You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-akamaisecurityevents-parser) to create the Kusto functions alias, **AkamaiSIEMEvent**
40
+
> This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Akamai%20Security%20Events/Parsers/AkamaiSIEMEvent.txt), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.
43
41
44
42
1. Linux Syslog agent configuration
45
43
@@ -96,4 +94,4 @@ Make sure to configure the machine's security according to your organization's s
96
94
97
95
## Next steps
98
96
99
-
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-akamai?tab=Overview) in the Azure Marketplace.
97
+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-akamai?tab=Overview) in the Azure Marketplace.
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/azure-ddos-protection.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,14 +3,14 @@ title: "Azure DDoS Protection connector for Microsoft Sentinel"
3
3
description: "Learn how to install the connector Azure DDoS Protection to connect your data source to Microsoft Sentinel."
4
4
author: cwatson-cat
5
5
ms.topic: how-to
6
-
ms.date: 03/14/2023
6
+
ms.date: 03/25/2023
7
7
ms.service: microsoft-sentinel
8
8
ms.author: cwatson
9
9
---
10
10
11
11
# Azure DDoS Protection connector for Microsoft Sentinel
12
12
13
-
Connect to Azure DDoS Protection logs via Public IP Address Diagnostic Logs. In addition to the core DDoS protection in the platform, Azure DDoS Protection provides advanced DDoS mitigation capabilities against network attacks. It's automatically tuned to protect your specific Azure resources. Protection is simple to enable during the creation of new virtual networks. It can also be done after creation and requires no application or resource changes. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219760&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
13
+
Connect to Azure DDoS Protection Standard logs via Public IP Address Diagnostic Logs. In addition to the core DDoS protection in the platform, Azure DDoS Protection Standard provides advanced DDoS mitigation capabilities against network attacks. It's automatically tuned to protect your specific Azure resources. Protection is simple to enable during the creation of new virtual networks. It can also be done after creation and requires no application or resource changes. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219760&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
@@ -56,7 +54,8 @@ To integrate with Blackberry CylancePROTECT make sure you have:
56
54
## Vendor installation instructions
57
55
58
56
59
-
>This data connector depends on a parser based on a Kusto Function to work as expected. [Follow the steps](https://aka.ms/sentinel-cylanceprotect-parser) to use the Kusto function alias, **CylancePROTECT**
57
+
> [!NOTE]
58
+
> This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias CyclanePROTECT and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Blackberry%20CylancePROTECT/Parsers/CylancePROTECT.txt), on the second line of the query, enter the hostname(s) of your CyclanePROTECT device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.
60
59
61
60
1. Install and onboard the agent for Linux
62
61
@@ -83,4 +82,4 @@ Configure the facilities you want to collect and their severities.
83
82
84
83
## Next steps
85
84
86
-
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-blackberrycylanceprotect?tab=Overview) in the Azure Marketplace.
85
+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-blackberrycylanceprotect?tab=Overview) in the Azure Marketplace.
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/braodcom-symantec-dlp.md
+12-15Lines changed: 12 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,25 +1,23 @@
1
1
---
2
-
title: "Braodcom Symantec DLP connector for Microsoft Sentinel"
3
-
description: "Learn how to install the connector Braodcom Symantec DLP to connect your data source to Microsoft Sentinel."
2
+
title: "Broadcom Symantec DLP connector for Microsoft Sentinel"
3
+
description: "Learn how to install the connector Broadcom Symantec DLP to connect your data source to Microsoft Sentinel."
4
4
author: cwatson-cat
5
5
ms.topic: how-to
6
-
ms.date: 02/23/2023
6
+
ms.date: 03/25/2023
7
7
ms.service: microsoft-sentinel
8
8
ms.author: cwatson
9
9
---
10
10
11
-
# Braodcom Symantec DLP connector for Microsoft Sentinel
11
+
# Broadcom Symantec DLP connector for Microsoft Sentinel
12
12
13
-
The [Broadcom Symantec Data Loss Prevention (DLP)](https://www.broadcom.com/products/cyber-security/information-protection/data-loss-prevention) connector allows you to easily connect your Symantec DLP with Azure Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s information, where it travels, and improves your security operation capabilities.
