Edit

RIDGEBOT - data connector for Microsoft Sentinel

  • Article

The RidgeBot connector lets users connect RidgeBot with Microsoft Sentinel, allowing creation of Dashboards, Workbooks, Notebooks and Alerts.

This is autogenerated content. For changes, contact the solution provider.

Connector attributes

Connector attribute Description
Log Analytics table(s) CommonSecurityLog
Data collection rules support Workspace transform DCR
Supported by RidgeSecurity

Query samples

Lasted 10 Exploited Risks

CommonSecurityLog

| where DeviceVendor == "RidgeSecurity"

| where DeviceEventClassID == "4001"

| order by TimeGenerated desc 

| limit 10

Prerequisites

To integrate with RIDGEBOT - data connector for Microsoft Sentinel make sure you have:

  • ****: To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. Learn more
  • ****: Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed Learn more

Vendor installation instructions

Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.

Notice that the data from all regions will be stored in the selected workspace

  1. Secure your machine

Make sure to configure the machine's security according to your organization's security policy

Learn more >

Next steps

For more information, go to the related solution in the Azure Marketplace.