SIEM integrations: Sentinel, Splunk and Datadog (quick overview)

[JuergenKlaassen]

Hi

Just to share my recent discoveries for Sentinel and Splunk as well as mentioning Datadog - as I find it noticeable in terms of integrations efforts and pricing.

Azure Sentinel

A publicly available Data Connector can be found on GitHub here. It's just updated to support Azure Functions v4 (as v3 gets deprecated tomorrow).
It's fairly easy to integrate. An important note here: get your Sentinel configured first and find your <Workspace ID> and the <Workspace Key> under Workspace Settings (you don't need to install any agents).

Post deployment you have all your required resources together.

Post integration the Directory Insights logs will be stored in a dedicated table named 'JumpCloud_CL' and the data can be used in Hunting, Workbooks, Incidents etc.

Splunk

I haven' tried it out, but since 4th October there is a "JumpCloud Directory Insights' add-on available published by Maciej Duda.

Datadog
This integration exists since a couple of months and was announced here.

[jreece22]

I created the Sentinel integration and then deleted it.  I later created the Sentinel integration again, but now the Table will not get created.  Any idea why the table doesn't get created now?  Or how I can create the table?

[urvashi]

Hi @jreece22 was there a significant time gap between creating/deleting and then creating it again? Trying to figure out if there might have been any product updates on Sentinel or in JumpCloud in that time.