NETIQ Identity Manager logs to Microsoft Sentinel

Kate Robson 3 months ago

Hi,

Has anyone ever sent NETIQ identity manager logs to Microsoft Sentinel, is it via syslog? Is there any documentation available on how to achieve this?

Tags:

Microsoft Sentinel

siem

Suggested Answer

0 Norbert Klasen 3 months ago

IDM uses CEF over Syslog as its audit protocols. See https://www.netiq.com/documentation/identity-manager-49/configure_auditing/data/identity-manager-set-up-cef-configuration.html on how to configure the components to send events to a syslog receiver.

Documentation on how to setup a syslog receiver for Microsoft Sentinel can be found here: https://learn.microsoft.com/en-us/azure/sentinel/cef-syslog-ama-overview?tabs=single
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Kate Robson 2 months ago in reply to Norbert Klasen

Thanks, this is really helpful.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

Identity Manager User Discussions

NETIQ Identity Manager logs to Microsoft Sentinel

Tags:

Suggested Answer

Resources