13
+
The [Broadcom Symantec Data Loss Prevention (DLP)](https://www.broadcom.com/products/cyber-security/information-protection/data-loss-prevention) connector allows you to easily connect your Symantec DLP with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s information, where it travels, and improves your security operation capabilities.
14
14
15
15
## Connector attributes
16
16
17
17
| Connector attribute | Description |
18
18
| --- | --- |
19
-
|**Kusto function alias**| SymantecDLP |
20
-
|**Kusto function url**|https://aka.ms/sentinel-symantecdlp-parser|
>This data connector depends on a parser based on a Kusto Function to work as expected. [Follow the steps](https://aka.ms/sentinel-symantecdlp-parser) to use the Kusto function alias, **SymantecDLP**
47
+
**NOTE:**This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SymantecDLP and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Broadcom%20SymantecDLP/Parsers/SymantecDLP.txt). The function usually takes 10-15 minutes to activate after solution installation/update.
51
48
52
49
1. Linux Syslog agent configuration
53
50
54
-
Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Azure Sentinel.
51
+
Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.
55
52
56
53
> Notice that the data from all regions will be stored in the selected workspace
57
54
58
55
1.1 Select or create a Linux machine
59
56
60
-
Select or create a Linux machine that Azure Sentinel will use as the proxy between your security solution and Azure Sentinel this machine can be on your on-prem environment, Azure or other clouds.
57
+
Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds.
61
58
62
59
1.2 Install the CEF collector on the Linux machine
63
60
64
-
Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Azure Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.
61
+
Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.
65
62
66
63
> 1. Make sure that you have Python on your machine using the following command: python –version.
67
64
@@ -73,7 +70,7 @@ Install the Microsoft Monitoring Agent on your Linux machine and configure the m
73
70
74
71
2. Forward Symantec DLP logs to a Syslog agent
75
72
76
-
Configure Symantec DLP to forward Syslog messages in CEF format to your Azure Sentinel workspace via the Syslog agent.
73
+
Configure Symantec DLP to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.
77
74
1.[Follow these instructions](https://help.symantec.com/cs/DLP15.7/DLP/v27591174_v133697641/Configuring-the-Log-to-a-Syslog-Server-action?locale=EN_US) to configure the Symantec DLP to forward syslog
78
75
2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address.
79
76
@@ -106,4 +103,4 @@ Make sure to configure the machine's security according to your organization's s
106
103
107
104
## Next steps
108
105
109
-
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-broadcomsymantecdlp?tab=Overview) in the Azure Marketplace.
106
+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-broadcomsymantecdlp?tab=Overview) in the Azure Marketplace.
@@ -68,4 +68,4 @@ Open Log Analytics to check if the logs are received using the Syslog schema.
68
68
69
69
## Next steps
70
70
71
-
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscoaci?tab=Overview) in the Azure Marketplace.
71
+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscoaci?tab=Overview) in the Azure Marketplace.
@@ -56,11 +54,7 @@ To integrate with Cisco Meraki make sure you have:
56
54
## Vendor installation instructions
57
55
58
56
59
-
>This data connector depends on a parser (based on a Kusto Function) to work as expected. You have 2 options to get this parser into workspace
60
-
61
-
> 1. If you have installed this connector via Meraki solution in ContentHub then navigate to parser definition from your workspace (Logs --> Functions --> CiscoMeraki --> Load the function code) to add your Meraki device list in the query and save the function.
62
-
63
-
> 2. If you have not installed the Meraki solution from ContentHub then [Follow the steps](https://aka.ms/sentinel-ciscomeraki-parser) to use the Kusto function alias, **CiscoMeraki**
57
+
**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias CiscoMeraki and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoMeraki/Parsers/CiscoMeraki.txt). The function usually takes 10-15 minutes to activate after solution installation/update.
0 commit comments