Edit

Cohesity (using Azure Functions) connector for Microsoft Sentinel

  • Article

The Cohesity function apps provide the ability to ingest Cohesity Datahawk ransomware alerts into Microsoft Sentinel.

Connector attributes

Connector attribute Description
Log Analytics table(s) Cohesity_CL
Data collection rules support Not currently supported
Supported by Cohesity

Query samples

All Cohesity logs

Cohesity_CL

| sort by TimeGenerated desc

Prerequisites

To integrate with Cohesity (using Azure Functions) make sure you have:

  • Microsoft.Web/sites permissions: Read and write permissions to Azure Functions to create a Function App is required. See the documentation to learn more about Azure Functions.
  • Azure Blob Storage connection string and container name: Azure Blob Storage connection string and container name

Vendor installation instructions

Note

This connector uses Azure Functions that connect to the Azure Blob Storage and KeyVault. This might result in additional costs. Check the Azure Functions pricing page, Azure Blob Storage pricing page and Azure KeyVault pricing page for details.

(Optional Step) Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. Follow these instructions to use Azure Key Vault with an Azure Functions App.

STEP 1 - Get a Cohesity DataHawk API key (see troubleshooting instruction 1)

STEP 2 - Register Azure app (link) and save Application (client) ID, Directory (tenant) ID, and Secret Value (instructions). Grant it Azure Storage (user_impersonation) permission. Also, assign the 'Microsoft Sentinel Contributor' role to the application in the appropriate subscription.

STEP 3 - Deploy the connector and the associated Azure Functions.

Azure Resource Manager (ARM) Template

Use this method for automated deployment of the Cohesity data connector using an ARM Template.

  1. Click the Deploy to Azure button below.

    Deploy To Azure

  2. Select the preferred Subscription, Resource Group and Location.

  3. Enter the parameters that you created at the previous steps

  4. Mark the checkbox labeled I agree to the terms and conditions stated above.

  5. Click Purchase to deploy.

Next steps

For more information, go to the related solution in the Azure Marketplace.