↳ Source GitHubConnecteur
Cybereinforce Threat Enforcement (CTE)
Description
The [Cybereinforce Threat Enforcement](https://cybereinforce.com) data connector ingests browser-level URL blocking, threat-intelligence match, and audit/administration events into Microsoft Sentinel using a scheduled Logic App and the Azure Monitor Logs Ingestion API. Cybereinforce enforces Microsoft Defender threat intelligence directly at the browser (Chrome, Firefox, Safari) on enrolled endpoints, and this connector surfaces that enforcement activity for SOC investigation, hunting, and alerting.
- Statut déclaré
- 1
- Auteur / éditeur déclaré
- Cybeurope
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Types de données
Permissions déclarées
read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Azure Subscription
Contributor or Owner permissions on the resource group are required to deploy the data ingestion infrastructure (Data Collection Endpoint, Data Collection Rule, custom table, and Logic App).
Cybereinforce Account
An active Cybereinforce Threat Enforcement tenant with admin access to generate a MicrosoftToken from the Cybereinforce Admin portal.
Instructions du connecteur
Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.
Step 1 - Generate a Cybereinforce MicrosoftToken
1. Sign in to the [Cybereinforce Admin portal](https://cybereinforce.com/admin/).
2. Under **Integrations**, find the **MicrosoftToken** section.
3. Click **Generate MicrosoftToken (/api/microsoftToken)**.
4. Copy the generated token and your Cybereinforce **Tenant ID** - both are required for the deployment in Step 2.
Step 2 - Deploy the data ingestion infrastructure
This step deploys the required Azure resources: a custom Log Analytics table (`CybereinforceCTE_CL`), a Data Collection Endpoint, a Data Collection Rule, a user-assigned managed identity, and a Logic App that polls Cybereinforce on a schedule and forwards new events into the table.
1. Click the **Deploy to Azure** button below.
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCybereinforce%2FData%20Connectors%2Fdeployment%2Fazuredeploy_cybereinforce.json)
2. Select the **Subscription**, **Resource Group**, and **Location** where your Microsoft Sentinel workspace resides.
3. Enter the **Log Analytics Workspace Resource ID**, the **Cybereinforce Tenant ID**, and the **MicrosoftToken** copied in Step 1.
4. Click **Review + create** and then **Create**.
Step 3 - Confirm ingestion
After a few polling cycles (default every 15 minutes), new events should appear in the `CybereinforceCTE_CL` table. Run one of the sample queries above in Log Analytics to confirm data is flowing.
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
9800e51↗- Identifiant source
cybereinforce_cte
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC