Cayosoft Guardian Threat Alerts

1. Prerequisites and Infrastructure Setup

Before configuring the integration, make sure the following requirements are met: - You have a Microsoft Sentinel workspace. - The Windows Server that hosts Cayosoft Guardian is connected to Azure Arc or runs as an Azure virtual machine. - The Azure Monitor Agent (AMA) is installed on the Cayosoft Guardian server.

2. Deploy the Data Collection Rule (DCR)

Cayosoft Guardian streams threat alerts via the Azure Monitor Agent, which requires a Data Collection Rule (DCR) linked to your Arc-enabled server or Azure VM. This is a one-time deployment, separate from the solution install. 1. Click the button below. [](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCayosoft%2520Guardian%2FData%2520Connectors%2FCayosoftGuardian_DCRTemplate.json) 2. Select your **Subscription**, **Resource Group**, and **Region**. 3. Enter your **Workspace Name** (the Microsoft Sentinel-enabled Log Analytics workspace) and **Arc Machine Name** (the exact name of the Arc-enabled server or Azure VM running Cayosoft Guardian). 4. Click **Review + Create**, then **Create**.

3. Configure Cayosoft Guardian Logging

Enable the event log generation within the product: 1. Open Cayosoft Guardian. 2. Navigate to **Settings** > **Service Settings** > **Windows Event Log Settings**. 3. Verify that **Windows Event Log for Alerts** is enabled. Cayosoft Guardian writes threat alerts to the Windows Event Log > Applications and Services Logs > Cayosoft Guardian Alerts

4. Install the Workbook

The Cayosoft Guardian solution includes a prebuilt workbook that visualizes threat alerts and incidents, including severity distribution, alerts by system type, alert trends over time, and recent incidents and alerts. 1. In Microsoft Sentinel, go to **Content hub**. 2. Search for **Cayosoft Guardian** and verify that the solution is installed. If it is not installed, install it. 3. Go to **Workbooks** and select the **Templates** tab. 4. Select **Cayosoft Guardian - Incidents Dashboard**, click **Save**, choose the Azure region where you want to save the workbook, and then click **View saved workbook**. 5. The workbook is available under **My workbooks**. Optionally, pin it to an Azure dashboard for quick access.

5. Enable the Analytics Rules

The Cayosoft Guardian solution also includes scheduled analytics rule templates that convert Cayosoft Guardian threat alerts into Microsoft Sentinel incidents. 1. In Microsoft Sentinel, go to **Analytics**. 2. Select the **Rule templates** tab. 3. Locate the Cayosoft Guardian analytics rule templates, for example: - **Cayosoft Guardian - Cloud Application Security Threats** - **Cayosoft Guardian - Core Identity and Infrastructure Threats** 4. Click **Create rule**, review the schedule, entity mapping, and incident settings, and then click **Review + Create**. 5. Verify that the rule appears as **Enabled** on the **Active rules** tab. The analytics rules generate the `SecurityIncident` records used by the workbook's **Incidents & recent alerts** table.

6. Verify the Integration

After configuring the connector, verify that Microsoft Sentinel is receiving Cayosoft Guardian threat alert data: 1. In Microsoft Sentinel, open the Log Analytics workspace connected to your Microsoft Sentinel instance. 2. Open **Logs**. 3. Run the following query:```CayosoftThreatAlerts_CL | sort by TimeGenerated desc | take 50 ``` 4. Confirm that new rows are available in the table. For detailed information, step-by-step guides, and known issues, please refer to the <a href='https://support.cayosoft.com/hc/en-us/articles/46659066589325-Threat-Alerts-Directory' target='_blank'>official documentation</a>.