Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Send the logs within GCP and AWS Data Connectors to custom tables inside the same workspace #11780

Open
fa-clavis opened this issue Feb 7, 2025 · 0 comments

Comments

@fa-clavis
Copy link

Is your feature request related to a problem? Please describe.
I have a current situation with a client that is needing to integrate a sister company into the group's main workspace/Sentinel. However, if I connect the second company's logs to the data connector, they will all go to the same destination table. There is no option to set a custom table or a second destination table for the second company's logs.

Describe the solution you'd like
I'd like to know if there is any native way to do this and solve this issue of which I wasn't able to discover as I'm relatively new to Sentinel. If it's not natively possible, I'd like suggestions on how I can resolve this problem. Cost isn't an issue, but I need to separate the tables because the client needs to separate the logs of the two companies. This is required as there will not be a second Sentinel installed as they want to concentrate all the logs and automations into one Sentinel instance. We need to discover a way to create custom or alternative/auxiliary tables that replicate the schema of the AWS and GCP data connectors, so each client receives the logs into their own table for each technology that will be integrated to the mother company's sentinel.

Describe alternatives you've considered
I've thought that perhaps an alternative data connector can be installed or an Azure Function for these technologies. We've thought about creating DCR rules, but we aren't sure that it will be able to solve the problem as they have never used this feature.

Greatly appreciated folks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant