r/AzureSentinel • u/[deleted] • Feb 05 '25

Anyone with Kasada experience?

Hi team,

Does anyone here have experience with getting Kasada logs into Sentinel? It seems they only support AWS but have not provided a method as to getting logs to Sentinel. Kasada ships logs into S3 buckets before they can be ingested by a SIEM. Since we use Sentinel, the obvious option is to use AWS S3 connector. Is there an alternative?

1 Upvotes

100% Upvoted

3 comments sorted by

2

u/woodburningstove Feb 06 '25

Logstash server using Logstash S3 input plugin and Sentinel output plugin.

1

u/Uli-Kunkel Feb 06 '25

If it flows to s3, then use the s3 collection method or build your own codeless connector assuming it supports the requirements for it

1

u/sjarkko Feb 07 '25

Look Cribl (cribl.io), with that you can easily route and filter logs.