You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/atlassian-confluence-audit-using-azure-functions.md
+10-21Lines changed: 10 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,37 +31,28 @@ ConfluenceAudit
31
31
| sort by TimeGenerated desc
32
32
```
33
33
34
-
35
-
36
34
## Prerequisites
37
35
38
36
To integrate with Atlassian Confluence Audit (using Azure Functions) make sure you have:
39
37
40
38
-**Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).
41
39
-**REST API Credentials/permissions**: **ConfluenceAccessToken**, **ConfluenceUsername** is required for REST API. [See the documentation to learn more about API](https://developer.atlassian.com/cloud/confluence/rest/api-group-audit/). Check all [requirements and follow the instructions](https://developer.atlassian.com/cloud/confluence/rest/intro/#auth) for obtaining credentials.
42
40
43
-
44
41
## Vendor installation instructions
45
42
46
-
47
43
> [!NOTE]
48
-
> This connector uses Azure Functions to connect to the Confluence REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
49
-
50
-
51
-
>**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
44
+
> This connector uses Azure Functions to connect to the Confluence REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
52
45
46
+
**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
53
47
54
48
**STEP 1 - Configuration steps for the Confluence API**
55
49
56
50
[Follow the instructions](https://developer.atlassian.com/cloud/confluence/rest/intro/#auth) to obtain the credentials.
57
51
58
-
59
-
60
52
**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
61
53
62
-
>**IMPORTANT:** Before deploying the Workspace data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
63
-
64
-
54
+
> [!IMPORTANT]
55
+
> Before deploying the Workspace data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
65
56
66
57
Option 1 - Azure Resource Manager (ARM) Template
67
58
@@ -71,19 +62,20 @@ Use this method for automated deployment of the Confluence Audit data connector
71
62
72
63
[](https://aka.ms/sentinel-confluenceauditapi-azuredeploy)
73
64
2. Select the preferred **Subscription**, **Resource Group** and **Location**.
74
-
> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.
75
-
3. Enter the **ConfluenceAccessToken**, **ConfluenceUsername**, **ConfluenceHomeSiteName** (short site name part, as example HOMESITENAME from https://HOMESITENAME.atlassian.net) and deploy.
65
+
> [!NOTE]
66
+
> Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.
67
+
3. Enter the **ConfluenceAccessToken**, **ConfluenceUsername**, **ConfluenceHomeSiteName** (short site name part, as example HOMESITENAME from ``` https://HOMESITENAME.atlassian.net ```) and deploy.
76
68
4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.
77
69
5. Click **Purchase** to deploy.
78
70
79
71
Option 2 - Manual Deployment of Azure Functions
80
72
81
73
Use the following step-by-step instructions to deploy the Confluence Audit data connector manually with Azure Functions (Deployment via Visual Studio Code).
82
74
83
-
84
75
**1. Deploy a Function App**
85
76
86
-
> **NOTE:** You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
77
+
> [!NOTE]
78
+
> You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
87
79
88
80
1. Download the [Azure Function App](https://aka.ms/sentinel-confluenceauditapi-functionapp) file. Extract archive to your local development computer.
89
81
2. Start VS Code. Choose File in the main menu and select Open Folder.
@@ -108,7 +100,6 @@ If you're already signed in, go to the next step.
108
100
6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.
109
101
7. Go to Azure Portal for the Function App configuration.
110
102
111
-
112
103
**2. Configure the Function App**
113
104
114
105
1. In the Function App, select the Function App Name and select **Configuration**.
@@ -120,11 +111,9 @@ If you're already signed in, go to the next step.
120
111
WorkspaceID
121
112
WorkspaceKey
122
113
logAnalyticsUri (optional)
123
-
>- Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.
114
+
- Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.
124
115
4. Once all application settings have been entered, click **Save**.
125
116
126
-
127
-
128
117
## Next steps
129
118
130
119
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-atlassianconfluenceaudit?tab=Overview) in the Azure Marketplace.
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/atlassian-jira-audit-using-azure-functions.md
+11-23Lines changed: 11 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,41 +33,31 @@ JiraAudit
33
33
| sort by TimeGenerated desc
34
34
```
35
35
36
-
37
-
38
36
## Prerequisites
39
37
40
38
To integrate with Atlassian Jira Audit (using Azure Functions) make sure you have:
41
39
42
40
-**Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).
43
41
-**REST API Credentials/permissions**: **JiraAccessToken**, **JiraUsername** is required for REST API. [See the documentation to learn more about API](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-audit-records/). Check all [requirements and follow the instructions](https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro/#authentication) for obtaining credentials.
