Skip to content

Commit 7b7304c

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #292454 from Saisang/sai-dataconnectors-20241224
Data connectors update 2024-12
2 parents c5ff257 + 4d46b88 commit 7b7304c

10 files changed

+627
-11
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4471,6 +4471,11 @@
44714471
"source_path_from_root": "/articles/fasttrack/index.yml",
44724472
"redirect_url": "/azure",
44734473
"redirect_document_id": false
4474+
},
4475+
{
4476+
"source_path_from_root": "/articles/sentinel/data-connectors/threat-intelligence-upload-indicators-api.md",
4477+
"redirect_url": "/azure/sentinel/data-connectors/threat-intelligence-upload-api",
4478+
"redirect_document_id": false
44744479
}
44754480
]
44764481
}

‎articles/sentinel/TOC.yml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,8 @@
362362
href: data-connectors/cortex-xdr-incidents.md
363363
- name: Cribl
364364
href: data-connectors/cribl.md
365+
- name: CTERA Syslog
366+
href: data-connectors/ctera-syslog.md
365367
- name: CrowdStrike Falcon Adversary Intelligence (using Azure Functions)
366368
href: data-connectors/crowdstrike-falcon-adversary-intelligence.md
367369
- name: Crowdstrike Falcon Data Replicator (using Azure Functions)
@@ -444,6 +446,8 @@
444446
href: data-connectors/hyas-protect.md
445447
- name: Holm Security Asset Data (using Azure Functions)
446448
href: data-connectors/holm-security-asset-data.md
449+
- name: IIS Logs of Microsoft Exchange Servers
450+
href: data-connectors/iis-logs-of-microsoft-exchange-servers.md
447451
- name: Illumio SaaS (using Azure Functions)
448452
href: data-connectors/illumio-saas.md
449453
- name: Imperva Cloud WAF (using Azure Functions)
@@ -518,8 +522,14 @@
518522
href: data-connectors/microsoft-purview.md
519523
- name: Microsoft Purview Information Protection
520524
href: data-connectors/microsoft-purview-information-protection.md
525+
- name: Mimecast Audit (using Azure Functions)
526+
href: data-connectors/mimecast-audit.md
521527
- name: Mimecast Audit & Authentication (using Azure Functions)
522528
href: data-connectors/mimecast-audit-authentication.md
529+
- name: Mimecast Awareness Training (using Azure Functions)
530+
href: data-connectors/mimecast-awareness-training.md
531+
- name: Mimecast Cloud Integrated (using Azure Functions)
532+
href: data-connectors/mimecast-cloud-integrated.md
523533
- name: Mimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)
524534
href: data-connectors/mimecast-intelligence-for-microsoft-microsoft-sentinel.md
525535
- name: Mimecast Secure Email Gateway (using Azure Functions)
@@ -600,6 +610,8 @@
600610
href: data-connectors/seraphic-web-security.md
601611
- name: Silverfort Admin Console
602612
href: data-connectors/silverfort-admin-console.md
613+
- name: SINEC Security Guard
614+
href: data-connectors/sinec-security-guard.md
603615
- name: Slack Audit (using Azure Functions)
604616
href: data-connectors/slack-audit.md
605617
- name: Snowflake (using Azure Functions)
@@ -633,7 +645,7 @@
633645
- name: Threat Intelligence Platforms
634646
href: data-connectors/threat-intelligence-platforms.md
635647
- name: Threat Intelligence Upload Indicators API (Preview)
636-
href: data-connectors/threat-intelligence-upload-indicators-api.md
648+
href: data-connectors/threat-intelligence-upload-api.md
637649
- name: Transmit Security Connector (using Azure Functions)
638650
href: data-connectors/transmit-security-connector.md
639651
- name: Trend Vision One (using Azure Functions)

‎articles/sentinel/data-connectors-reference.md

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,10 @@ For more information about the codeless connector platform, see [Create a codele
186186

187187
- [Cribl](data-connectors/cribl.md)
188188

189+
## CTERA Networks Ltd
190+
191+
- [CTERA Syslog](data-connectors/ctera-syslog.md)
192+
189193
## Crowdstrike
190194

191195
- [CrowdStrike Falcon Adversary Intelligence (using Azure Functions)](data-connectors/crowdstrike-falcon-adversary-intelligence.md)
@@ -377,7 +381,7 @@ For more information about the codeless connector platform, see [Create a codele
377381
- [Premium Microsoft Defender Threat Intelligence (Preview)](data-connectors/premium-microsoft-defender-threat-intelligence.md)
378382
- [Threat intelligence - TAXII](data-connectors/threat-intelligence-taxii.md)
379383
- [Threat Intelligence Platforms](data-connectors/threat-intelligence-platforms.md)
380-
- [Threat Intelligence Upload Indicators API (Preview)](data-connectors/threat-intelligence-upload-indicators-api.md)
384+
- [Threat Intelligence Upload Indicators API (Preview)](data-connectors/threat-intelligence-upload-api.md)
381385
- [Microsoft Defender for IoT](data-connectors/microsoft-defender-for-iot.md)
382386
- [Windows Firewall](data-connectors/windows-firewall.md)
383387
- [Windows Firewall Events via AMA (Preview)](data-connectors/windows-firewall-events-via-ama.md)
@@ -398,6 +402,7 @@ For more information about the codeless connector platform, see [Create a codele
398402

