Available from the Check Point solution|
539537
| **Log Analytics table(s)** | [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog) |
540538
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
541539
| **Vendor documentation/<br>installation instructions** | [Log Exporter - Check Point Log Export](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323) |
@@ -547,7 +545,7 @@ See Barracuda instructions - note the assigned facilities for the different type
547545

548546
| Connector attribute | Description |
549547
| --- | --- |
550-
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Available in the [Cisco ASA solution](sentinel-solutions-catalog.md#cisco)|
548+
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Available in the Cisco ASA solution|
551549
| **Log Analytics table(s)** | [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog) |
552550
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
553551
| **Vendor documentation/<br>installation instructions** | [Cisco ASA Series CLI Configuration Guide](https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html) |
@@ -588,7 +586,7 @@ Configure eNcore to stream data via TCP to the Log Analytics Agent. This configu
588586

589587
| Connector attribute | Description |
590588
| --- | --- |
591-
| **Data ingestion method** | [**Syslog**](connect-syslog.md)<br><br> Available in the [Cisco ISE solution](sentinel-solutions-catalog.md#cisco)|
589+
| **Data ingestion method** | [**Syslog**](connect-syslog.md)<br><br> Available in the Cisco ISE solution|
592590
| **Log Analytics table(s)** | [Syslog](/azure/azure-monitor/reference/tables/syslog) |
593591
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
594592
| **Kusto function alias:** | CiscoMeraki |
@@ -602,7 +600,7 @@ Configure eNcore to stream data via TCP to the Log Analytics Agent. This configu
602600

603601
| Connector attribute | Description |
604602
| --- | --- |
605-
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br> Available in the [Cisco Umbrella solution](sentinel-solutions-catalog.md#cisco)|
603+
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br> Available in the Cisco Umbrella solution|
606604
| **Log Analytics table(s)** | Cisco_Umbrella_dns_CL<br>Cisco_Umbrella_proxy_CL<br>Cisco_Umbrella_ip_CL<br>Cisco_Umbrella_cloudfirewall_CL |
607605
| **DCR support** | Not currently supported |
608606
| **Azure Function App code** | https://aka.ms/Sentinel-CiscoUmbrellaConn-functionapp |
@@ -667,7 +665,7 @@ Configure eNcore to stream data via TCP to the Log Analytics Agent. This configu
667665

668666
| Connector attribute | Description |
669667
| --- | --- |
670-
| **Data ingestion method** | Only available after installing the [Continuous Threat Monitoring for SAP solution](sentinel-solutions-catalog.md#sap)|
668+
| **Data ingestion method** | Only available after installing the Continuous Threat Monitoring for SAP solution|
671669
| **Log Analytics table(s)** | See [Microsoft Sentinel SAP solution data reference](sap/sap-solution-log-reference.md) |
672670
| **Vendor documentation/<br>installation instructions** | [Deploy SAP continuous threat monitoring](sap/deployment-overview.md) |
673671
| **Supported by** | Microsoft |
@@ -707,7 +705,7 @@ Configure eNcore to stream data via TCP to the Log Analytics Agent. This configu
707705