44
42
45
-
46
43
## Vendor installation instructions
47
44
48
-
49
45
> [!NOTE]
50
-
> This connector uses Azure Functions to connect to the Jira REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
51
-
52
-
53
-
>**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
46
+
> This connector uses Azure Functions to connect to the Jira REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
54
47
48
+
**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
55
49
56
50
> [!NOTE]
57
-
> This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-jiraauditapi-parser) to create the Kusto functions alias, **JiraAudit**
58
-
51
+
> This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-jiraauditapi-parser) to create the Kusto functions alias, **JiraAudit**
59
52
60
53
**STEP 1 - Configuration steps for the Jira API**
61
54
62
55
[Follow the instructions](https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro/#authentication) to obtain the credentials.
63
56
64
-
65
-
66
57
**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
67
58
68
-
>**IMPORTANT:** Before deploying the Workspace data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
69
-
70
-
59
+
> [!IMPORTANT]
60
+
> Before deploying the Workspace data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
71
61
72
62
Option 1 - Azure Resource Manager (ARM) Template
73
63
@@ -77,19 +67,20 @@ Use this method for automated deployment of the Jira Audit data connector using
77
67
78
68
[](https://aka.ms/sentineljiraauditazuredeploy)
79
69
2. Select the preferred **Subscription**, **Resource Group** and **Location**.
80
-
> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.
81
-
3. Enter the **JiraAccessToken**, **JiraUsername**, **JiraHomeSiteName** (short site name part, as example HOMESITENAME from https://HOMESITENAME.atlassian.net) and deploy.
70
+
> [!NOTE]
71
+
> Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.
72
+
3. Enter the **JiraAccessToken**, **JiraUsername**, **JiraHomeSiteName** (short site name part, as example HOMESITENAME from ``` https://HOMESITENAME.atlassian.net ```) and deploy.
82
73
4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.
83
74
5. Click **Purchase** to deploy.
84
75
85
76
Option 2 - Manual Deployment of Azure Functions
86
77
87
78
Use the following step-by-step instructions to deploy the Jira Audit data connector manually with Azure Functions (Deployment via Visual Studio Code).
88
79
89
-
90
80
**1. Deploy a Function App**
91
81
92
-
> **NOTE:** You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
82
+
> [!NOTE]
83
+
> You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
93
84
94
85
1. Download the [Azure Function App](https://aka.ms/sentinel-jiraauditapi-functionapp) file. Extract archive to your local development computer.
95
86
2. Start VS Code. Choose File in the main menu and select Open Folder.
@@ -114,7 +105,6 @@ If you're already signed in, go to the next step.
114
105
6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.
115
106
7. Go to Azure Portal for the Function App configuration.
116
107
117
-
118
108
**2. Configure the Function App**
119
109
120
110
1. In the Function App, select the Function App Name and select **Configuration**.
@@ -126,11 +116,9 @@ If you're already signed in, go to the next step.
126
116
WorkspaceID
127
117
WorkspaceKey
128
118
logAnalyticsUri (optional)
129
-
>- Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.
119
+
- Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.
130
120
3. Once all application settings have been entered, click **Save**.
131
121
132
-
133
-
134
122
## Next steps
135
123
136
124
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-atlassianjiraaudit?tab=Overview) in the Azure Marketplace.
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/braodcom-symantec-dlp.md
+2-3Lines changed: 2 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -72,10 +72,9 @@ Install the Microsoft Monitoring Agent on your Linux machine and configure the m
72
72
2. Forward Symantec DLP logs to a Syslog agent
73
73
74
74
Configure Symantec DLP to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.
75
-
1.[Follow these instructions](https://help.symantec.com/cs/DLP15.7/DLP/v27591174_v133697641/Configuring-the-Log-to-a-Syslog-Server-action?locale=EN_US) to configure the Symantec DLP to forward syslog
76
-
2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address.
75
+
1. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address.
77
76
78
-
3. Validate connection
77
+
2. Validate connection
79
78
80
79
Follow the instructions to validate your connectivity:
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/cisco-asa-ftd-via-ama.md
+2-9Lines changed: 2 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,30 +33,23 @@ CommonSecurityLog
33
33
| sort by TimeGenerated
34
34
```
35
35
36
-
37
-
38
36
## Prerequisites
39
37
40
38
To integrate with Cisco ASA/FTD via AMA (Preview) make sure you have:
41
39
42
40
-****: To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)
43
41
44
-
45
42
## Vendor installation instructions
46
43
47
44
Enable data collection rule
48
45
49
46
> Cisco ASA/FTD event logs are collected only from **Linux** agents.
50
47
51
-
52
-
53
-
54
48
Run the following command to install and apply the Cisco ASA/FTD collector:
Copy file name to clipboardExpand all lines: articles/sentinel/data-connectors/claroty.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.author: cwatson
10
10
11
11
# Claroty connector for Microsoft Sentinel
12
12
13
-
The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/continuous-threat-detection/) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.
13
+
The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.
0 commit comments