Updated files from source

cwatson-cat · cwatson-cat · commit cffd09529e03 · 2024-05-30T13:19:23.000-07:00
diff --git a/articles/sentinel/data-connectors/fortinet-fortindr-cloud.md b/articles/sentinel/data-connectors/fortinet-fortindr-cloud.md
@@ -3,15 +3,15 @@ title: "Fortinet FortiNDR Cloud (using Azure Functions) connector for Microsoft
 description: "Learn how to install the connector Fortinet FortiNDR Cloud (using Azure Functions) to connect your data source to Microsoft Sentinel."
 author: cwatson-cat
 ms.topic: how-to
-ms.date: 04/26/2024
+ms.date: 05/30/2024
 ms.service: microsoft-sentinel
 ms.author: cwatson
 ms.collection: sentinel-data-connector
 ---
 
 # Fortinet FortiNDR Cloud (using Azure Functions) connector for Microsoft Sentinel
 
-The Fortinet FortiNDR Cloud data connector provides the capability to ingest [Fortinet FortiNDR Cloud](https://docs.fortinet.com/product/fortindr-cloud) events stored in Amazon S3 into Microsoft Sentinel using the Amazon S3 REST API.
+The Fortinet FortiNDR Cloud data connector provides the capability to ingest [Fortinet FortiNDR Cloud](https://docs.fortinet.com/product/fortindr-cloud) data into Microsoft Sentinel using the FortiNDR Cloud API
 
 This is autogenerated content. For changes, contact the solution provider.
 
@@ -58,14 +58,15 @@ FncEventsDetections_CL
 To integrate with Fortinet FortiNDR Cloud (using Azure Functions) make sure you have: 
 
 - **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).
-- **MetaStream Credentials/permissions**: **AWS Access Key Id**, **AWS Secret Access Key**, **FortiNDR Cloud Account Code** are required to retrieve event data.
+- **MetaStream Credentials**: **AWS Access Key Id**, **AWS Secret Access Key**, **FortiNDR Cloud Account Code** are required to retrieve event data.
+- **API Credentials**: **FortiNDR Cloud API Token**, **FortiNDR Cloud Account UUID** are required to retrieve detection data.
 
 
 ## Vendor installation instructions
 
 
 > [!NOTE]
-   >  This connector uses Azure Functions to connect to the Amazon S3 REST API to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
+   >  This connector uses Azure Functions to connect to the FortiNDR Cloud API to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
 
 
 >**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
@@ -82,7 +83,7 @@ The provider should provide or link to detailed steps to configure the 'PROVIDER
 
 **STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
 
->**IMPORTANT:** Before deploying the Fortinet FortiNDR Cloud connector, have the Workspace ID  and Workspace Primary Key (can be copied from the following), as well as the as well as the MetaStream credentials (available in FortiNDR Cloud account management), readily available.
+>**IMPORTANT:** Before deploying the Fortinet FortiNDR Cloud connector, have the Workspace ID  and Workspace Primary Key (can be copied from the following), as well as the as well as the FortiNDR Cloud API credentials (available in FortiNDR Cloud account management), readily available.
 
 
 
diff --git a/articles/sentinel/data-connectors/github-enterprise-audit-log.md b/articles/sentinel/data-connectors/github-enterprise-audit-log.md
@@ -3,7 +3,7 @@ title: "GitHub Enterprise Audit Log connector for Microsoft Sentinel"
 description: "Learn how to install the connector GitHub Enterprise Audit Log to connect your data source to Microsoft Sentinel."
 author: cwatson-cat
 ms.topic: how-to
-ms.date: 04/26/2024
+ms.date: 05/30/2024
 ms.service: microsoft-sentinel
 ms.author: cwatson
 ms.collection: sentinel-data-connector
@@ -13,7 +13,9 @@ ms.collection: sentinel-data-connector
 
 The GitHub audit log connector provides the capability to ingest GitHub logs into Microsoft Sentinel. By connecting GitHub audit logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process. 
 