399403
- [Exchange Security Insights Online Collector (using Azure Functions)](data-connectors/exchange-security-insights-online-collector.md)
400404
- [Exchange Security Insights On-Premises Collector](data-connectors/exchange-security-insights-on-premises-collector.md)
405+
- [IIS Logs of Microsoft Exchange Servers](data-connectors/iis-logs-of-microsoft-exchange-servers.md)
401406
- [Microsoft Active-Directory Domain Controllers Security Event Logs](data-connectors/microsoft-active-directory-domain-controllers-security-event-logs.md)
402407
- [Microsoft Exchange Admin Audit Logs by Event Logs](data-connectors/microsoft-exchange-admin-audit-logs-by-event-logs.md)
403408
- [Microsoft Exchange HTTP Proxy Logs](data-connectors/microsoft-exchange-http-proxy-logs.md)
@@ -408,6 +413,9 @@ For more information about the codeless connector platform, see [Create a codele
408413

409414
## Mimecast North America
410415

416+
- [Mimecast Audit (using Azure Functions)](data-connectors/mimecast-audit.md)
417+
- [Mimecast Awareness Training (using Azure Functions)](data-connectors/mimecast-awareness-training.md)
418+
- [Mimecast Cloud Integrated (using Azure Functions)](data-connectors/mimecast-cloud-integrated.md)
411419
- [Mimecast Audit & Authentication (using Azure Functions)](data-connectors/mimecast-audit-authentication.md)
412420
- [Mimecast Secure Email Gateway (using Azure Functions)](data-connectors/mimecast-secure-email-gateway.md)
413421
- [Mimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)](data-connectors/mimecast-intelligence-for-microsoft-microsoft-sentinel.md)
@@ -510,6 +518,10 @@ For more information about the codeless connector platform, see [Create a codele
510518

511519
- [Seraphic Web Security](data-connectors/seraphic-web-security.md)
512520

521+
## Siemens DI Software
522+
523+
- [SINEC Security Guard](data-connectors/sinec-security-guard.md)
524+
513525
## Silverfort Ltd.
514526

515527
- [Silverfort Admin Console](data-connectors/silverfort-admin-console.md)

