
<p>Azure Sentinel is Microsoft’s cloud-native SIEM solution and the first cloud-native SIEM from a major public cloud provider. Azure Sentinel is deployed in an organization’s Azure tenant and accessed via the Microsoft Azure portal, ensuring alignment with preexisting organizational policies.</p>



<p><em>Azure Sentinel allows</em> <em>organizations to ingest, correlate, and analyze</em> <em>security signals from across the enterprise.</em> Additionally, Azure Sentinel can make use of infrastructure as a service (IaaS) and platform as a service (PaaS) available in Azure to deliver capabilities like workflow automation and long-term log retention that is typically<br>provided as add-on services from other SIEM providers.</p>



<figure class="wp-block-image size-full"><img src="https://www.thecloudxperts.co.uk/wp-content/uploads/2022/12/image.png" alt="" class="wp-image-831"/></figure>



<p class="has-medium-font-size"><strong>Azure Built-in Connectors</strong></p>



<p>Azure Sentinel includes many connectors that can be deployed in a few clicks via the Azure Sentinel portal and the requisite RBAC permissions. This includes Azure Active Directory, Azure subscription activity, Office 365,<br>and the whole family of Microsoft Defender products. New data connectors for other products are added on a regular basis. Consider the built-in data connectors over custom ones, where feasible, as they are fully supported by Microsoft and the Azure Sentinel community.</p>



<p><em><strong>This list is not actively maintained ;anymore. Refer to the ;<a rel="noreferrer noopener" href="https://docs.microsoft.com/en-us/azure/sentinel/data-connectors-reference" target="_blank">Azure Sentinel connector documentation</a> ;for more information. ;</strong></em></p>



<h3 class="has-medium-font-size wp-block-heading" id="toc-hId-810593266">Syslog and CEF</h3>



<p>Most network and security systems support either Syslog or ;CEF ;(which stands for Common Event Format) over Syslog as means for sending data to a SIEM. This makes Syslog or CEF the most straightforward ways to stream security and networking events to Azure Sentinel.</p>



<p>The advantage of CEF over Syslog is that it ensures the data is normalized, making it more immediately useful for analysis using Sentinel. However, unlike many other SIEM products, Sentinel allows ingesting unparsed Syslog events and performing analytics on them using query time parsing. ;</p>



<p>The number of systems supporting Syslog or CEF is in the hundreds, making the table below by no means comprehensive. The table links the source device&#8217;s vendor documentation for configuring the device to send events in Syslog or CEF.</p>



<h3 class="has-medium-font-size wp-block-heading" id="toc-hId--1741563695">Direct</h3>



<p>Most Microsoft cloud sources and many other clouds and on-prem systems can send to Azure Sentinel natively. For Microsoft Azure sources, this often uses their diagnostics feature.</p>



<h3 class="has-medium-font-size wp-block-heading" id="toc-hId-1246640">Agent</h3>



<p>The Log Analytics agent can collect different types of events from servers and endpoints listed here. Windows and Linux machines deployed on-premises or in any other cloud environments. Microsoft Internet Information Server (IIS) Web Servers logs can be collected via this agent. Any logs from other applications running on the same machine where MMA agent is running. This is collected via MMA Custom Log settings.</p>



<h3 class="has-medium-font-size wp-block-heading" id="toc-hId-1744056975">Threat Intelligence (TI)</h3>



<p>You can use one of the threat intelligence connectors:</p>



<ul class="wp-block-list"><li>Platform, which uses the Graph Security API</li><li>TAXII, which uses the TAXII 2.0 protocol</li></ul>



<p>to ingest threat intelligence indicators, which are used by Azure Sentinel&#8217;s built-in TI analytics rules, and to build your own rules.</p>



<h3 class="has-medium-font-size wp-block-heading" id="toc-hId--808099986">Custom: Logic Apps, Logstash, Azure Functions, Rest API and others</h3>



<p>In addition to CEF and Syslog, many solutions are based on Sentinel&#8217;s data collector API and create custom log tables in the workspace. Those belong to 3 groups:</p>



<ul class="wp-block-list"><li>Sources that support Logstash have an output plug-in that can send the events to Azure Sentinel.</li><li>Sources that have native support for the API.</li><li>Sources for which there is a community or Microsoft field-created solution that uses the API, usually using Logic Apps or an Azure function.</li><li>As a low-footprint, relatively inexpensive resource, Azure Function Apps are one of the most stable and performant log ingestion methods. Functions apps provide the full capabilities of .Net, Python, PowerShell, and recently, Node.js and can be used to perform a wide range of log ingestion tasks, including but not limited to log retrieval via REST APIs, pagination, filtering or parsing, and enrichment of data.</li></ul>



<h3 class="has-medium-font-size wp-block-heading" id="toc-hId-934710349">Automation and integration</h3>



<p>While all the types above focused on getting telemetry into Azure Sentinel, connectors marked as automation/integration enable Azure Sentinel to implement other use cases such as sending information to another system or performing an action on another system. Those might be API-based on integration or Logic App-based integrations. </p>



<p><strong><em>The main engine behind the Azure Sentinel</em> <em>automation capability is Azure Logic Apps.</em> </strong>Azure Sentinel <strong>playbooks</strong> can perform very advanced tasks with activities branching based on criteria identified in alerts or data retrieved using indicators collected in alerts. The full processing can be performed within the Azure Sentinel environment and is limited only by the automation capabilities provided by the third-party security controls required to provide information or perform additional tasks.</p>



<h2 class="has-medium-font-size wp-block-heading" id="toc-hId--1420933107">The Grand List</h2>



<p>The wide variety of potential data types as log sources means that the consideration paid to each<br>different data type is important at the outset of an Azure Sentinel project. Azure Sentinel includes<br>more than 100 connectors, out of the box, with the ability to create custom sources to meet individual<br>requirements. We have collected a summary table of some of the more common data source types, with<br>experiential commentary relevant for deployment teams configuring new data ingest sources.</p>



