[Deprecated] Forcepoint CSG via Legacy Agent connector for Microsoft Sentinel
Important
Log collection from many appliances and devices is now supported by the Common Event Format (CEF) via AMA, Syslog via AMA, or Custom Logs via AMA data connector in Microsoft Sentinel. For more information, see Find your Microsoft Sentinel data connector.
Forcepoint Cloud Security Gateway is a converged cloud security service that provides visibility, control, and threat protection for users and data, wherever they are. For more information visit: https://www.forcepoint.com/product/cloud-security-gateway
Connector attributes
| Connector attribute | Description |
|---|---|
| Log Analytics table(s) | CommonSecurityLog (Forcepoint CSG) CommonSecurityLog (Forcepoint CSG) |
| Data collection rules support | Workspace transform DCR |
| Supported by | Community |
Query samples
Top 5 Web requested Domains with log severity equal to 6 (Medium)
CommonSecurityLog
| where TimeGenerated <= ago(0m)
| where DeviceVendor == "Forcepoint CSG"
| where DeviceProduct == "Web"
| where LogSeverity == 6
| where DeviceCustomString2 != ""
| summarize Count=count() by DeviceCustomString2
| top 5 by Count
| render piechart
Top 5 Web Users with 'Action' equal to 'Blocked'
CommonSecurityLog
| where TimeGenerated <= ago(0m)
| where DeviceVendor == "Forcepoint CSG"
| where DeviceProduct == "Web"
| where Activity == "Blocked"
| where SourceUserID != "Not available"
| summarize Count=count() by SourceUserID
| top 5 by Count
| render piechart
Top 5 Sender Email Addresses Where Spam Score Greater Than 10.0
CommonSecurityLog
| where TimeGenerated <= ago(0m)
| where DeviceVendor == "Forcepoint CSG"
| where DeviceProduct == "Email"
| where DeviceCustomFloatingPoint1 > 10.0
| summarize Count=count() by SourceUserName
| top 5 by Count
| render barchart
Vendor installation instructions
- Linux Syslog agent configuration
This integration requires the Linux Syslog agent to collect your Forcepoint Cloud Security Gateway Web/Email logs on port 514 TCP as Common Event Format (CEF) and forward them to Microsoft Sentinel.
Your Data Connector Syslog Agent Installation Command is:
sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}
- Implementation options
The integration is made available with two implementations options.
2.1 Docker Implementation
Leverages docker images where the integration component is already installed with all necessary dependencies.
Follow the instructions provided in the Integration Guide linked below.
2.2 Traditional Implementation
Requires the manual deployment of the integration component inside a clean Linux machine.
Follow the instructions provided in the Integration Guide linked below.
- Validate connection
Follow the instructions to validate your connectivity:
Open Log Analytics to check if the logs are received using the CommonSecurityLog schema.
It may take about 20 minutes until the connection streams data to your workspace.
If the logs are not received, run the following connectivity validation script:
- Make sure that you have Python on your machine using the following command: python -version
- You must have elevated permissions (sudo) on your machine
Run the following command to validate your connectivity:
sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}
- Secure your machine
Make sure to configure the machine's security according to your organization's security policy
Next steps
For more information, go to the related solution in the Azure Marketplace.