708706
| Connector attribute | Description |
709707
| --- | --- |
710-
| **Data ingestion method** | **Azure service-to-service integration: <br>[API-based connections](connect-azure-windows-microsoft-services.md#api-based-connections)** <br><br> Also available as part of the [Microsoft Sentinel 4 Dynamics 365 solution](sentinel-solutions-catalog.md#azure)|
708+
| **Data ingestion method** | **Azure service-to-service integration: <br>[API-based connections](connect-azure-windows-microsoft-services.md#api-based-connections)** <br><br> Also available as part of the Microsoft Sentinel 4 Dynamics 365 solution|
711709
| **License prerequisites/<br>Cost information** | <li>[Microsoft Dynamics 365 production license](/office365/servicedescriptions/microsoft-dynamics-365-online-service-description). Not available for sandbox environments.<li>At least one user assigned a Microsoft/Office 365 [E1 or greater](/power-platform/admin/enable-use-comprehensive-auditing#requirements) license.<br>Other charges may apply |
712710
| **Log Analytics table(s)** | Dynamics365Activity |
713711
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
@@ -960,7 +958,7 @@ For more information, see the Eset documentation.
960958
961959
| Connector attribute | Description |
962960
| --- | --- |
963-
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>[Send Fortinet logs to the log forwarder](#send-fortinet-logs-to-the-log-forwarder) <br><br>Available in the [Fortinet Fortigate solution](sentinel-solutions-catalog.md#fortinet-fortigate)|
961+
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>[Send Fortinet logs to the log forwarder](#send-fortinet-logs-to-the-log-forwarder) <br><br>Available in the Fortinet Fortigate solution)|
964962
| **Log Analytics table(s)** | [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog) |
965963
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
966964
| **Vendor documentation/<br>installation instructions** | [Fortinet Document Library](https://aka.ms/asi-syslog-fortinet-fortinetdocumentlibrary)<br>Choose your version and use the *Handbook* and *Log Message Reference* PDFs. |
@@ -990,7 +988,7 @@ end
990988
991989
| Connector attribute | Description |
992990
| --- | --- |
993-
| **Data ingestion method** |[**Microsoft Sentinel Data Collector API**](connect-rest-api-template.md)<br><br>Only available after installing the [Continuous Threat Monitoring for GitHub](sentinel-solutions-catalog.md#github) solution. |
991+
| **Data ingestion method** |[**Microsoft Sentinel Data Collector API**](connect-rest-api-template.md)<br><br>Only available after installing the Continuous Threat Monitoring for GitHub solution. |
994992
| **Log Analytics table(s)** | GitHubAuditLogPolling_CL |
995993
| **DCR support** | Not currently supported |
996994
| **API credentials** | GitHub access token |
@@ -1057,7 +1055,7 @@ Add http://localhost:8081/ under **Authorized redirect URIs** while creating [We
10571055
10581056
| Connector attribute | Description |
10591057
| --- | --- |
1060-
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Available in the [Imperva Cloud WAF solution](sentinel-solutions-catalog.md#imperva)|
1058+
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Available in the Imperva Cloud WAF solution|
10611059
| **Log Analytics table(s)** | [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog) |
10621060
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
10631061
| **Vendor documentation/<br>installation instructions** | [Steps for Enabling Imperva WAF Gateway Alert Logging to Microsoft Sentinel](https://community.imperva.com/blogs/craig-burlingame1/2020/11/13/steps-for-enabling-imperva-waf-gateway-alert) |
@@ -1069,7 +1067,7 @@ Add http://localhost:8081/ under **Authorized redirect URIs** while creating [We
10691067
10701068
| Connector attribute | Description |
10711069
| --- | --- |
1072-
| **Data ingestion method** | [**Syslog**](connect-syslog.md)<br><br> available in the [InfoBlox Threat Defense solution](sentinel-solutions-catalog.md#infoblox) |
1070+
| **Data ingestion method** | [**Syslog**](connect-syslog.md)<br><br> available in the InfoBlox Threat Defense solution |
10731071
| **Log Analytics table(s)** | [Syslog](/azure/azure-monitor/reference/tables/syslog) |
10741072
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
10751073
| **Kusto function alias:** | InfobloxNIOS |
@@ -1098,7 +1096,7 @@ Add http://localhost:8081/ under **Authorized redirect URIs** while creating [We
10981096
10991097
| Connector attribute | Description |
11001098
| --- | --- |
1101-
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br>Only available after installing the [Lookout Mobile Threat Defense for Microsoft Sentinel](sentinel-solutions-catalog.md#lookout) solution |
1099+
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br>Only available after installing the Lookout Mobile Threat Defense for Microsoft Sentinel solution |
11021100
| **Log Analytics table(s)** | Lookout_CL |
11031101
| **DCR support** | Not currently supported |
11041102
| **API credentials** | <li>Lookout Application Key |
@@ -1408,7 +1406,7 @@ Refer to the Onapsis in-product help to set up log forwarding to the Log Analyti
14081406
14091407
| Connector attribute | Description |
14101408
| --- | --- |
1411-
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Also available in the [Palo Alto PAN-OS and Prisma solutions](sentinel-solutions-catalog.md#palo-alto)|
1409+
| **Data ingestion method** | **[Common Event Format (CEF)](connect-common-event-format.md) over Syslog** <br><br>Also available in the Palo Alto PAN-OS and Prisma solutions|
14121410
| **Log Analytics table(s)** | [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog) |
14131411
| **DCR support** | [Workspace transformation DCR](../azure-monitor/logs/tutorial-workspace-transformations-portal.md) |
14141412
| **Vendor documentation/<br>installation instructions** | [Common Event Format (CEF) Configuration Guides](https://aka.ms/asi-syslog-paloalto-forwarding)<br>[Configure Syslog Monitoring](https://aka.ms/asi-syslog-paloalto-configure) |
@@ -1433,7 +1431,7 @@ Refer to the Onapsis in-product help to set up log forwarding to the Log Analyti
14331431
14341432
| Connector attribute | Description |
14351433
| --- | --- |
1436-
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br>Also available in the [Proofpoint POD solution](sentinel-solutions-catalog.md#proofpoint) |
1434+
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br>Also available in the Proofpoint POD solution |
14371435
| **Log Analytics table(s)** | ProofpointPOD_message_CL<br>ProofpointPOD_maillog_CL |
14381436
| **DCR support** | Not currently supported |
14391437
| **Azure Function App code** | https://aka.ms/Sentinel-proofpointpod-functionapp |
@@ -1450,7 +1448,7 @@ Refer to the Onapsis in-product help to set up log forwarding to the Log Analyti
14501448
14511449
| Connector attribute | Description |
14521450
| --- | --- |
1453-
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br>Also available in the [Proofpoint TAP solution](sentinel-solutions-catalog.md#proofpoint) |
1451+
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md) <br><br>Also available in the Proofpoint TAP solution |
14541452
| **Log Analytics table(s)** | ProofPointTAPClicksPermitted_CL<br>ProofPointTAPClicksBlocked_CL<br>ProofPointTAPMessagesDelivered_CL<br>ProofPointTAPMessagesBlocked_CL |
14551453
| **DCR support** | Not currently supported |
14561454
| **Azure Function App code** | https://aka.ms/sentinelproofpointtapazurefunctioncode |
@@ -1479,7 +1477,7 @@ Refer to the Onapsis in-product help to set up log forwarding to the Log Analyti
14791477
14801478
| Connector attribute | Description |
14811479
| --- | --- |
1482-
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md)<br><br>[Extra configuration for the Qualys VM KB](#extra-configuration-for-the-qualys-vm-kb) <br><br>Also available in the [Qualys VM solution](sentinel-solutions-catalog.md#qualys)|
1480+
| **Data ingestion method** | [**Azure Functions and the REST API**](connect-azure-functions-template.md)<br><br>[Extra configuration for the Qualys VM KB](#extra-configuration-for-the-qualys-vm-kb) <br><br>Also available in the Qualys VM solution|
14831481
| **Log Analytics table(s)** | QualysKB_CL |
14841482
| **DCR support** | Not currently supported |
14851483
| **Azure Function App code** | https://aka.ms/Sentinel-qualyskb-functioncode |
@@ -2044,5 +2042,6 @@ You can find the value of your workspace ID on the ZScaler Private Access connec
20442042
20452043
For more information, see:
20462044
2047-
- [Microsoft Sentinel solutions catalog](sentinel-solutions-catalog.md)
2045+
- Solutions catalog for Microsoft Sentinel in the [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps?filters=solution-templates&page=1&search=sentinel)
2046+
- [Microsoft Sentinel solution catalog](sentinel-solutions-catalog.md)
20482047
- [Threat intelligence integration in Microsoft Sentinel](threat-intelligence-integration.md)