<figure class="wp-block-table"><table><tbody><tr><td><strong>Vendor</strong></td><td><strong>Product</strong></td><td><strong>Connector<br>Type</strong></td><td><strong>Connecting and using</strong></td></tr><tr><td><strong>Agari</strong></td><td>Phishing Defense and Brand Protection</td><td>Built-in (Function, Graph Security API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-agari-phishing-defense">Instructions</a></td></tr><tr><td><strong>AI Vectra</strong></td><td>Detect</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-ai-vectra-detect">Instructions</a></td></tr><tr><td><strong>Akamai</strong></td><td> ;</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-akamai-security-events" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Alcide</strong></td><td>kAudit</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-alcide-kaudit">Instructions</a></td></tr><tr><td><strong>AlgoSec</strong></td><td>ASMS</td><td>CEF</td><td><a href="https://www.algosec.com/docs/en/asms/a30.00/asms-help/content/shared-files/syslog-msg-ref.htm">Instructions and examples</a></td></tr><tr><td><strong>Anomali</strong></td><td>Limo</td><td>Built-in (TAXII)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence#connect-azure-sentinel-to-taxii-servers">Instructions</a></td></tr><tr><td><strong>Anomali</strong></td><td>ThreatStream</td><td>Built-in (TI Platform)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence#instructions">Instructions</a></td></tr><tr><td><strong>Anomali</strong></td><td>Match</td><td>Integration</td><td><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/use-microsoft-azure-sentinel-and-anomali-match-for-actionable/ba-p/2080763">Overview and instructions</a></td></tr><tr><td><strong>Apache</strong></td><td>httpd</td><td>Built-in (Agent custom logs)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-apache-http-server">Instructions</a>Also, read ;<a href="https://www.loggly.com/ultimate-guide/centralizing-apache-logs/" target="_blank" rel="noreferrer noopener">using rsyslog or logger as a file forwarder</a> ;for an alternative method.</td></tr><tr><td><strong>Apache</strong></td><td>Kafka</td><td>Logstash</td><td>See Logstash ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-kafka.html">plug-in</a>. Use to get events sent using Kafka, not for Kafka&#8217;s own audit events.</td></tr><tr><td><strong>Aruba</strong></td><td>ClearPass</td><td>CEF</td><td><a href="https://www.arubanetworks.com/techdocs/ClearPass/6.8/PolicyManager/index.htm#CPPM_UserGuide/Admin/syslogExportFilters_add_syslog_filter_general.htm">Instructions</a></td></tr><tr><td><strong>AT&;T Cyber</strong></td><td>AlienVault OTX</td><td>TI (Platform)</td><td>Using Logic Apps, See ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/ingesting-alien-vault-otx-threat-indicators-into-azure-sentinel/ba-p/1086566">instructions</a></td></tr><tr><td><strong>AWS</strong></td><td>CloudTrail</td><td>Built-in</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-aws">Sentinel built-in connector</a></td></tr><tr><td><strong>AWS</strong></td><td>CloudTrail S3 logs</td><td>Custom</td><td>Using an Azure Function. See ;<a href="https://github.com/andedevsecops/AWS-CloudTrail-AzFunc">here</a>.Using an AWS Lambda Function. See ;<a href="https://github.com/andedevsecops/aws-data-connector-az-sentinel">here</a>.</td></tr><tr><td><strong>AWS</strong></td><td>CloudWatch</td><td>Logstash</td><td>See ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-cloudwatch.html">Logstash Plug-in</a>.</td></tr><tr><td><strong>AWS</strong></td><td>Kinesis</td><td>Logstash</td><td>See ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-kinesis.html">Logstash Plug-in</a>.</td></tr><tr><td><strong>AWS</strong></td><td>Object Level S3 Logging</td><td>Logstash ;</td><td>See ;<a href="https://techcommunity.microsoft.com/t5/Azure-Sentinel/Hunting-for-Capital-One-Breach-TTPs-in-AWS-logs-using-Azure/ba-p/1019767">here</a>.</td></tr><tr><td><strong>AWS</strong></td><td>Security Hub</td><td>Custom</td><td>Azure Function. See ;<a href="https://github.com/andedevsecops/AWS-Security-Hub-Data-Connector">here</a>.</td></tr><tr><td><strong>Barracuda</strong></td><td>WAF</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-barracuda">Instructions</a></td></tr><tr><td><strong>Barracuda</strong></td><td>CloudGen Firewall</td><td>API</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-barracuda-cloudgen-firewall">Sentinel built-in connector</a></td></tr><tr><td><strong>BETTER Mobile</strong></td><td>Threat Defense</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-better-mtd">Instructions</a></td></tr><tr><td><strong>Beyond Security</strong></td><td>beSECURE</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-besecure">Instructions</a></td></tr><tr><td><strong>Carbon Black</strong></td><td>Cloud Endpoint Standard (Cb Defense)</td><td>Built-in (Function)Syslog</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-vmware-carbon-black">Sentinel built-in connector ;</a> ;<a href="https://developer.carbonblack.com/reference/cb-defense/integrations/" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Carbon Black</strong></td><td>(Cb Response)</td><td>Syslog</td><td><a href="https://developer.carbonblack.com/2016/06/cb-event-forwarder-3.2.0-released/" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Checkpoint</strong></td><td> ;</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-checkpoint">Sentinel Built-in connector</a></td></tr><tr><td><strong>Cisco</strong></td><td>ACS</td><td>Syslog</td><td><a href="https://community.cisco.com/t5/security-documents/acs-5-x-configuring-the-external-syslog-server/ta-p/3143143">Instructions</a></td></tr><tr><td><strong>Cisco</strong></td><td>ASA</td><td>Cisco (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-cisco">Sentinel built-in connector</a>Notes:- Cisco ASA support uses Sentinel&#8217;s CEF pipeline. However, Cisco&#8217;s logging is not in CEF format.- Make sure you disable logging timestamp using &#8220;no logging timestamp&#8221;. See ;<a href="https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/monitor_syslog.html" target="_blank" rel="noreferrer noopener">here</a> ;for more details.</td></tr><tr><td><strong>Cisco</strong></td><td>Cloud Security Gateway (CWS)</td><td>CEF</td><td>Use the ;<a href="https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/Advanced_Reporting/WSA_Advanced_Reporting_6/Advanced_Web_Security_Reporting_6_3.pdf" target="_blank" rel="noreferrer noopener">Cisco Advanced Web Security Reporting</a>.</td></tr><tr><td><strong>Cisco</strong></td><td>FTD</td><td>Cisco (CEF)</td><td>FTP Platform logs are compatible with ASA logs and can use the same connector (see ;<a href="https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212420-configure-firepower-threat-defense-ftd.html#anc8">here</a>).</td></tr><tr><td><strong>Cisco</strong></td><td>IOS</td><td>Syslog</td><td><a href="https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html">Instructions</a></td></tr><tr><td><strong>Cisco</strong></td><td>ISE ; (NAC)</td><td>Syslog</td><td><a href="https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_maintain_monitor.html?bookSearch=true#ID58">Instructions</a></td></tr><tr><td><strong>Cisco</strong></td><td>Web Security Appliance (WSA)</td><td>CEF</td><td>Use the ;<a href="https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/Advanced_Reporting/WSA_Advanced_Reporting_6/Advanced_Web_Security_Reporting_6_3.pdf" target="_blank" rel="noreferrer noopener">Cisco Advanced Web Security Reporting</a>.</td></tr><tr><td><strong>Cisco</strong></td><td>Meraki</td><td>Syslog</td><td><a href="https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration" target="_blank" rel="noreferrer noopener">Instructions</a><a href="https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples" target="_blank" rel="noreferrer noopener">Event Types and Log Samples</a></td></tr><tr><td><strong>Cisco</strong></td><td>eStreamer</td><td>CEF</td><td><a href="https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreCLIOperationsGuide_354.html">Using enCore</a></td></tr><tr><td><strong>Cisco</strong></td><td>Firepower Threat Defense</td><td>CEFSyslog</td><td><a href="http://%3Ctable%20title%3D%22table%22%3E%20%3Ctbody%3E%20%3Ctr%3E%20%3Ctd%20width%3D%22148.267px%22%20height%3D%2228px%22%20style%3D%22width:%20148.667px;";><strong>Cisco</strong%3E%3C/td%3E%20%3Ctd%20width=%22156.267px%22%20height=%2228px%22%20style=%22width:%20156.667px;%22%3EeStreamer%3C/td%3E%20%3Ctd%20width=%2288.5333px%22%20height=%2228px%22%20style=%22width:%2088.6667px;%22%3ECEF%3C/td%3E%20%3Ctd%20width=%22361.067px%22%20height=%2228px%22%20style=%22width:%20360px;%22%3E%20%3Cp%3E%3Ca%20href=%22https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreCLIOperationsGuide_354.html%22%20target=%22_self%22%3EUsing%20enCore%3C/a%3E%3C/p%3E%20%3C/td%3E%20%3C/tr%3E%20%3C/tbody%3E%20%3C/table%3E">Using eStreamer enCore</a><a href="https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/analyze_events_using_external_tools.html" target="_blank" rel="noreferrer