‎articles/sentinel/data-connectors/ctera-syslog.md

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
title: "CTERA Syslog connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector CTERA Syslog to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 12/24/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# CTERA Syslog connector for Microsoft Sentinel
13+
14+
The CTERA Data Connector for Microsoft Sentinel offers monitoring and threat detection capabilities for your CTERA solution.
15+
It includes a workbook visualizing the sum of all operations per type, deletions, and denied access operations.
16+
It also provides analytic rules which detects ransomware incidents and alert you when a user is blocked due to suspicious ransomware activity.
17+
Additionally, it helps you identify critical patterns such as mass access denied events, mass deletions, and mass permission changes, enabling proactive threat management and response.
18+
19+
This is autogenerated content. For changes, contact the solution provider.
20+
21+
## Connector attributes
22+
23+
| Connector attribute | Description |
24+
| --- | --- |
25+
| **Log Analytics table(s)** | Syslog<br/> |
26+
| **Data collection rules support** | [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal) |
27+
| **Supported by** | [CTERA](https://www.ctera.com/) |
28+
29+
## Query samples
30+
31+
**Query to find all denied operations.**
32+
33+
```kusto
34+
Syslog
35+
36+
| where ProcessName == 'gw-audit'
37+
38+
| extend TenantName = extract("(\"vportal\":\"[^\"]*\")", 1, SyslogMessage), UserName = extract("(user=[^
39+
|]*)", 1, SyslogMessage)
40+
41+
| extend Permission = extract("(op=[^
42+
|]*)", 1, SyslogMessage)
43+
44+
| where Permission matches regex @"(?i).*denied.*"
45+
46+
| summarize Count = count() by Permission
47+
```
48+
49+
**Query to find all delete operations.**
50+
51+
```kusto
52+
Syslog
53+
54+
| where ProcessName == 'gw-audit'
55+
56+
| extend TenantName = extract("(\"vportal\":\"[^\"]*\")", 1, SyslogMessage), UserName = extract("(user=[^
57+
|]*)", 1, SyslogMessage)
58+
59+
| extend Permission = extract("(op=[^
60+
|]*)", 1, SyslogMessage)
61+
62+
| where Permission == "op=delete"
63+
64+
| summarize Count = count() by Permission
65+
```
66+
67+
**Query to summarize operations by user.**
68+
69+
```kusto
70+
Syslog
71+
72+
| where ProcessName == 'gw-audit'
73+
74+
| extend TenantName = extract("(\"vportal\":\"[^\"]*\")", 1, SyslogMessage), UserName = extract("(user=[^
75+
|]*)", 1, SyslogMessage)
76+
77+
| extend Permission = extract("(op=[^
78+
|]*)", 1, SyslogMessage)
79+
80+
| summarize Count = count() by UserName, Permission
81+
```
82+
83+
**Query to summarize operations by a portal tenant.**
84+
85+
```kusto
86+
Syslog
87+
88+
| where ProcessName == 'gw-audit'
89+
90+
| extend TenantName = extract("(\"vportal\":\"[^\"]*\")", 1, SyslogMessage), UserName = extract("(user=[^
91+
|]*)", 1, SyslogMessage)
92+
93+
| extend Permission = extract("(op=[^
94+
|]*)", 1, SyslogMessage)
95+
96+
| summarize Count = count() by TenantName, Permission
97+
```
98+
99+
**Query to find operations performed by a specific user.**
100+
101+
```kusto
102+
Syslog
103+
104+
| where ProcessName == 'gw-audit'
105+
106+
| extend TenantName = extract("(\"vportal\":\"[^\"]*\")", 1, SyslogMessage), UserName = extract("(user=[^
107+
|]*)", 1, SyslogMessage)
108+
109+
| extend Permission = extract("(op=[^
110+
|]*)", 1, SyslogMessage)
111+
112+
| where UserName == 'user=specific_user'
113+
114+
| summarize Count = count() by Permission
115+
```
116+
117+
118+
119+
## Vendor installation instructions
120+
121+
Step 1: Connect CTERA Platform to Syslog
122+
123+
Set up your CTERA portal syslog connection and Edge-Filer Syslog connector
124+
125+
126+
Step 2: Install Azure Monitor Agent (AMA) on Syslog Server
127+
128+
Install the Azure Monitor Agent (AMA) on your syslog server to enable data collection.
129+
130+
131+
132+
133+
## Next steps
134+
135+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/cteranetworksltd1651947437632.microsoft-sentinel-solution-ctera?tab=Overview) in the Azure Marketplace.

‎articles/sentinel/data-connectors/iis-logs-of-microsoft-exchange-servers.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
title: "IIS Logs of Microsoft Exchange Servers connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector IIS Logs of Microsoft Exchange Servers to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 12/24/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# IIS Logs of Microsoft Exchange Servers connector for Microsoft Sentinel
13+
14+
[Option 5] - Using Azure Monitor Agent - You can stream all IIS Logs from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to create custom alerts, and improve investigation.
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Log Analytics table(s)** | W3CIISLog<br/> |
23+
| **Data collection rules support** | Not currently supported |
24+
| **Supported by** | [Community](https://github.com/Azure/Azure-Sentinel/issues) |
25+
26+
## Query samples
27+
28+
**All Audit logs**
29+
30+
```kusto
31+
W3CIISLog
32+
| sort by TimeGenerated
33+
```
34+
35+
36+
37+
## Prerequisites
38+
39+
To integrate with IIS Logs of Microsoft Exchange Servers make sure you have:
40+
41+
- ****: Azure Log Analytics will be deprecated, to collect data from non-Azure VMs, Azure Arc is recommended. [Learn more](/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)
42+
- **Detailled documentation**: >**NOTE:** Detailled documentation on Installation procedure and usage can be found [here](https://aka.ms/MicrosoftExchangeSecurityGithub)
43+
44+
45+
## Vendor installation instructions
46+
47+
48+
> [!NOTE]
49+
> This solution is based on options. This allows you to choose which data will be ingest as some options can generate a very high volume of data. Depending on what you want to collect, track in your Workbooks, Analytics Rules, Hunting capabilities you will choose the option(s) you will deploy. Each options are independant for one from the other. To learn more about each option: ['Microsoft Exchange Security' wiki](https://aka.ms/ESI_DataConnectorOptions)
50+
51+
>This Data Connector is the **option 5** of the wiki.
52+
53+
1. Download and install the agents needed to collect logs for Microsoft Sentinel
54+
55+
Type of servers (Exchange Servers, Domain Controllers linked to Exchange Servers or all Domain Controllers) depends on the option you want to deploy.
56+
57+
58+
[Option 5] IIS logs of Exchange Servers
59+
60+
Select how to stream IIS logs of Exchange Servers
61+
62+
63+
64+
65+
## Next steps
66+
67+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/microsoftsentinelcommunity.azure-sentinel-solution-exchangesecurityinsights?tab=Overview) in the Azure Marketplace.

0 commit comments

Comments
 (0)