You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
I have a current situation with a client that is needing to integrate a sister company into the group's main workspace/Sentinel. However, if I connect the second company's logs to the data connector, they will all go to the same destination table. There is no option to set a custom table or a second destination table for the second company's logs.
Describe the solution you'd like
I'd like to know if there is any native way to do this and solve this issue of which I wasn't able to discover as I'm relatively new to Sentinel. If it's not natively possible, I'd like suggestions on how I can resolve this problem. Cost isn't an issue, but I need to separate the tables because the client needs to separate the logs of the two companies. This is required as there will not be a second Sentinel installed as they want to concentrate all the logs and automations into one Sentinel instance. We need to discover a way to create custom or alternative/auxiliary tables that replicate the schema of the AWS and GCP data connectors, so each client receives the logs into their own table for each technology that will be integrated to the mother company's sentinel.
Describe alternatives you've considered
I've thought that perhaps an alternative data connector can be installed or an Azure Function for these technologies. We've thought about creating DCR rules, but we aren't sure that it will be able to solve the problem as they have never used this feature.
Greatly appreciated folks!
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
I have a current situation with a client that is needing to integrate a sister company into the group's main workspace/Sentinel. However, if I connect the second company's logs to the data connector, they will all go to the same destination table. There is no option to set a custom table or a second destination table for the second company's logs.
Describe the solution you'd like
I'd like to know if there is any native way to do this and solve this issue of which I wasn't able to discover as I'm relatively new to Sentinel. If it's not natively possible, I'd like suggestions on how I can resolve this problem. Cost isn't an issue, but I need to separate the tables because the client needs to separate the logs of the two companies. This is required as there will not be a second Sentinel installed as they want to concentrate all the logs and automations into one Sentinel instance. We need to discover a way to create custom or alternative/auxiliary tables that replicate the schema of the AWS and GCP data connectors, so each client receives the logs into their own table for each technology that will be integrated to the mother company's sentinel.
Describe alternatives you've considered
I've thought that perhaps an alternative data connector can be installed or an Azure Function for these technologies. We've thought about creating DCR rules, but we aren't sure that it will be able to solve the problem as they have never used this feature.
Greatly appreciated folks!
The text was updated successfully, but these errors were encountered: