Skip to content

Commit a419f3c

Browse files
v-ccolinv-ccolin
authored
Merge pull request #295276 from Saisang/sai-dataconnectors20250225
[Autogen] Data connectors Feb 2025
2 parents 6ba91c0 + f423972 commit a419f3c

File tree

4 files changed

+134
-0
lines changed

4 files changed

+134
-0
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -394,6 +394,8 @@
394394
href: data-connectors/derdack-signl4.md
395395
- name: Digital Shadows Searchlight (using Azure Functions)
396396
href: data-connectors/digital-shadows-searchlight-using-azure-functions.md
397+
- name: Doppel Data Connector
398+
href: data-connectors/doppel-data-connector.md
397399
- name: Dynamics 365
398400
href: data-connectors/dynamics-365.md
399401
- name: Dynatrace Attacks
@@ -426,6 +428,8 @@
426428
href: data-connectors/forescout-host-property-monitor.md
427429
- name: Fortinet FortiNDR Cloud (using Azure Functions)
428430
href: data-connectors/fortinet-fortindr-cloud.md
431+
- name: Garrison ULTRA Remote Logs (using Azure Functions)
432+
href: data-connectors/garrison-ultra-remote-logs.md
429433
- name: Gigamon AMX Data Connector
430434
href: data-connectors/gigamon-amx-data-connector.md
431435
- name: GitHub (using Webhooks) (using Azure Functions)

‎articles/sentinel/data-connectors-reference.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,10 @@ For more information about the codeless connector platform, see [Create a codele
241241

242242
- [Digital Shadows Searchlight (using Azure Functions)](data-connectors/digital-shadows-searchlight.md)
243243

244+
## Doppel
245+
246+
- [Doppel Data Connector](data-connectors/doppel-data-connector.md)
247+
244248
## Dynatrace
245249

246250
- [Dynatrace Attacks](data-connectors/dynatrace-attacks.md)
@@ -281,6 +285,10 @@ For more information about the codeless connector platform, see [Create a codele
281285

282286
- [Fortinet FortiNDR Cloud (using Azure Functions)](data-connectors/fortinet-fortindr-cloud.md)
283287

288+
## Garrison Technology
289+
290+
- [Garrison ULTRA Remote Logs (using Azure Functions)](data-connectors/garrison-ultra-remote-logs.md)
291+
284292
## Gigamon, Inc
285293

286294
- [Gigamon AMX Data Connector](data-connectors/gigamon-amx-data-connector.md)

‎articles/sentinel/data-connectors/doppel-data-connector.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
title: "Doppel Data connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector Doppel Data to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: generated-reference
6+
ms.date: 02/20/2025
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# Doppel Data connector for Microsoft Sentinel
13+
14+
The data connector is built on Microsoft Sentinel for Doppel events and alerts and supports DCR-based [ingestion time transformations](/azure/azure-monitor/logs/ingestion-time-transformations) that parses the received security event data into a custom column so that queries don't need to parse it again, thus resulting in better performance.
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Log Analytics table(s)** | DoppelTable_CL<br/> |
23+
| **Data collection rules support** | Not currently supported |
24+
| **Supported by** | [Doppel](https://www.doppel.com/request-a-demo) |
25+
26+
## Query samples
27+
28+
**One event log**
29+
30+
```kusto
31+
DoppelTable_CL
32+
| take 1
33+
```
34+
35+
36+
37+
## Prerequisites
38+
39+
To integrate with Doppel Data Connector make sure you have:
40+
41+
- **Microsoft Entra Tenant ID, Client ID and Client Secret**: Microsoft Entra ID requires a Client ID and Client Secret to authenticate your application. Additionally, Global Admin/Owner level access is required to assign the Entra-registered application a Resource Group Monitoring Metrics Publisher role.
42+
- **Requires Workspace ID, DCE-URI, DCR-ID**: You will need to get the Log Analytics Workspace ID, DCE Logs Ingestion URI and DCR Immutable ID for the configuration.
43+
44+
45+
## Vendor installation instructions
46+
47+
Configure Doppel Webhook
48+
49+
Configure the Webhook in Doppel and Endpoint with permissions in Microsoft Sentinel to send data.
50+
51+
52+
53+
54+
## Next steps
55+
56+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/doppel.azure-sentinel-solution-doppel?tab=Overview) in the Azure Marketplace.

‎articles/sentinel/data-connectors/garrison-ultra-remote-logs.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
title: "Garrison ULTRA Remote Logs (using Azure Functions) connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector Garrison ULTRA Remote Logs (using Azure Functions) to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: generated-reference
6+
ms.date: 02/20/2025
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# Garrison ULTRA Remote Logs (using Azure Functions) connector for Microsoft Sentinel
13+
14+
The [Garrison ULTRA](https://www.garrison.com/en/garrison-ultra-cloud-platform) Remote Logs connector allows you to ingest Garrison ULTRA Remote Logs into Microsoft Sentinel.
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Log Analytics table(s)** | Garrison_ULTRARemoteLogs_CL<br/> |
23+
| **Data collection rules support** | Not currently supported |
24+
| **Supported by** | [Garrison](https://support.ultra.garrison.com) |
25+
26+
## Query samples
27+
28+
**Last 10 logs**
29+
30+
```kusto
31+
Garrison_ULTRARemoteLogs_CL
32+
33+
| top 10 by TimeGenerated desc
34+
```
35+
36+
37+
38+
## Prerequisites
39+
40+
To integrate with Garrison ULTRA Remote Logs (using Azure Functions) make sure you have:
41+
42+
- **Garrison ULTRA**: To use this data connector you must have an active [Garrison ULTRA](https://www.garrison.com/en/garrison-ultra-cloud-platform) license.
43+
44+
45+
## Vendor installation instructions
46+
47+
Deployment - Azure Resource Manager (ARM) Template
48+
49+
These steps outline the automated deployment of the Garrison ULTRA Remote Logs data connector using an ARM Template.
50+
51+
1. Click the **Deploy to Azure** button below.
52+
53+
[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Frefs%2Fheads%2Fmaster%2FSolutions%2FGarrison%2520ULTRA%2FData%2520Connectors%2FGarrisonULTRARemoteLogs%2Fazuredeploy_DataCollectionResources.json)
54+
2. Provide the required details such as Resource Group, Microsoft Sentinel Workspace and ingestion configurations
55+
56+
> [!NOTE]
57+
> It is recommended to create a new Resource Group for deployment of these resources.
58+
59+
3. Mark the checkbox labeled **I agree to the terms and conditions stated above**.
60+
4. Click **Purchase** to deploy.
61+
62+
63+
64+
## Next steps
65+
66+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/garrisontechnologyltd1725375696148.microsoft-sentinel-solution-garrison-ultra?tab=Overview) in the Azure Marketplace.

0 commit comments

Comments
 (0)