Cohesity (using Azure Functions) connector for Microsoft Sentinel
The Cohesity function apps provide the ability to ingest Cohesity Datahawk ransomware alerts into Microsoft Sentinel.
This is autogenerated content. For changes, contact the solution provider.
Connector attributes
| Connector attribute | Description |
|---|---|
| Log Analytics table(s) | Cohesity_CL |
| Data collection rules support | Not currently supported |
| Supported by | Cohesity |
Query samples
All Cohesity logs
Cohesity_CL
| sort by TimeGenerated desc
Prerequisites
To integrate with Cohesity (using Azure Functions) make sure you have:
- Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. See the documentation to learn more about Azure Functions.
- Azure Blob Storage connection string and container name: Azure Blob Storage connection string and container name
Vendor installation instructions
Note
This connector uses Azure Functions that connect to the Azure Blob Storage and KeyVault. This might result in additional costs. Check the Azure Functions pricing page, Azure Blob Storage pricing page and Azure KeyVault pricing page for details.
(Optional Step) Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. Follow these instructions to use Azure Key Vault with an Azure Functions App.
STEP 1 - Get a Cohesity DataHawk API key (see troubleshooting instruction 1)
STEP 2 - Register Azure app (link) and save Application (client) ID, Directory (tenant) ID, and Secret Value. Grant it Azure Storage (user_impersonation) permission. Also, assign the 'Microsoft Sentinel Contributor' role to the application in the appropriate subscription.
STEP 3 - Deploy the connector and the associated Azure Functions.
Azure Resource Manager (ARM) Template
Use this method for automated deployment of the Cohesity data connector using an ARM Template.
Click the Deploy to Azure button below.
Select the preferred Subscription, Resource Group and Location.
Enter the parameters that you created at the previous steps
Mark the checkbox labeled I agree to the terms and conditions stated above.
Click Purchase to deploy.