- **Note:** If you are intended to ingest GitHub subscribed events into Microsoft Sentinel , Please refer to GitHub (using Webhooks) Connector from "**Data Connectors**" gallery.
+ **Note:** If you intended to ingest GitHub subscribed events into Microsoft Sentinel, please refer to GitHub (using Webhooks) Connector from "**Data Connectors**" gallery.
+
+This is autogenerated content. For changes, contact the solution provider.
 
 ## Connector attributes
 
@@ -47,8 +49,8 @@ To integrate with GitHub Enterprise Audit Log make sure you have:
 
 Connect the GitHub Enterprise Organization-level Audit Log to Microsoft Sentinel
 
-Enable GitHub audit Logs. 
- Follow [this](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal key
+Enable GitHub audit logs. 
+ Follow [this guide](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal access token.
 
 
 
diff --git a/articles/sentinel/data-connectors/vmware-vcenter.md b/articles/sentinel/data-connectors/vmware-vcenter.md
@@ -3,7 +3,7 @@ title: "VMware vCenter connector for Microsoft Sentinel"
 description: "Learn how to install the connector VMware vCenter to connect your data source to Microsoft Sentinel."
 author: cwatson-cat
 ms.topic: how-to
-ms.date: 04/26/2024
+ms.date: 05/30/2024
 ms.service: microsoft-sentinel
 ms.author: cwatson
 ms.collection: sentinel-data-connector
@@ -19,7 +19,7 @@ This is autogenerated content. For changes, contact the solution provider.
 
 | Connector attribute | Description |
 | --- | --- |
-| **Log Analytics table(s)** | vCenter_CL<br/> |
+| **Log Analytics table(s)** | vcenter_CL<br/> |
 | **Data collection rules support** | Not currently supported |
 | **Supported by** | [Microsoft Corporation](https://support.microsoft.com) |
 
@@ -47,6 +47,13 @@ vCenter
 
 
 
+## Prerequisites
+
+To integrate with VMware vCenter make sure you have: 
+
+- **Include custom pre-requisites if the connectivity requires - else delete customs**: Description for any custom pre-requisite
+
+
 ## Vendor installation instructions
 
 
@@ -64,9 +71,9 @@ Typically, you should install the agent on a different computer from the one on
 
 Follow the configuration steps below to get vCenter server logs into Microsoft Sentinel. Refer to the [Azure Monitor Documentation](/azure/azure-monitor/agents/data-sources-json) for more details on these steps.
  For vCenter Server logs, we have issues while parsing the data by OMS agent data using default settings. 
-So we advice to capture the logs into custom table **vCenter_CL** using below instructions. 
+So we advice to capture the logs into custom table **vcenter_CL** using below instructions. 
 1. Login to the server where you have installed OMS agent.
-2. Download config file [vCenter.conf](https://aka.ms/sentinel-vcenter-conf) 
+2. Download config file vCenter.conf 
 		wget -v https://aka.ms/sentinel-vcenteroms-conf -O vcenter.conf 
 3. Copy vcenter.conf to the /etc/opt/microsoft/omsagent/**workspace_id**/conf/omsagent.d/ folder. 
 		cp vcenter.conf /etc/opt/microsoft/omsagent/<<workspace_id>>/conf/omsagent.d/
@@ -80,8 +87,14 @@ So we advice to capture the logs into custom table **vCenter_CL** using below in
 5. Save changes and restart the Azure Log Analytics agent for Linux service with the following command:
 		sudo /opt/microsoft/omsagent/bin/service_control restart
 6. Modify /etc/rsyslog.conf file - add below template preferably at the beginning / before directives section 
-		$template vcenter,"%timestamp% %hostname% %msg%\n" 
-7. Create a custom conf file in /etc/rsyslog.d/ for example 10-vcenter.conf and add following filter conditions.
+
+		$template vcenter,"%timestamp% %hostname% %msg%\ n" 
+
+ **Note - There is no space between slash(\\) and character 'n' in above command.**
+
+ 7. Create a custom conf file in /etc/rsyslog.d/ for example 10-vcenter.conf and add following filter conditions.
+
+Download config file [10-vCenter.conf](https://aka.ms/sentinel-vcenter-conf)
 
 	 With an added statement you will need to create a filter which will specify the logs coming from the vcenter server to be forwarded to the custom table.
 
