Skip to content

Commit 1c103c9

Browse files
github-actions[bot]bavinash-netapp
github-actions[bot]
and
bavinash-netapp
authored
chore: Update Solutions Analyzer CSV files and documentation (#1)
Co-authored-by: bavinash-netapp <[email protected]>
1 parent b168312 commit 1c103c9

File tree

68 files changed

+1824
-4470
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+1824
-4470
lines changed

‎Tools/Solutions Analyzer/connector-docs/connectors-index.md‎

Lines changed: 35 additions & 689 deletions
Large diffs are not rendered by default.

‎Tools/Solutions Analyzer/connector-docs/connectors/cyeradspmccf.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Cyera DSPM Azure Sentinel Data Connector
1+
# Cyera DSPM Microsoft Sentinel Data Connector
22

33
| | |
44
|----------|-------|
@@ -8,7 +8,7 @@
88
| **Used in Solutions** | [CyeraDSPM](../solutions/cyeradspm.md) |
99
| **Connector Definition Files** | [CyeraDSPMLogs_ConnectorDefinitionCCF.json](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyeraDSPM/Data%20Connectors/CyeraDSPM_CCF/CyeraDSPMLogs_ConnectorDefinitionCCF.json) |
1010

11-
The [Cyera DSPM](https://api.cyera.io/) data connector allows you to connect to your Cyera's DSPM tenant and ingesting Classifications, Assets, Issues, and Identity Resources/Definitions into Microsoft Sentinel. The data connector is built on Microsoft Sentinel's Codeless Connector Framework and uses the Cyera's API to fetch Cyera's [DSPM Telemetry](https://www.cyera.com/) once recieced can be correlated with security events creating custom columns so that queries don't need to parse it again, thus resulting in better performance.
11+
The [Cyera DSPM](https://api.cyera.io/) data connector allows you to connect to your Cyera's DSPM tenant and ingesting Classifications, Assets, Issues, and Identity Resources/Definitions into Microsoft Sentinel. The data connector is built on Microsoft Sentinel's Codeless Connector Framework and uses the Cyera's API to fetch Cyera's [DSPM Telemetry](https://www.cyera.com/) once received can be correlated with security events creating custom columns so that queries don't need to parse it again, thus resulting in better performance.
1212

1313
## Permissions
1414

‎Tools/Solutions Analyzer/connector-docs/connectors/cyerafunctionsconnector.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Cyera DSPM Azure Functions Sentinel Data Connector
1+
# Cyera DSPM Azure Functions Microsoft Sentinel Data Connector
22

33
| | |
44
|----------|-------|
@@ -8,7 +8,7 @@
88
| **Used in Solutions** | [CyeraDSPM](../solutions/cyeradspm.md) |
99
| **Connector Definition Files** | [FunctionAppDC.json](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyeraDSPM/Data%20Connectors/CyeraDSPM_Functions/FunctionAppDC.json) |
1010

11-
The **Cyera DSPM Azure Function Connector** enables seamless ingestion of Cyera’s **Data Security Posture Management (DSPM)** telemetry — *Assets*, *Identities*, *Issues*, and *Classifications* — into **Microsoft Sentinel**.\n\nThis connector uses an **Azure Function App** to call Cyera’s REST API on a schedule, fetch the latest DSPM telemetry, and send it to Sentinel through the **Azure Monitor Logs Ingestion API** via a **Data Collection Endpoint (DCE)** and **Data Collection Rule (DCR, kind: Direct)** — no agents required.\n\n**Tables created/used**\n\n| Entity | Table | Purpose |\n|---|---|---|\n| Assets | `CyeraAssets_CL` | Raw asset metadata and data-store context |\n| Identities | `CyeraIdentities_CL` | Identity definitions and sensitivity context |\n| Issues | `CyeraIssues_CL` | Findings and remediation details |\n| Classifications | `CyeraClassifications_CL` | Data class & sensitivity definitions |\n| MS View | `CyeraAssets_MS_CL` | Normalized asset view for dashboards |\n\n> **Note:** This v7 connector supersedes the earlier CCF-based approach and aligns with Microsoft’s recommended Direct ingestion path for Sentinel.
11+
The **Cyera DSPM Azure Function Connector** enables seamless ingestion of Cyera’s **Data Security Posture Management (DSPM)** telemetry — *Assets*, *Identities*, *Issues*, and *Classifications* — into **Microsoft Sentinel**.\n\nThis connector uses an **Azure Function App** to call Cyera’s REST API on a schedule, fetch the latest DSPM telemetry, and send it to Microsoft Sentinel through the **Azure Monitor Logs Ingestion API** via a **Data Collection Endpoint (DCE)** and **Data Collection Rule (DCR, kind: Direct)** — no agents required.\n\n**Tables created/used**\n\n| Entity | Table | Purpose |\n|---|---|---|\n| Assets | `CyeraAssets_CL` | Raw asset metadata and data-store context |\n| Identities | `CyeraIdentities_CL` | Identity definitions and sensitivity context |\n| Issues | `CyeraIssues_CL` | Findings and remediation details |\n| Classifications | `CyeraClassifications_CL` | Data class & sensitivity definitions |\n| MS View | `CyeraAssets_MS_CL` | Normalized asset view for dashboards |\n\n> **Note:** This v7 connector supersedes the earlier CCF-based approach and aligns with Microsoft’s recommended Direct ingestion path for Microsoft Sentinel.
1212

1313
## Permissions
1414

@@ -36,7 +36,7 @@ The **Cyera DSPM Azure Function Connector** enables seamless ingestion of Cyera
3636
> Before deploying, have these values handy:
3737
- **Cyera Function Connector Name**: `CyeraDSPMConnector`
3838
> *Note: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.*
39-
- **Workspace Name**: `{{workspace}}`
39+
- **Workspace Name**: `{{workspace-location}}`
4040
> *Note: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.*
4141
- **Workspace Location**: `{{workspace-location}}`
4242
> *Note: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.*

‎Tools/Solutions Analyzer/connector-docs/connectors/ermesbrowsersecurityevents.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
| **Publisher** | Ermes Cyber Security S.p.A. |
77
| **Tables Ingested** | [`ErmesBrowserSecurityEvents_CL`](../tables-index.md#ermesbrowsersecurityevents_cl) |
88
| **Used in Solutions** | [Ermes Browser Security](../solutions/ermes-browser-security.md) |
9-
| **Connector Definition Files** | [data_connector_definition.json](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ermes%20Browser%20Security/Data%20Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json) |
9+
| **Connector Definition Files** | [ErmesBrowserSecurityEvents_ConnectorDefinition.json](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ermes%20Browser%20Security/Data%20Connectors/ErmesBrowserSecurityEvents_CCF/ErmesBrowserSecurityEvents_ConnectorDefinition.json) |
1010

1111
Ermes Browser Security Events
1212

@@ -26,6 +26,7 @@ Ermes Browser Security Events
2626
**1. Connect Ermes Browser Security Events to Microsoft Sentinel**
2727

2828
Connect using OAuth2 credentials
29+
- **API URL (optional)**: https://api.shield.ermessecurity.com
2930
- **OAuth Configuration**:
3031
- Client ID
3132
- Client Secret

