Raibal Holding Pre-requisites
Pre-requisites
Start date: 26/10/2022
Customer's MS Sentinel
Subscription Name: Azure subscription 1
Subscription ID: f4461d64-c4e8-4f5c-a081-bf3572fd7168
Resource Group: rbl-rg1
FOR EVENTS - Workspace Name: RaibalSentinelWorkspace
FOR EVENTS - Workspace Id: 45d419b6-2093-4a61-a581-27b9567cf426
Softline's MS Sentinel
Subscription Name: IsocIndia
Subscription ID: 9ee3095b-24b4-4bf4-8c3d-7484ff131b52
Resource Group:
FOR ALERTS - Workspace Name:
FOR ALERTS - Workspace Id:
Event source
ID
Type
System
Count
Responsible
Connector and Limitations
Status
SRC-1
Windows Servers (Azure Cloud based)
Windows Server 2016, 2019
1
Guru S T
Collection of logs using AMA agent.
Done
SRC-2
Windows Servers (on-premises) and Windows Endpoint Device
Windows Server 2016, 2019
1
Guru S T
Collection of logs using AMA agent.
Done
SRC-3
ESXi host (on-premises)
VMware EXSI 6.7
1
Venkata
Collection of events(syslog)
Done
SRC-4
NGFW (on-premises)
FortiGate
1
Venkata
Collection of events (CEF)local7
Done
SRC-5
Email Security Systems (Azure Cloud based)
Mimecast
1
Divakar
Collection of events
Out of Scope (No OOTB connector)
SRC-6
Azure services
AAD & O365
2
Guru S T
Azure
Done
Contact details of the Customer for Incident Verification
Contact Details
Email
Phone
Fayez Eltaha
fayez@raibal.ae
+971 56 644 5022
Anshad K
anshad@raibal.ae
+971 58 990 2374
Collectors
No.
Server
Computer Name
IP
Username
Connection Method
1.
Linux Collector (Ubuntu 20)
RBL-CENT01
192.168.30.40
Configuration documents and links
https://vmvirtual.blog/2021/04/18/ingest-your-vmware-esxi-logs-into-azure-sentinel/
https://help.fortinet.com/fadc/4-5-1/olh/Content/FortiADC/handbook/log_remote.htm
https://community.fortinet.com/t5/FortiGate/Technical-Note-FortiGate-Logs-can-be-sent-to-syslog-servers-in/ta-p/190617?externalId=FD43712
FortiGate-Configuration English.docx
VMware ESXI Configuration - English.docx