noopener">Instructions,</a> ;<a href="https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide/about.html">Event reference</a></td></tr><tr><td><strong>Cisco</strong></td><td>FireSight</td><td>CEF</td><td><a href="http://%3Ctable%20title%3D%22table%22%3E%20%3Ctbody%3E%20%3Ctr%3E%20%3Ctd%20width%3D%22148.267px%22%20height%3D%2228px%22%20style%3D%22width:%20148.667px;";><strong>Cisco</strong%3E%3C/td%3E%20%3Ctd%20width=%22156.267px%22%20height=%2228px%22%20style=%22width:%20156.667px;%22%3EeStreamer%3C/td%3E%20%3Ctd%20width=%2288.5333px%22%20height=%2228px%22%20style=%22width:%2088.6667px;%22%3ECEF%3C/td%3E%20%3Ctd%20width=%22361.067px%22%20height=%2228px%22%20style=%22width:%20360px;%22%3E%20%3Cp%3E%3Ca%20href=%22https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreCLIOperationsGuide_354.html%22%20target=%22_self%22%3EUsing%20enCore%3C/a%3E%3C/p%3E%20%3C/td%3E%20%3C/tr%3E%20%3C/tbody%3E%20%3C/table%3E">Using eStreamer enCore</a></td></tr><tr><td><strong>Cisco</strong></td><td>IronPort Web Security Appliance</td><td>Syslog</td><td><a href="https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa_12-0/user_guide/b_WSA_UserGuide_12_0/b_WSA_UserGuide_11_7_chapter_010101.html" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Cisco</strong></td><td>Nexus</td><td>Syslog</td><td><a href="https://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_1/Cisco_Nexus_5000_Series_Switch_CLI_Software_Configuration_Guide_chapter26.html">Instructions</a></td></tr><tr><td><strong>Cisco</strong></td><td>Umbrella</td><td>Built-in (Function)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-cisco-umbrella">Instructions</a>Also, see ;<a href="https://www.linkedin.com/pulse/curious-case-saas-3rd-party-azure-sentinel-nathan-swift/">this blog post</a>for a custom solution</td></tr><tr><td><strong>Cisco</strong></td><td>Unified Computing System (UCS)</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-cisco-ucs">Instructions</a></td></tr><tr><td><strong>Cisco</strong></td><td>Viptela ;SD-WAN</td><td>Syslog</td><td><a href="https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/SD-WAN_Release_17.1/02System_and_Interfaces/08Configuring_System_Logging">Instructions</a></td></tr><tr><td><strong>Citrix</strong></td><td>Analytics</td><td>Built-in (Direct)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-citrix-analytics">Instructions</a></td></tr><tr><td><strong>Citrix</strong></td><td>NetScaler ;</td><td>Syslog</td><td><a href="https://docs.citrix.com/en-us/citrix-adc/13/system/audit-logging/configuring-audit-logging.html" target="_blank" rel="noreferrer noopener">Instructions</a><a href="https://developer-docs.citrix.com/projects/citrix-adc-syslog-message-reference/en/latest/" target="_blank" rel="noreferrer noopener">Message format</a></td></tr><tr><td><strong>Citrix</strong></td><td>NetScaler App FW</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-citrix-waf" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Clearswift</strong></td><td>Web Security Gateway</td><td>Syslog</td><td><a href="https://clearswifthelp.clearswift.com/SWG/500/en/SWG.htm#Sections/SystemsCenter/SYCLogExport.htm%3FTocPath%3DMonitor%2520and%2520manage%2520Gateway%7CLogs%2520and%2520Alarms%7C_____2">Instructions</a></td></tr><tr><td><strong>Cloudflare</strong></td><td> ;</td><td> ;</td><td>Use Cloudflare ;<a href="https://blog.cloudflare.com/export-logs-from-cloudflare-gateway-with-logpush/" target="_blank" rel="noreferrer noopener">Logpush</a> ;to send to storage and a custom connector to read events from storage (for example, r<a href="https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/S3-Lambda">eading AWS S3 buckets</a>).</td></tr><tr><td><strong>Cribl</strong></td><td>LogStream</td><td>Direct</td><td><a href="https://cribl.io/blog/integrating-cribl-logstream-with-azure-sentinel-a-practical-walkthrough/">Instructions</a></td></tr><tr><td><strong>CrowdStrike</strong></td><td>Falcon</td><td>CEF</td><td><a href="https://www.crowdstrike.com/blog/tech-center/integrate-with-your-siem/">Instructions</a>. Use a ;<a href="https://www.crowdstrike.com/resources/data-sheets/falcon-connector/" target="_blank" rel="noreferrer noopener">SIEM connector</a> ;installed on-premises.</td></tr><tr><td><strong>CyberArk</strong></td><td>Endpoint Privilege Manager (EPM)</td><td>SyslogLogstash</td><td><a href="https://docs.cyberark.com/Product-Doc/OnlineHelp/EPM-onprem/Latest/en/Content/EPM/Server%20User%20Guide/Enabling%20Third%20Party%20Event%20Forwarding.htm">Instructions</a> ;(for both)</td></tr><tr><td><strong>CyberArk</strong></td><td>Privileged Access Security (PTA)</td><td>CEF</td><td><a href="https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PTA/Outbound-Sending-%20PTA-syslog-Records-to-SIEM.htm">Instructions</a><a href="https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PTA/CEF-Based-Format-Definition.htm">Message format</a></td></tr><tr><td><strong>Darktrace</strong></td><td>Immune</td><td>CEF</td><td>See ;<a href="https://www.darktrace.com/en/press/2016/73/">announcement</a>. Contact vendor for instructions.</td></tr><tr><td><strong>Digital Guardian</strong></td><td> ;</td><td>CEF</td><td><a href="https://docs.mcafee.com/bundle/enterprise-security-manager-data-sources-configuration-reference-guide/page/GUID-7CB66D98-B24B-4FDA-B962-AA332D20DEF4.html">3rd party instructions</a></td></tr><tr><td><strong>DocuSign</strong></td><td>Monitor</td><td>Custom</td><td>See this ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/protecting-your-docusign-agreements-with-azure-sentinel/ba-p/2085502">blog post</a></td></tr><tr><td><strong>Duo Security</strong></td><td> ;</td><td>CEF</td><td>Using Duo ;<a href="https://github.com/duosecurity/duo_log_sync/">LogSync</a></td></tr><tr><td><strong>Extrahop</strong></td><td>Reveal</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-extrahop">Instructions</a></td></tr><tr><td><strong>F5</strong></td><td>ASM (WAF)</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-f5">Instructions</a></td></tr><tr><td><strong>F5</strong></td><td>BigIP (System, LTM, AFM, ASM, APM, AVR)</td><td>Built-in (Direct)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-f5-big-ip">Instructions</a> ;</td></tr><tr><td><strong>Fastly</strong></td><td>WAF</td><td>Custom</td><td>See ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/ingest-fastly-web-application-firewall-logs-into-azure-sentinel/ba-p/1238804">this blog post</a> ;(Logic Apps or Azure Function)</td></tr><tr><td><strong>Forcepoint</strong></td><td>Web Security (WebSense)</td><td>CEF</td><td><a href="https://www.websense.com/content/support/library/web/v78/triton_web_help/settings_siem_explain.aspx">Instructions</a><a href="http://www.websense.com/content/support/library/web/v76/siem/siem.pdf#page=22">Detailed reference</a></td></tr><tr><td><strong>Forcepoint</strong></td><td>CASB</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-forcepoint-casb-ngfw">Sentinel built-in connector</a></td></tr><tr><td><strong>Forcepoint</strong></td><td>DLP</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-forcepoint-dlp">Sentinel built-in connector</a></td></tr><tr><td><strong>Forcepoint</strong></td><td>NGFW</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-forcepoint-casb-ngfw">Sentinel built-in connector</a></td></tr><tr><td><strong>Forescout</strong></td><td>CounterAct</td><td>CEF</td><td><a href="https://www.forescout.com/company/resources/cef-plugin-configuration-guide-2-6-0/">Instructions</a></td></tr><tr><td><strong>Fortinet</strong></td><td> ;</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-fortinet">Sentinel built-in connector</a><a href="https://docs.fortinet.com/document/fortigate/6.2.0/fortios-log-message-reference/998820/fortios-to-cef-log-field-mapping-guidelines" target="_blank" rel="noreferrer noopener">Log message reference</a><a href="https://docs.fortinet.com/document/fortigate/6.2.0/fortios-log-message-reference/127777/examples-of-cef-support" target="_blank" rel="noreferrer noopener">CEF mapping and examples</a></td></tr><tr><td><strong>Fortinet</strong></td><td>FortiSIEM</td><td>CEF</td><td><a href="https://help.fortinet.com/fa/faz50hlp/56/5-6-1/FMG-FAZ/2400_System_Settings/1600_Log%20Forwarding/0400_Configuring.htm">Instructions</a></td></tr><tr><td><strong>Fortinet</strong></td><td>FortiSOAR</td><td>Integration</td><td><a href="https://docs.fortinet.com/document/fortisoar/1.0.0/azure-sentinel/1/azure-sentinel-v1-0-0">Instructions</a></td></tr><tr><td><strong>GitHub</strong></td><td> ;</td><td>Custom</td><td>See connector, rules, and hunting queries ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/protecting-your-github-assets-with-azure-sentinel/ba-p/1457721">here</a></td></tr><tr><td><strong>GCP</strong></td><td>Cloud Storage</td><td>Logstash</td><td>See ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-google_cloud_storage.html">Plug-in</a>. Use to get events stored in GCP Cloud Storage, not for Cloud Storage own audit events.