We are delighted to share our new EIC Delivery Methodology for efficiently managing Saviynt Implementations and delivering quick time to value. CLICK HERE.

Saviynt SEIM Integration - Azure Sentinel - Datacollection API Deprecation

ssudhakar
New Contributor III
New Contributor III

HI All,

As per Saviynt documentation on Azure Sentinel integration it was mentioned that datacollectionAPI will be used for getting the logs from any client via REST API

https://docs-be.saviyntcloud.com/bundle/EIC-Connectors/page/Content/Resources/Attachments/SentinelIn...

ssudhakar_0-1704704981607.png

datacollectionAPI is deprecated by microsoft and they are recommending to use logs ingestion api

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api?tabs=powershell

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview

ssudhakar_1-1704705169978.png

So our question is, do we need to make any changes in the Azure Sentinel-Saviynt Integration configurations (like python script changes, additional settings enablement or disablement) considering the api deprecation at microsoft side and if SIEM team needs to proceed with logs ingestion api instead datacollectionapi?

Can anyone please help us with the details ?

Thanks and Regards,
Sudhin Sudhakar

 

 

 

 

 

 

2 REPLIES 2

DixshantValecha
Saviynt Employee
Saviynt Employee

Hi @ssudhakar,

We are checking on your request and we will keep you posted.

DixshantValecha
Saviynt Employee
Saviynt Employee

Hi @ssudhakar,

I would like to inform you that the Saviynt SEIM Integration for Azure Sentinel, a community-developed solution. As part of our commitment to fostering collaboration and continuous improvement, the source code for this integration is made available to the community.

We encourage you to explore the possibilities of enhancing and improving the integration by adapting the sample script to utilize the latest APIs. The source code, along with detailed documentation, can be accessed through the following link: [Saviynt SEIM Integration Guide](https://docs-be.saviyntcloud.com/bundle/EIC-Connectors/page/Content/Resources/Attachments/SentinelIn...).

Your contributions and insights are valuable in advancing the functionality and robustness of this integration. Once you have validated any enhancements or improvements, we kindly request that you share your solutions with the forum community. This collaborative effort will not only benefit individual users but will also contribute to the overall success of the integration.

Thank you for your ongoing support and dedication to the Saviynt community.