‎Tools/Solutions Analyzer/connector-docs/connectors/esetsmc.md‎

Lines changed: 136 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -1,139 +1,139 @@
1-
# Eset Security Management Center
2-
3-
| | |
4-
|----------|-------|
5-
| **Connector ID** | `EsetSMC` |
6-
| **Publisher** | Eset |
7-
| **Tables Ingested** | [`eset_CL`](../tables-index.md#eset_cl) |
8-
| **Used in Solutions** | [Eset Security Management Center](../solutions/eset-security-management-center.md) |
9-
| **Connector Definition Files** | [esetSmc.json](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset%20Security%20Management%20Center/Data%20Connectors/esetSmc.json) |
10-
11-
Connector for [Eset SMC](https://help.eset.com/esmc_admin/72/en-US/) threat events, audit logs, firewall events and web sites filter.
12-
13-
## Permissions
14-
15-
**Resource Provider Permissions:**
16-
- **Workspace** (Workspace): read and write permissions are required.
17-
- **Keys** (Workspace): read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
18-
19-
**Custom Permissions:**
20-
- **Access to Eset SMC console**: Permissions to configure log export
21-
22-
## Setup Instructions
23-
24-
> ⚠️ **Note**: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
25-
26-
**1. Install and onboard the agent for Linux**
27-
28-
Typically, you should install the agent on a different computer from the one on which the logs are generated.
29-
30-
> Syslog logs are collected only from **Linux** agents.
31-
**Choose where to install the agent:**
32-
33-
**Install agent on Azure Linux Virtual Machine**
34-
35-
Select the machine to install the agent on and then click **Connect**.
36-
- **Install agent on Linux Virtual Machine**
37-
38-
**Install agent on a non-Azure Linux Machine**
39-
40-
Download the agent on the relevant machine and follow the instructions.
41-
- **Install agent on Linux (Non-Azure)**
42-
43-
**2. Configure the logs to be collected**
44-
45-
Configure rsyslog to accept logs from your Eset SMC IP address.
1+
# Eset Security Management Center
2+
3+
| | |
4+
|----------|-------|
5+
| **Connector ID** | `EsetSMC` |
6+
| **Publisher** | Eset |
7+
| **Tables Ingested** | [`eset_CL`](../tables-index.md#eset_cl) |
8+
| **Used in Solutions** | [Eset Security Management Center](../solutions/eset-security-management-center.md) |
9+
| **Connector Definition Files** | [esetSmc.json](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset%20Security%20Management%20Center/Data%20Connectors/esetSmc.json) |
10+
11+
Connector for [Eset SMC](https://help.eset.com/esmc_admin/72/en-US/) threat events, audit logs, firewall events and web sites filter.
12+
13+
## Permissions
14+
15+
**Resource Provider Permissions:**
16+
- **Workspace** (Workspace): read and write permissions are required.
17+
- **Keys** (Workspace): read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
18+
19+
**Custom Permissions:**
20+
- **Access to Eset SMC console**: Permissions to configure log export
21+
22+
## Setup Instructions
23+
24+
> ⚠️ **Note**: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
25+
26+
**1. Install and onboard the agent for Linux**
27+
28+
Typically, you should install the agent on a different computer from the one on which the logs are generated.
29+
30+
> Syslog logs are collected only from **Linux** agents.
31+
**Choose where to install the agent:**
32+
33+
**Install agent on Azure Linux Virtual Machine**
34+
35+
Select the machine to install the agent on and then click **Connect**.
36+
- **Install agent on Linux Virtual Machine**
37+
38+
**Install agent on a non-Azure Linux Machine**
39+
40+
Download the agent on the relevant machine and follow the instructions.
41+
- **Install agent on Linux (Non-Azure)**
42+
43+
**2. Configure the logs to be collected**
44+
45+
Configure rsyslog to accept logs from your Eset SMC IP address.
46+
47+
```
48+
sudo -i
49+
50+
# Set ESET SMC source IP address
51+
export ESETIP={Enter your IP address}
52+
53+
# Create rsyslog configuration file
54+
cat > /etc/rsyslog.d/80-remote.conf << EOF
55+
\$ModLoad imudp
56+
\$UDPServerRun 514
57+
\$ModLoad imtcp
58+
\$InputTCPServerRun 514
59+
\$AllowedSender TCP, 127.0.0.1, $ESETIP
60+
\$AllowedSender UDP, 127.0.0.1, $ESETIP
61+
user.=alert;user.=crit;user.=debug;user.=emerg;user.=err;user.=info;user.=notice;user.=warning @127.0.0.1:25224
62+
EOF
63+
64+
# Restart rsyslog
65+
systemctl restart rsyslog```
66+
67+
**3. Configure OMS agent to pass Eset SMC data in API format**
68+
69+
In order to easily recognize Eset data we will push it to separate table and parse at agent so query in Azure Sentinel is easier and fast. To make it simple we will just modify ```match oms.**``` section to send data as API objects by changing type to out_oms_api. Modify file on /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/conf/omsagent.conf. Full ```match oms.**``` section looks like this:
4670
4771
```
48-
sudo -i
49-
50-
# Set ESET SMC source IP address
51-
export ESETIP={Enter your IP address}
52-
53-
# Create rsyslog configuration file
54-
cat > /etc/rsyslog.d/80-remote.conf << EOF
55-
\$ModLoad imudp
56-
\$UDPServerRun 514
57-
\$ModLoad imtcp
58-
\$InputTCPServerRun 514
59-
\$AllowedSender TCP, 127.0.0.1, $ESETIP
60-
\$AllowedSender UDP, 127.0.0.1, $ESETIP
61-
user.=alert;user.=crit;user.=debug;user.=emerg;user.=err;user.=info;user.=notice;user.=warning @127.0.0.1:25224
62-
EOF
63-
64-
# Restart rsyslog
65-
systemctl restart rsyslog```
66-
67-
**3. Configure OMS agent to pass Eset SMC data in API format**
68-
69-
In order to easily recognize Eset data we will push it to separate table and parse at agent so query in Azure Sentinel is easier and fast. To make it simple we will just modify ```match oms.**``` section to send data as API objects by changing type to out_oms_api. Modify file on /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/conf/omsagent.conf. Full ```match oms.**``` section looks like this:
70-
71-
```
72-
<match oms.** docker.**>
73-
type out_oms_api
74-
log_level info
75-
num_threads 5
76-
run_in_background false
77-
78-
omsadmin_conf_path /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/conf/omsadmin.conf
79-
cert_path /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/certs/oms.crt
80-
key_path /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/certs/oms.key
81-
82-
buffer_chunk_limit 15m
83-
buffer_type file
84-
buffer_path /var/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/state/out_oms_common*.buffer
85-
86-
buffer_queue_limit 10
87-
buffer_queue_full_action drop_oldest_chunk
88-
flush_interval 20s
89-
retry_limit 10
90-
retry_wait 30s
91-
max_retry_wait 9m
92-
</match>
93-
```
94-
95-
**4. Change OMS agent configuration to catch tag oms.api.eset and parse structured data**
96-
97-
Modify file /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/conf/omsagent.d/syslog.conf
98-
```
99-
<source>
100-
type syslog
101-
port 25224
102-
bind 127.0.0.1
103-
protocol_type udp
104-
tag oms.api.eset
105-
</source>
106-
107-
<filter oms.api.**>
108-
@type parser
109-
key_name message
110-
format /(?<message>.*?{.*})/
111-
</filter>
112-
113-
<filter oms.api.**>
114-
@type parser
115-
key_name message
116-
format json
117-
</filter>
72+
<match oms.** docker.**>
73+
type out_oms_api
74+
log_level info
75+
num_threads 5
76+
run_in_background false
77+
78+
omsadmin_conf_path /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/conf/omsadmin.conf
79+
cert_path /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/certs/oms.crt
80+
key_path /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/certs/oms.key
81+
82+
buffer_chunk_limit 15m
83+
buffer_type file
84+
buffer_path /var/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/state/out_oms_common*.buffer
85+
86+
buffer_queue_limit 10
87+
buffer_queue_full_action drop_oldest_chunk
88+
flush_interval 20s
89+
retry_limit 10
90+
retry_wait 30s
91+
max_retry_wait 9m
92+
</match>
93+
```
94+
95+
**4. Change OMS agent configuration to catch tag oms.api.eset and parse structured data**
96+
97+
Modify file /etc/opt/microsoft/omsagent/{REPLACEyourworkspaceid}/conf/omsagent.d/syslog.conf
11898
```
119-
120-
**5. Disable automatic configuration and restart agent**
121-
122-
```bash
123-
# Disable changes to configuration files from Portal
124-
sudo su omsagent -c 'python /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable'
125-
126-
# Restart agent
127-
sudo /opt/microsoft/omsagent/bin/service_control restart
128-
129-
# Check agent logs
130-
tail -f /var/opt/microsoft/omsagent/log/omsagent.log
131-
```
132-
133-
**6. Configure Eset SMC to send logs to connector**
134-
135-
Configure Eset Logs using BSD style and JSON format.
136-
- Go to Syslog server configuration as described in [Eset documentation](https://help.eset.com/esmc_admin/72/en-US/admin_server_settings.html?admin_server_settings_syslog.html) and configure Host (your connector), Format BSD, Transport TCP
137-
- Go to Logging section as described in [Eset documentation](https://help.eset.com/esmc_admin/72/en-US/admin_server_settings.html?admin_server_settings_export_to_syslog.html) and enable JSON
138-
139-
[← Back to Connectors Index](../connectors-index.md)
99+
<source>
100+
type syslog
101+
port 25224
102+
bind 127.0.0.1
103+
protocol_type udp
104+
tag oms.api.eset
105+
</source>
106+
107+
<filter oms.api.**>
108+
@type parser
109+
key_name message
110+
format /(?<message>.*?{.*})/
111+
</filter>
112+
113+
<filter oms.api.**>
114+
@type parser
115+
key_name message
116+
format json
117+
</filter>
118+
```
119+
120+
**5. Disable automatic configuration and restart agent**
121+
122+
```bash
123+
# Disable changes to configuration files from Portal
124+
sudo su omsagent -c 'python /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable'
125+
126+
# Restart agent
127+
sudo /opt/microsoft/omsagent/bin/service_control restart
128+
129+
# Check agent logs
130+
tail -f /var/opt/microsoft/omsagent/log/omsagent.log
131+
```
132+
133+
**6. Configure Eset SMC to send logs to connector**
134+
135+
Configure Eset Logs using BSD style and JSON format.
136+
- Go to Syslog server configuration as described in [Eset documentation](https://help.eset.com/esmc_admin/72/en-US/admin_server_settings.html?admin_server_settings_syslog.html) and configure Host (your connector), Format BSD, Transport TCP
137+
- Go to Logging section as described in [Eset documentation](https://help.eset.com/esmc_admin/72/en-US/admin_server_settings.html?admin_server_settings_export_to_syslog.html) and enable JSON
138+
139+
[← Back to Connectors Index](../connectors-index.md)

0 commit comments

Comments
 (0)