</td></tr><tr><td><strong>GCP</strong></td><td>Pub/Sub</td><td>Logstash</td><td>See ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-google_pubsub.html">Plug-in</a>. ;Use to get events sent using Pub/Sub, not for Pub/Sub own audit events.</td></tr><tr><td><strong>GCP</strong></td><td>Stacdriver</td><td>Logstash ;Custom</td><td>Through GCP Cloud Storage or GCP Pub/Sub as described above. ;Using GCP Cloud Function. See ;<a href="https://github.com/andedevsecops/azure-sentinel-gcp-data-connector">here</a>.</td></tr><tr><td><strong>Group-IB</strong></td><td> ;</td><td>Custom (TI Platform)</td><td>Using Logic Apps. See ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/group-ib-threat-intelligence-and-attribution-connector-azure/ba-p/2252904">instructions</a></td></tr><tr><td><strong>GuardiCore</strong></td><td>Centra</td><td>CEF</td><td>Contact vendor for instructions</td></tr><tr><td><strong>HP</strong></td><td>Printers</td><td>Syslog</td><td><a href="http://h10032.www1.hp.com/ctg/Manual/c04531741">Instructions</a></td></tr><tr><td><strong>IBM</strong></td><td>iSeries</td><td>CEF</td><td>See ;<a href="https://developer.ibm.com/technologies/systems/articles/connecting-ibm-i-to-siem-systems/">here</a>.</td></tr><tr><td><strong>IBM</strong></td><td>QRadar events</td><td>Syslog</td><td>Forward raw events or correlation events in raw, parsed, or JSON format. See ;<a href="https://www.ibm.com/support/knowledgecenter/SS42VS_7.4.0/com.ibm.qradar.doc/c_qradar_adm_frwd_event_data.html">instructions</a>.</td></tr><tr><td><strong>IBM</strong></td><td>QRadar offenses</td><td>Custom (Function)</td><td><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/migrating-qradar-offenses-to-azure-sentinel/ba-p/2102043">Blog post</a></td></tr><tr><td><strong>IBM</strong></td><td>X-Force</td><td>TI (TAXII)</td><td><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/connect-x-force-exchange-api-on-azure-sentinel/ba-p/1246880">Instructions</a></td></tr><tr><td><strong>IBM</strong></td><td>zSecure</td><td>CEF</td><td>See ;<a href="https://www.ibm.com/support/knowledgecenter/en/SS2RWS_2.3.0/com.ibm.zsecure.doc_2.3.0/about_this_release/about_rel_whats_new.html" target="_blank" rel="noreferrer noopener">What&#8217;s new for zSecure V2.3.0</a>Note that it supports alerts only.</td></tr><tr><td><strong>Illusive ;</strong></td><td>Attack Management System</td><td>Syslog</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-illusive-attack-management-system">Sentinel built-in connector</a></td></tr><tr><td><strong>Imperva</strong></td><td>SecureSphere</td><td>CEF</td><td><a href="https://www.imperva.com/docs/SB_Imperva_SecureSphere_CEF_guide.pdf" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Infoblox</strong></td><td>NIOS</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-infoblox">Instructions</a></td></tr><tr><td><strong>InSights</strong></td><td> ;</td><td>TI (TAXII)</td><td><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/bring-threat-intelligence-from-intsights-using-taxii-data/ba-p/2080178">TAXII Instructions and related workbook</a></td></tr><tr><td><strong>Jamf</strong></td><td>Pro</td><td>Syslog</td><td><a href="https://docs.jamf.com/10.25.0/jamf-pro/administrator-guide/Change_Management.html">Instructions</a></td></tr><tr><td><strong>Juniper</strong></td><td>ATP</td><td>CEF</td><td><a href="https://www.juniper.net/documentation/en_US/release-independent/jatp/topics/task/multi-task/jatp-siem-syslog-leef-and-cef-logging.html">Instructions</a></td></tr><tr><td><strong>Juniper</strong></td><td>JunOS based devices</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-juniper-srx">Instructions</a></td></tr><tr><td><strong>Kaspersky</strong></td><td>Security Center ;</td><td>CEF</td><td><a href="https://support.kaspersky.com/KSC/SP3/en-US/151334.htm" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>ManageEngine</strong></td><td>AD Audit Plus</td><td>CEF</td><td><a href="https://www.manageengine.com/products/active-directory-audit/help/getting-started/siem-integration.html">Instructions</a> ;(use ArcSight instructions)</td></tr><tr><td><strong>ManageEngine</strong></td><td>Exchange Reporter Plus</td><td>Syslog</td><td><a href="https://www.manageengine.com/products/exchange-reports/help/admin/log-forwarder.html">Instructions</a></td></tr><tr><td><strong>McAfee</strong></td><td>ePO</td><td>Syslog</td><td><a href="https://docs.mcafee.com/bundle/epolicy-orchestrator-5.9.x-product-guide/page/GUID-5C5332B3-837A-4DDA-BE5C-1513A230D90A.html">Instructions</a> ;(Note: TLS only (requires ;<a href="https://www.rsyslog.com/doc/v8-stable/tutorials/tls_cert_summary.html" target="_blank" rel="noreferrer noopener">rsyslog TLS configuration)</a></td></tr><tr><td><strong>McAfee</strong></td><td>MVISION EDR</td><td>Syslog</td><td><a href="https://github.com/mohlcyber/McAfee-MVISION-EDR-Integrations/tree/master/activity-feeds">Instructions</a></td></tr><tr><td><strong>McAfee</strong></td><td>Web Gateway</td><td>CEF</td><td><a href="https://community.mcafee.com/t5/Documents/Web-Gateway-Understanding-syslog-send-logs-to-your-SIEM-or-other/ta-p/554145#toc-hId-440677315" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Microfocus</strong></td><td>Fortify AppDefender</td><td>CEF</td><td><a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fappdefender.fortify.com%2Fdocumentation%2FDefault.htm%23AppDefender_Topics%2F7_Administer%2FSyslog%2520Settings%2FAV_Ten_CEF_output.htm%253FTocPath%253DAdministration%252520View%257CAbout%252520Syslog%252520Connections%257C_____1&;data=02%7C01%7COfer.Shezaf%40microsoft.com%7C27cf350463e2495b103708d842c5541b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637332762588484276&;sdata=qJHZGqWRgn21Sh0A1jEvYUNAvTii%2FItE%2Fg0EnPg5v7I%3D&;reserved=0">Instructions</a> ;(require authentication; contact vendor for further details).</td></tr><tr><td><strong>Microsoft</strong></td><td>Active Directory</td><td>Agent</td><td>Most AD events are logged as part of security events. ;Also, See in this list:LDAP auditingSMBv1 auditing</td></tr><tr><td><strong>Microsoft</strong></td><td>Advanced Threat Protection (ATA)</td><td>CEF</td><td><a href="https://docs.microsoft.com/EN-US/advanced-threat-analytics/install-ata-step6">Instructions</a><a href="https://docs.microsoft.com/en-us/advanced-threat-analytics/cef-format-sa">Log reference</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Active Directory (AAD)</td><td>Built-in (Diagnostics)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory">Instructions</a>Detections: ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/Detections/SigninLogs">Sign-in Logs</a>, ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/Detections/AuditLogs">Audit Logs</a><a href="https://docs.microsoft.com/en-us/azure/sentinel/top-workbooks">Built-in workbooks:</a>Azure AD Audit Logs,Azure AD Audit, Activity and Sign-in LogsAzure AD Sign-in logsWebinars: ;&#8220;A day in a SOC analyst life&#8221; (<a href="https://youtu.be/HloK6Ay4h1M" target="_blank" rel="noreferrer noopener">YouTube</a>, ;<a href="https://1drv.ms/v/s%21AnEPjr8tHcNmghEg_9Z2NjQ_DDpo" target="_blank" rel="noreferrer noopener">MP4</a>, ;<a href="https://1drv.ms/b/s%21AnEPjr8tHcNmghALzkfTkg-dTmfH" target="_blank" rel="noreferrer noopener">Presentation</a>)&#8221;Tackling Identity&#8221; ; ;<a href="https://youtu.be/BcxiY32famg" target="_blank" rel="noreferrer noopener">(YouTube</a>, ;<a href="https://1drv.ms/v/s!AnEPjr8tHcNmghxbFa4WcLrfBJwe" target="_blank" rel="noreferrer noopener">MP4</a>, ;<a href="https://1drv.ms/b/s!AnEPjr8tHcNmghskgL3XiweyXwF_" target="_blank" rel="noreferrer noopener">Presentation</a>) ;</td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Active Directory Domain Services</td><td>Diagnostics</td><td><a href="https://docs.microsoft.com/en-us/azure/active-directory-domain-services/security-audit-events">Instructions</a><a href="https://docs.microsoft.com/en-us/azure/active-directory-domain-services/use-azure-monitor-workbooks">Use Workbooks to analyze</a></td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection">Azure Active Directory Identity Protection</a></td><td> ;</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-ad-identity-protection">Instructions</a><a href="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks">Alert information</a></td></tr><tr><td><strong>Microsoft</strong></td><td>AzureAzure ActivityAzure SubscriptionsAzure Management Groups</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-activity">Built-in connector</a>,Connect through the ;<a href="https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log">subscription diagnostic settings</a> ;to ensure lower latency and broader collection.For Management groups, ;<a href="https://docs.microsoft.com/en-us/rest/api/monitor/managementgroupdiagnosticsettings">Use the API to turn on diagnostics settings</a><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema">Azure Activity schema</a><a