‎articles/sentinel/iot-advanced-threat-monitoring.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,4 +340,4 @@ For more information, see:
340340
- [Tutorial: Use playbooks with automation rules in Microsoft Sentinel](tutorial-respond-threats-playbook.md)
341341
- [Defending Critical Infrastructure with the Microsoft Sentinel: IT/OT Threat Monitoring Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184)
342342
- [Microsoft Defender for IoT documentation](../defender-for-iot/index.yml)
343-
- [Microsoft Defender for IoT solution](sentinel-solutions-catalog.md#microsoft)
343+
- [Microsoft Defender for IoT solution](sentinel-solutions-catalog.md)

‎articles/sentinel/iot-solution.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,5 +148,7 @@ For more information, see:
148148
149149
- [Tutorial: Investigate and detect threats for IoT devices](iot-advanced-threat-monitoring.md)
150150
- [Defending Critical Infrastructure with the Microsoft Sentinel: IT/OT Threat Monitoring Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184)
151+
- [Microsoft Defender for IoT documentation](../defender-for-iot/index.yml)
152+
- [Microsoft Defender for IoT solution](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot?tab=Overview)
151153
- [Microsoft Defender for IoT data connector](data-connectors-reference.md#microsoft-defender-for-iot)
152-
- [Microsoft Defender for IoT solution](sentinel-solutions-catalog.md#microsoft)
154+

0 commit comments

Comments
 (0)