href="https://github.com/Azure/Azure-Sentinel/tree/master/Detections/AzureActivity">Detections</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Application Insights</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resource">Send to a sentinel workspace</a>Or use ;<a href="https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/cross-workspace-query" target="_blank" rel="noreferrer noopener">queries across workspaces</a></td></tr><tr><td><strong>Microsoft</strong></td><td>App Services &; Web Application monitoring ;</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/app-monitoring">Instructions and reference architecture</a> ;</td></tr><tr><td><strong>Microsoft</strong></td><td>Azure B2B</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/active-directory/b2b/auditing-and-reporting" target="_blank" rel="noreferrer noopener">Included as part of AAD events</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure B2C</td><td>Direct</td><td>collect B2C logs from your B2C tenant to your primary tenant AAD logs as described ;<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory-b2c%2Fazure-monitor&;data=02%7C01%7COfer.Shezaf%40microsoft.com%7C5336e81cdfeb4b657ac808d815c6f928%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637283291785222659&;sdata=ktixiEB9wYXx%2F%2BIh0bCSsdylzkQszxaLPUiTGFO4Gyc%3D&;reserved=0" target="_blank" rel="noreferrer noopener">here</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Cosmos DB</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/cosmos-db/cosmosdb-monitor-resource-logs">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Data Lake Gen 1</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-diagnostic-logs#enable-diagnostic-logging-for-your-data-lake-storage-gen1-account">Instructions</a><a href="https://docs.microsoft.com/en-us/archive/blogs/azuredatalake/struggling-to-get-insights-for-your-azure-data-lake-store-azure-log-analytics-can-help#create-your-first-log-analytics-query-for-an-azure-data-lake-store-account">Query examples</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Data Factory</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/data-factory/monitor-using-azure-monitor">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Databricks</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/architecture/databricks-monitoring/application-logs">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure DDOS</td><td>Built-in (diagnostics)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-ddos-protection">Built-in connector</a><a href="https://docs.microsoft.com/en-us/azure/virtual-network/manage-ddos-protection#configure-ddos-attack-mitigation-reports" target="_blank" rel="noreferrer noopener">Diagnostics instructions</a><a href="https://github.com/Azure/Azure-Network-Security/tree/master/Azure%20DDoS%20Protection/Enable%20Diagnostic%20Logging/Powershell">Enable collection using PowerShell</a><a href="https://www.youtube.com/watch?v=au_PsT2WUyM">Webinar: Detecting and Responding to Threats using Azure Network Security tools and Azure Sentinel</a></td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/azure/security-center/azure-defender">Azure Defender</a> ; and ;<a href="https://docs.microsoft.com/en-us/azure/security-center/security-center-introduction">Azure Security Center</a> ;(ASC)</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center">Built-in connector for getting ASC alerts</a> ;<a href="https://docs.microsoft.com/en-us/azure/security-center/alerts-reference">Alert list</a> ;and ;<a href="https://docs.microsoft.com/en-us/azure/security-center/alerts-schemas?tabs=schema-sentinel">alert schema</a>.Use ;<a href="https://docs.microsoft.com/en-us/azure/security-center/continuous-export">Azure Defender&#8217;s continuous export feature</a> ;to get recommendations, findings, secure score, and compliance data to Sentinel.</td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/azure/defender-for-iot/overview">Azure Defender for IoT</a></td><td>Built-in (Direct)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-asc-iot">Instructions</a><a href="https://docs.microsoft.com/en-us/azure/defender-for-iot/concept-security-alerts">Alerts Overview</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure DevOps</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/devops/organizations/audit/auditing-streaming?toc=%2Fazure%2Fdevops%2Fsecurity-access-billing%2Ftoc.json&;bc=%2Fazure%2Fdevops%2Fsecurity-access-billing%2Fbreadcrumb%2Ftoc.json&;view=azure-devops#set-up-an-azure-monitor-log-stream">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Event Hub (subscription)</td><td>Logstash</td><td>See ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-azure_event_hubs.html">Logstash Plug-in</a>. Use to get events sent using an Event Hub, not for Event Hub own audit events.</td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Files</td><td>Direct (Diagnostics)</td><td><a href="https://docs.microsoft.com/en-us/azure/storage/files/storage-files-monitoring?tabs=azure-portal">Instructions</a><a href="https://docs.microsoft.com/en-us/azure/storage/files/storage-files-monitoring-reference#resource-logs-preview">Schema information</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Firewall</td><td>Built-in (diagnostics)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-firewall">Built-in connector</a><a href="https://docs.microsoft.com/en-us/azure/firewall/firewall-workbook">Workbook</a><a href="https://github.com/Azure/Azure-Network-Security/tree/master/Azure%20Firewall/Enable%20Diagnostic%20Logging/Powershell">Enable collection using PowerShell</a> ;or ;<a href="https://docs.microsoft.com/en-us/azure/firewall/tutorial-diagnostics" target="_blank" rel="noreferrer noopener">diagnostics</a><a href="https://www.youtube.com/watch?v=au_PsT2WUyM">Webinar: Detecting and Responding to Threats using Azure Network Security tools and Azure Sentinel</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Front Door</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/frontdoor/front-door-diagnostics" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Key Vault (AKV)</td><td>Built-in (Diagnostics)</td><td>Connect:<a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-key-vault">Instructions</a> ;(Built-in, Using policy)<a href="https://docs.microsoft.com/en-us/azure/azure-monitor/insights/azure-key-vault#enable-key-vault-diagnostics-in-the-portal">Enable AKV diagnostics using the portal</a><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/insights/azure-key-vault#enable-key-vault-diagnostics-using-powershell">Enable AKV diagnostics using PowerShell</a>Use:<a href="https://docs.microsoft.com/en-us/azure/azure-monitor/insights/azure-key-vault#azure-monitor-log-records">Log schema</a><a href="https://github.com/Azure/Azure-Sentinel/tree/master/Detections/AzureDiagnostics">Detection rules</a><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/visibility-of-azure-key-vault-activity-in-sentinel-azure-key/ba-p/2140751">Workbook</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Information Protection (Classic and Unified Labeling)</td><td>Built-in (Direct)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-information-protection">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Kubernetes Service (AKS)</td><td>Direct</td><td>Blog post: ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-azure-kubernetes-service-aks-with-azure-sentinel/ba-p/1583204">Monitoring Azure Kubernetes Service (AKS) with Azure Sentinel</a>Documentation: ;<a href="https://docs.microsoft.com/en-us/azure/azure-monitor/insights/container-insights-onboard">Enable Azure Monitor for containers</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Log Analytics</td><td>Direct</td><td>Collect query auditing and other metrics: ;<a href="https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/query-audit">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Logic Apps</td><td>Direct</td><td><a href="https://www.serverlessnotes.com/docs/azure-logic-apps-insights-using-log-analytics">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Network Security Groups (NSG)</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics" target="_blank" rel="noreferrer noopener">Flow logs</a><a href="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log" target="_blank" rel="noreferrer noopener">Rule activation</a><a href="https://www.youtube.com/watch?v=au_PsT2WUyM">Webinar: Detecting and Responding to Threats using Azure Network Security tools and Azure Sentinel</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure SQL</td><td>Built-in (diagnostics)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-sql-logs">Built-in connector</a><a href="https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing#subheading-2" target="_blank" rel="noreferrer noopener">Diagnostics settings instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure SQL Managed Instance</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/auditing-configure#set-up-auditing-for-your-server-to-event-hubs-or-azure-monitor-logs">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Site Recovery</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/site-recovery/monitor-log-analytics" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Storage</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/storage/common/monitor-storage?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&;tabs=azure-powershell">Instructions</a>Blog: ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/microsoft-ignite-2021-blob-and-file-storage-investigations/ba-p/2175138">Blob and File Storage Investigations</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Storage Content</td><td>Custom (Azure Function)</td><td>Ingest the content of Azure Storage Blobs. See ;<a href="https://github.com/sreedharande/AzureStorageAccountBlobsIngestion">GitHub</a>.</td></tr><tr><td><strong>Microsoft</strong></td><td>Azure Synapse</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/synapse-analytics/monitoring/how-to-monitor-using-azure-monitor">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview">Azure Web Application Firewall</a> ;(WAF)</td><td>Built-in (Diagnostics)</td><td><a href="https://techcommunity.microsoft.com/t5/azure-network-security/integrating-azure-web-application-firewall-with-azure-sentinel/ba-p/1720306">Blog post</a><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-microsoft-waf">Built-in connector</a><a href="https://www.youtube.com/watch?v=au_PsT2WUyM">Webinar: Detecting and Responding to Threats using Azure Network Security tools and Azure Sentinel</a></td></tr><tr><td><strong>Microsoft</strong></td><td>BitLocker / MBAM</td><td>Agent</td><td>Using Windows Event collection. ;<a href="https://secureinfra.blog/2020/07/31/adding-mbam-bitlocker-logs-to-azure-sentinel/amp/">Blog post</a></td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/cloud-app-security/what-is-cloud-app-security">Cloud App Security</a> ;(Alerts, Discovery logs)</td><td>Built-in (Direct)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-cloud-app-security">Instructions</a><a href="https://docs.microsoft.com/en-us/cloud-app-security/monitor-alerts#built-in-alerts">Alerts Information</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Cloud App Security (Activity Log)</td><td>CEF</td><td><a href="https://techcommunity.microsoft.com/t5/Azure-Sentinel/Ingest-Box-com-activity-events-via-Microsoft-Cloud-App-Security/ba-p/1072849">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Defender for Office</td><td>Built-inCustom ; ; ;</td><td>For AIRs alerts: ;<a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365-advanced-threat-protection">instructions</a>For other alerts: ;Use Either a ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-O365Data">Logic App</a> ;or an ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/O365%20Data">Azure function</a> ;custom connector. For the Azure Function connector, ;query for RecordType_d == &#8220;28&#8221;, &#8220;41&#8221; or &#8220;47&#8221; .</td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/azure-advanced-threat-protection/what-is-atp">Defender for Identity</a> ;(Azure ATP) Alerts</td><td>Built-in</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-atp">Instructions</a> ;(Direct)<a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender">Instructions</a> ;(Microsoft 365 Defender) ;<a href="https://docs.microsoft.com/en-us/azure-advanced-threat-protection/suspicious-activity-guide?tabs=external">Alerts overview</a></td></tr><tr><td><strong>Microsoft</strong></td><td><a href="https://docs.microsoft.com/en-us/azure-advanced-threat-protection/what-is-atp">Defender for Identity</a> ;(Azure ATP) Events</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/defender-for-identity/setting-syslog">Instructions</a><a href="https://docs.microsoft.com/en-us/defender-for-identity/cef-format-sa">Log reference</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Desktop Analytics</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/sccm/desktop-analytics/tutorial-windows10#set-up-desktop-analytics">Connect</a></td></tr><tr><td><strong>Microsoft</strong></td><td>DNS</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-dns">Sentinel built-in connector</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Dynamics 365</td><td>Built-in</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-dynamics-365">Sentinel built-in connector</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Dynamics (not 365)</td><td>Agent</td><td><a href="https://cloudblogs.microsoft.com/dynamics365/no-audience/2009/04/08/crm-usage-reporting-unleashed/">Using IIS logs</a><a href="https://support.microsoft.com/en-us/help/907490/how-to-enable-tracing-in-microsoft-dynamics-crm">Using Dynamics Trace Files</a></td></tr><tr><td><strong>Microsoft</strong></td><td>IIS</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-iis-logs">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Intune</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/intune/review-logs-using-azure-monitor" target="_blank" rel="noreferrer noopener">Connect</a><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/secure-working-from-home-deep-insights-at-enrolled-mem-assets/ba-p/1424255">Use cases</a></td></tr><tr><td><strong>Microsoft</strong></td><td>LDAP (Windows Server)</td><td>Agent</td><td>Configure ;<a href="https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/configure-ad-and-lds-event-logging">AD diagnostics logging</a> ;and set &#8220;<strong>16 LDAP Interface Events</strong>&#8221; to 2 or above.</td></tr><tr><td><strong>Microsoft</strong></td><td>Office 365 (Exchange, SharePoint, OneDrive, DLP Alerts)</td><td>Built-in</td><td> ;<a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365">Sentinel built-in connector</a>For details about DLP alerts, read ;<a href="https://techcommunity.microsoft.com/t5/Azure-Sentinel/Ingest-Office-365-DLP-Events-into-Azure-Sentinel/ba-p/1031820">here</a>. ;</td></tr><tr><td><strong>Microsoft ;</strong></td><td>Office 365 (Microsoft Defender for Office; formerly Office ATP, ;PowerBI, Yammer, Sway, Forms, eDiscovery, and others)</td><td>Custom (Azure Function, Logic Apps)</td><td>Use Either a ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-O365Data">Logic App</a> ;or an ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/O365%20Data">Azure function</a> ;custom connector</td></tr><tr><td><strong>Microsoft</strong></td><td>Office 365 e-mail trace logs</td><td>Custom (Logic Apps)</td><td>See ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/office-365-email-activity-and-data-exfiltration-detection/ba-p/1169652">Blog Post</a>.</td></tr><tr><td><strong>Microsoft</strong></td><td>PowerBI Embedded</td><td>Direct (Diagnostics)</td><td><a href="https://docs.microsoft.com/en-us/power-bi/developer/embedded/monitor-power-bi-embedded">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>SMBv1 (Windows Server)</td><td>Agent</td><td>See ;<a href="https://azurecloudai.blog/2018/12/17/step-by-step-safely-disabling-smb-v1-from-your-production-environment/">Enable Auditing on SMB Servers</a>, and the ;<a href="https://docs.microsoft.com/en-us/powershell/module/smbshare/set-smbserverconfiguration?view=win10-ps">CmdLet reference</a> ;</td></tr><tr><td><strong>Microsoft</strong></td><td>Teams (Call Logs)</td><td>Custom</td><td>Using ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/secure-your-calls-monitoring-microsoft-teams-callrecords/ba-p/1574600">Logic Apps</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Teams (Management Activity)</td><td>Built-in</td><td>Use the built-in ;<a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365">Office 365 connector</a>Use the ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/protecting-your-teams-with-azure-sentinel/ba-p/1265761">Hunting use cases</a> ;or ;<a href="https://medium.com/@ko.sharon/graph-visualization-of-external-ms-teams-collaborations-in-azure-sentinel-32c98e5a0a15">Graph Visualization of External MS Teams Collaborations</a>.<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/understanding-microsoft-teams-data-schema-in-azure-sentinel/ba-p/1722876">Understand the Teams event schema</a>Use the custom ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-O365Data">Logic App</a> ;or ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/O365%20Data">Azure function</a> ;connectors for special use cases.<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/expanding-microsoft-teams-log-data-in-azure-sentinel/ba-p/1811827" target="_blank" rel="noreferrer noopener">Expanding Microsoft Teams Log Data in Azure Sentinel</a>:Extracting Teams file-sharing informationMapping Teams logs to Teams call recordsMerging Teams logs with sign-in activity to detect anomalous actions</td></tr><tr><td><strong>Microsoft</strong></td><td>Teams Shifts</td><td>Custom</td><td>Use Either a ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-O365Data">Logic App</a> ;or an ;<a href="https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/O365%20Data">Azure function</a> ;custom connector. For the Azure Function connector, ;query for RecordType_d == &#8220;73&#8221;</td></tr><tr><td><strong>Microsoft</strong></td><td>SCCM</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/platform/collect-sccm">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>SQL Server</td><td>Agent</td><td><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-sql-server-with-azure-sentinel/ba-p/1502960">Instructions, parser, rules, and hunting queries</a>You can also ;<a href="https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-database-engine?view=sql-server-ver15">audit at the engine level</a>.</td></tr><tr><td><strong>Microsoft</strong></td><td>Sysmon</td><td>Agent</td><td>Using Windows Event collection. ;<a href="https://medium.com/%40olafhartong/using-sysmon-in-azure-sentinel-883eb6ffc431">Blog post</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Windows (Security Events)</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-windows-security-events">Sentinel built-in connector</a><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/enriching-windows-security-events-with-parameterized-function/ba-p/1712564">Enriching Windows Security Events with Parameterized Function</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Windows (Other Events, Sysmon)</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-windows-computer#collect-event-and-performance-data">Instructions</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Windows network connections</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview">VM Insights</a><a href="https://docs.microsoft.com/en-us/azure/azure-monitor/insights/wire-data">Wire Data</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Windows Firewall</td><td>Agent</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-windows-firewall">Sentinel built-in connector</a></td></tr><tr><td><strong>Microsoft</strong></td><td>Windows Virtual Desktop</td><td>Direct</td><td><a href="https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics#push-diagnostics-data-to-your-workspace">Connect using the portal</a> ;and ;<a href="https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics#example-queries">samples queries</a><a href="https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics#push-diagnostics-data-to-your-workspace">Connect using PowerShell</a> ;and ;<a href="https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics#example-queries">Sample queries</a>Blog post covering connecting and using: ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-windows-virtual-desktop-environments-fall-2019/ba-p/1356632" target="_blank" rel="noreferrer noopener">Monitoring Windows Virtual Desktop environments</a><a href="https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-role-service#common-error-scenarios">Common error codes</a></td></tr><tr><td><strong>Mimecast</strong></td><td> ;</td><td>Agent</td><td><a href="https://www.mimecast.com/tech-connect/tech-partners/microsoft-azure-sentinel/">Announcement</a>. For technical instructions, contact the vendor.</td></tr><tr><td><strong>Minerva Labs</strong></td><td> ;</td><td>CEF</td><td>Please ask the vendor for instructions.</td></tr><tr><td><strong>MISP</strong></td><td> ;</td><td>TI (Platform)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence#instructions">Sentinel built-in connector</a></td></tr><tr><td><strong>NetApp</strong></td><td>ONTAP</td><td>Syslog</td><td><a href="https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-sag%2FGUID-9F8EB0DF-12F5-4DA9-B14B-34487DE3717D.html">Instructions</a>Note that those are management activity audit logs and not file usage activity logs.</td></tr><tr><td><strong>Netflow</strong></td><td> ;</td><td>Logstash</td><td>Use the ;<a href="https://www.elastic.co/guide/en/logstash/current/plugins-codecs-netflow.html">Netflow codec plug-in</a></td></tr><tr><td><strong>Nexthink</strong></td><td> ;</td><td>CEF</td><td><a href="https://doc.nexthink.com/Documentation/Nexthink/latest/APIAndIntegrations/IntegratingwithHPArcSight">Instructions</a></td></tr><tr><td><strong>Nozomi</strong></td><td>Guardian</td><td>CEF</td><td>Contact vendor for details</td></tr><tr><td><strong>NXlog</strong></td><td> ;</td><td>Direct</td><td><a href="https://nxlog.co/documentation/nxlog-user-guide/sentinel.html">Instructions</a></td></tr><tr><td><strong>Okta</strong></td><td>SSO</td><td>Built-in (Function)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-okta-single-sign-on">Instructions</a></td></tr><tr><td><strong>One Identity</strong></td><td>Safeguard</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-one-identity">Instructions</a></td></tr><tr><td><strong>Oracle</strong></td><td>Cloud (OCI)</td><td>Custom (Azure Function)</td><td>Available ;<a href="https://github.com/BrianJackson/OCI-Sentinel/">Here</a></td></tr><tr><td><strong>Oracle</strong></td><td>DB</td><td>Syslog</td><td><a href="https://docs.oracle.com/cd/B28359_01/network.111/b28531/auditing.htm#DBSEG66112">Instructions</a></td></tr><tr><td><strong>Orca</strong></td><td> ;</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-orca-security-alerts">Instructions</a></td></tr><tr><td><strong>OSSEC</strong></td><td> ;</td><td>CEF</td><td><a href="https://www.ossec.net/docs/docs/manual/output/syslog-output.html">Instructions</a></td></tr><tr><td><strong>Pager Duty</strong></td><td> ;</td><td>Automation (Playbook)</td><td><a href="https://techcommunity.microsoft.com/t5/azure-sentinel/centralize-your-security-response-with-azure-sentinel-amp/ba-p/2110228">Blog post</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>Cloudgenix</td><td>Syslog</td><td><a href="https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cloudgenix/configuration-guides/CloudGenix-Configuring-Syslog-Server-Support.pdf">Instructions</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>Minemeld</td><td>TI (Platform)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence#instructions">Sentinel built-in connector</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>PanOS</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-paloalto">Sentinel built-in connector</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>Panorama</td><td>CEF</td><td><a href="https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-log-collection/configure-log-forwarding-from-panorama-to-external-destinations.html">Instructions</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>Prisma</td><td>SyslogCustom</td><td><a href="https://docs.paloaltonetworks.com/prisma/prisma-saas/prisma-saas-admin/prisma-saas-syslog-and-api-integration/prisma-saas-syslog-integration/configure-prisma-saas-syslog-monitoring.html">Instructions</a>, ;<a href="https://docs.paloaltonetworks.com/prisma/prisma-saas/prisma-saas-admin/prisma-saas-syslog-and-api-integration/prisma-saas-syslog-integration/syslog-field-descriptions.html">Fields</a><a href="https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Ingest-Prisma">Logic Apps</a> ;using a Webhook and ;<a href="https://techcommunity.microsoft.com/t5/azure-sentinel/connecting-prisma-to-sentinel/m-p/1408693">clarification</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>Traps through Cortex</td><td>Syslog</td><td><a href="https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/view-and-manage-logs/forward-traps-logs-to-a-syslog-server">Instructions</a>Notes:- Require rsyslog configuration to support RFC5424- TLS only (requires ;<a href="https://www.rsyslog.com/doc/v8-stable/tutorials/tls_cert_summary.html" target="_blank" rel="noreferrer noopener">rsyslog TLS configuration</a>)- The certificate has to be signed by a public CA</td></tr><tr><td><strong>Palo Alto</strong></td><td>XDR</td><td>CEF</td><td><a href="https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/logs/log-forwarding-data-types.html#log-forwarding-data-types">Instructions</a></td></tr><tr><td><strong>Palo Alto</strong></td><td>XSOAR</td><td>Integration</td><td><a href="https://xsoar.pan.dev/docs/reference/integrations/azure-sentinel">Forward Azure Sentinel incidents to Palo Alto XSOAR ;</a></td></tr><tr><td><strong>Perimeter 81</strong></td><td> ;</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-perimeter-81-logs">Instructions</a></td></tr><tr><td><strong>Ping Identity</strong></td><td>Federate</td><td>CEF</td><td><a href="https://docs.pingidentity.com/bundle/pingfederate-102/page/gsn1564002980953.html">Instructions</a></td></tr><tr><td><strong>Ping Identity</strong></td><td>Provisioner</td><td>CEF</td><td><a href="https://docs.pingidentity.com/bundle/pingfederate-102/page/ftm1564002981012.html">Instructions</a></td></tr><tr><td><strong>Postgress</strong></td><td>DB</td><td>Syslog, Windows Event log</td><td><a href="https://www.postgresql.org/docs/9.1/runtime-config-logging.html">Instructions</a></td></tr><tr><td><strong>Proofpoint</strong></td><td>On Demand</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-proofpoint-pod">Instructions</a></td></tr><tr><td><strong>Proofpoint</strong></td><td>TAP</td><td>Built-in (Function)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-proofpoint-tap">Instructions</a></td></tr><tr><td><strong>Pulse</strong></td><td>Connect</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-pulse-connect-secure">Instructions</a></td></tr><tr><td><strong>Qualys</strong></td><td>VM</td><td>Built-in (Function)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-qualys-vm">Instructions</a></td></tr><tr><td><strong>Radware</strong></td><td>Cloud WAF</td><td>Logstash</td><td><a href="https://support.radware.com/ci/okcsFattach/get/1025459_3">Instructions</a></td></tr><tr><td><strong>RedHat</strong></td><td>OpenShift</td><td>Syslog<br>API</td><td><a href="https://docs.openshift.com/container-platform/4.4/logging/config/cluster-logging-external.html">Instructions</a> ;for Syslog<br><a href="https://github.com/yokawasa/fluent-plugin-azure-loganalytics" target="_blank" rel="noreferrer noopener">Fluentd Log Analytics plugin</a> ;for API</td></tr><tr><td><strong>RedHat</strong></td><td>Azure OpenShift</td><td>Syslog<br>Custom</td><td><a href="https://docs.openshift.com/aro/4/logging/config/cluster-logging-external.html">Instructions</a> ;for Syslog<br><a href="https://github.com/yokawasa/fluent-plugin-azure-loganalytics" target="_blank" rel="noreferrer noopener">Fluentd Log Analytics plugin</a> ;for API</td></tr><tr><td><strong>RiskIQ</strong></td><td> ;</td><td>Action (Logic Apps)</td><td><a href="https://docs.microsoft.com/en-us/Connectors/riskiqintelligence/">Azure Logic-Apps built-in connector</a></td></tr><tr><td><strong>Salesforce</strong></td><td>Service Cloud</td><td>Built-in (Function)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-salesforce-service-cloud">Instructions</a></td></tr><tr><td><strong>SAP</strong></td><td>Hana</td><td>Syslog</td><td><a href="https://apps.support.sap.com/sap/support/knowledge/preview/en/2624117">Instructions</a> ;(requires an SAP account)</td></tr><tr><td><strong>SentinelOne</strong></td><td> ;</td><td>CEF</td><td>Please consult the vendor for instructions</td></tr><tr><td><strong>SNMP</strong></td><td> ;</td><td>Syslog</td><td><a href="https://docs.microsoft.com/en-gb/archive/blogs/msoms/collecting-snmp-data-with-operations-management-suite">Instructions</a></td></tr><tr><td><strong>Snort</strong></td><td> ;</td><td>Agent</td><td><a href="http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node21.html#SECTION00361000000000000000">Instructions</a></td></tr><tr><td><strong>SonicWall</strong></td><td> ;</td><td>CEF</td><td><a href="http://help.sonicwall.com/help/sw/eng/7020/26/2/3/content/Log_Syslog.120.2.htm" target="_blank" rel="noreferrer noopener">Instructions</a>Make sure you:<br>&#8211; Select local use 4 as the facility.- Select ArcSight as the Syslog format.</td></tr><tr><td><strong>Sophos</strong></td><td>Central</td><td>CEF</td><td><a href="https://community.sophos.com/kb/en-us/125169">Instructions</a>. Note that the script provided by Sophos has to be scheduled using a cron job, which is not documented on the reference page.</td></tr><tr><td><strong>Sophos</strong></td><td>XF Firewall</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-sophos-xg-firewall">Instructions</a></td></tr><tr><td><strong>Squadra</strong></td><td> ;secRMM</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-squadra-secrmm">Instructions</a></td></tr><tr><td><strong>Squid Proxy</strong></td><td> ;</td><td>Built-in (Agent)Syslog</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-squid-proxy">Instructions</a> ;Configure ;<a href="http://www.squid-cache.org/Doc/config/access_log/" target="_blank" rel="noreferrer noopener">access logs</a> ;with either the ;<a href="https://wiki.squid-cache.org/Features/LogModules" target="_blank" rel="noreferrer noopener">TCP or UDP modules</a>. Sentinel&#8217;s built-in queries use the default log format.</td></tr><tr><td><strong>Symantec</strong></td><td>DLP</td><td>SyslogCEF</td><td><a href="https://knowledge.broadcom.com/external/article?legacyId=tech218905">Instructions.</a> ;Note that only UDP is supported<a href="https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6af3be40-bbb9-4bb3-841c-cd41282a4b65&;CommunityKey=65cf8c43-bb97-4e96-ae0b-0db8ba1b4d07&;tab=digestviewer#bm6af3be40-bbb9-4bb3-841c-cd41282a4b65">Instructions</a>. Uses response automation.</td></tr><tr><td><strong>Symantec</strong></td><td>ICDX</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-symantec">Instructions</a></td></tr><tr><td><strong>Symantec</strong></td><td>Proxy SG (Bluecoat)</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-symantec-proxy-sg">Instructions</a></td></tr><tr><td><strong>Symantec ;</strong> ;</td><td>Endpoint Protection Manager</td><td>Syslog</td><td><a href="https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=b45aafed-07d6-4460-b163-2aa37c52be6e&;CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&;tab=digestviewer#bmb45aafed-07d6-4460-b163-2aa37c52be6e" target="_blank" rel="noreferrer noopener">Instructions</a> ; ;</td></tr><tr><td><strong>Symantec</strong></td><td>Cloud Workload Protection</td><td>API</td><td><a href="https://help.symantec.com/cs/SCWP/SCWP/v132583719_v111037498/Integrieren-in-Azure-Log-Analytics?locale=EN_US" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>Symantec</strong></td><td>VIP</td><td>Built-in (Syslog)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-symantec-vip">Instructions</a></td></tr><tr><td><strong>TheHive</strong></td><td> ;</td><td>Integration</td><td><a href="https://github.com/chihebchebbi/Azure-Sentinel-Hive-Playbook">Send new incidents to TheHive</a></td></tr><tr><td><strong>Thinkst</strong></td><td>Canary</td><td>Syslog</td><td><a href="https://help.canary.tools/hc/en-gb/articles/360002432118-How-can-I-get-alerts-via-Syslog-">Instructions</a></td></tr><tr><td><strong>ThreatConnect</strong></td><td> ;</td><td>TI (Platform)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence#instructions">Sentinel built-in connector</a></td></tr><tr><td><strong>ThreatQuotient</strong></td><td> ;</td><td>TI (Platform)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence#instructions">Sentinel built-in connector</a></td></tr><tr><td><strong>Thycotic</strong></td><td>Secret Server</td><td>CEF</td><td><a href="https://docs.thycotic.com/ss/10.8.0/events-and-alerts/secure-syslog-cef/index.md">Instructions</a></td></tr><tr><td><strong>TitanHQ</strong></td><td>WebTitan Cloud</td><td>Syslog</td><td><a href="https://docs.titanhq.com/en/5955-configuring-remote-hosts-for-syslog-messages.html">Instructions</a></td></tr><tr><td><strong>Trend Micro</strong></td><td> ;</td><td>CEF</td><td><a href="https://esupport.trendmicro.com/media/13970354/TMCM_SIEM_Integration.pdf" target="_blank" rel="noreferrer noopener">Using Control Manager</a><a href="http://docs.trendmicro.com/en-us/enterprise/control-manager-70/tools-and-additional/using-logforwarder/configuring-logforwa.aspx" target="_blank" rel="noreferrer noopener">Using LogForwarder</a></td></tr><tr><td><strong>Trend Micro</strong></td><td>Apax Central (Cloud and On-prem)</td><td>CEF</td><td><a href="https://success.trendmicro.com/solution/000152501-SIEM-solutions-integration-with-Apex-Central">Instructions</a></td></tr><tr><td><strong>Trend Micro</strong></td><td>Deep Security</td><td>CEF</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-trend-micro">Sentinel built-in connector</a></td></tr><tr><td><strong>Tufin</strong></td><td>SecureTrack</td><td>Syslog</td><td><a href="https://forum.tufin.com/support/kc/latest/Content/Suite/4827.htm">Instructions</a></td></tr><tr><td><strong>Varonis</strong></td><td>DatAlert</td><td>CEF</td><td><a href="https://info.varonis.com/hubfs/docs/splunk-app/Varonis-App-for-Splunk-User-Guide.pdf" target="_blank" rel="noreferrer noopener">Instructions</a></td></tr><tr><td><strong>WatchGuard</strong></td><td> ;</td><td>CEF</td><td><a href="https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Wi-Fi-Cloud/manage_wirelessmanager/configuration/system/arcsight_integration.html">Instructions</a></td></tr><tr><td><strong>Zimperium</strong> ; ;<strong></strong></td><td>Mobile Threat Defense</td><td>Built-in (API)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-zimperium-mtd">Instructions</a> ;</td></tr><tr><td><strong>zScaler</strong></td><td>Internet Access (ZIA)</td><td>Built-in (CEF)</td><td><a href="https://docs.microsoft.com/en-us/azure/sentinel/connect-zscaler">Instructions</a></td></tr><tr><td><strong>zScaler</strong></td><td>Private Access (ZPA)</td><td>Logstash</td><td>Use ;<a href="https://help.zscaler.com/zpa/about-log-streaming-service">LSS.</a> ;Since LSS sends raw TCP but not Syslog, you will have to use Logstash and not Azure Sentinel&#8217;s native connector. ;</td></tr><tr><td><strong>Zoom</strong></td><td> ;</td><td>Custom</td><td>Using Azure Function.</td></tr></tbody></table></figure>

The Cyber Security, Compliance & Cloud
Cyber Security | Digital Transformation | Cloud Computing
