Integrating Cayosoft Guardian Threat alerts with Microsoft Sentinel

This article describes how to integrate Cayosoft Guardian Threat alerts with Microsoft Sentinel.

The Cayosoft Guardian data connector automatically ingests threat alerts from Cayosoft Guardian into Microsoft Sentinel. Cayosoft Guardian writes threat alerts to the Windows Event Log as Event ID 2. The Azure Monitor Agent (AMA) collects these events by using Data Collection Rules (DCRs) and sends the parsed data to a custom Log Analytics table.

After the data is ingested, Microsoft Sentinel can use it for monitoring, analytics, incident creation, investigation, and automated response across your hybrid identity environment.

The integration is delivered as a packaged Microsoft Sentinel solution that includes the following components:

• Cayosoft Guardian Threat Alerts data connector.
• Custom Log Analytics table for normalized threat alert data.
• Scheduled analytics rules for incident generation.
• Microsoft Sentinel workbook for alert visualization and trend analysis.

How the integration works

Data collection

The Data Collection Endpoint (DCE) and Data Collection Rule (DCR) collect Windows Event Log records from the server running Cayosoft Guardian. The connector targets Event ID 2 in the custom Cayosoft Guardian Alerts log. These events represent Cayosoft Guardian Threat alerts generated by the product.

The DCR uses an inline transformKql transformation to parse the event payload and normalize alert properties before they are stored in Log Analytics.

Each threat alert record written to the Windows Event Log becomes a single row in the destination table.

The parsed data is written to the custom Log Analytics table named CayosoftThreatAlerts_CL.

This table is the primary data source for the Cayosoft Guardian analytics rules and workbook in Microsoft Sentinel.

The solution deploys scheduled analytics rules that query CayosoftThreatAlerts_CL and generate Microsoft Sentinel incidents based on alert severity.

The rules are mapped to the following severity levels:

• Critical and High

  Both are reported as High.

• Medium
• Low
• Informational

The rules include custom alert details such as ThreatId, TargetName, Categories and Evidence which can be found under Threat alert's Custom details. They also extract relevant tactics when available. Alerts are grouped by ThreatId so related activity is consolidated in Microsoft Sentinel in a way that aligns with how threats are displayed in Cayosoft Guardian.

The Cayosoft Guardian workbook provides a dashboard view of alert volume, unique threats, severity distribution, system types, and trends over time.

Before you begin

Before configuring the integration, make sure the following requirements are met:

• You have a Microsoft Sentinel workspace.
• You have read and write permissions for the Log Analytics workspace.
• The Windows Server that hosts Cayosoft Guardian is connected to Azure Arc or runs as an Azure virtual machine.
• The Azure Monitor Agent is installed on the Cayosoft Guardian server.
• You have read and write permissions for Data Collection Rules.
• You can associate the Data Collection Rule with the Azure Arc-enabled server or Azure virtual machine that runs Cayosoft Guardian.

1. Enable Windows Event Log for Cayosoft Guardian alerts

Before connecting the server to Microsoft Sentinel, enable alert logging in Cayosoft Guardian. This ensures that threat alerts are written to the Windows Event Log and can be collected by the Azure Monitor Agent.

1. Open the Cayosoft Guardian web portal.
2. Go to Settings > Service Settings > Windows Event Log Settings.
3. Uncheck Disabled to have the Windows Event Log for Alerts feature enabled.
4. Save the changes.

What is available in Microsoft Sentinel

After the integration is configured and data is ingested, the following components are available in Microsoft Sentinel.

• Incidents - Cayosoft Guardian threats appear as Microsoft Sentinel incidents. Each incident includes severity, priority, tags, and category mapping such as Credential Access or Persistence.

  

• Incident details and entity mapping- Each incident includes grouped alerts and entity relationships. The incident view can show affected accounts, groups, computers, and the originating application, helping analysts understand the scope and context of the threat.

  

• Analytics rules - The Microsoft Sentinel solution deploys scheduled analytics rules for Cayosoft Guardian threat alerts. These rules query the CayosoftThreatAlerts_CL custom table and generate incidents based on severity. For example, the high-severity rule, Cayosoft Guardian - High Severity Alert Detected, queries CayosoftThreatAlerts_CL for high-severity events and creates incidents for matching results.

  

• Workbook - The Cayosoft Guardian - Incidents Dashboard workbook provides a visual summary of threat alert data. The workbook includes the following views:
  • Total alerts and unique threats.
  • Alert summary grouped by ThreatId.
  • Alert trends over time.
  • Alerts by system type, such as Microsoft Entra ID, Active Directory, Intune, Exchange Online, and hybrid identity.
  • Filters for severity, system, and time range.

2. Verify data ingestion

After configuring the connector, verify that Microsoft Sentinel is receiving Cayosoft Guardian threat alert data.

1. In Microsoft Sentinel, open the Log Analytics workspace connected to your Sentinel instance.
2. Open Logs.
3. Run the following query: CayosoftThreatAlerts_CL | sort by TimeGenerated desc | take 50
4. Confirm that new rows are available in the table.

If no data appears, confirm that Cayosoft Guardian is writing alert events to the Windows Event Log and that the Azure Monitor Agent is connected to the correct Data Collection Rule.

3. Install the workbook

The Cayosoft Guardian solution includes a prebuilt workbook that visualizes threat alerts and incidents, including severity distribution, alerts by system type, alert trends over time, and recent incidents and alerts.

1. In Microsoft Sentinel, go to Content hub.
2. Search for Cayosoft Guardian and verify that the solution is installed. If it is not installed, install it.
3. Go to Workbooks and select the Templates tab.
4. Select Cayosoft Guardian Threats, click Save, choose the Azure region where you want to save the workbook, and then click View saved workbook.
5. The workbook is available under My workbooks. Optionally, pin it to an Azure dashboard for quick access.

4. Enable the analytics rules

The Cayosoft Guardian solution also includes scheduled analytics rule templates that convert Cayosoft Guardian threat alerts into Microsoft Sentinel incidents.

1. In Microsoft Sentinel, go to Analytics.
2. Select the Rule templates tab.
3. Locate the Cayosoft Guardian analytics rule templates, for example:
   • Cayosoft Guardian - Cloud Application Security Threats
   • Cayosoft Guardian - Core Identity and Infrastructure Threats
4. Click Create rule, review the schedule, entity mapping, and incident settings, and then click Review + create.
5. Verify that the rule appears as Enabled on the Active rules tab. The analytics rules generate the SecurityIncident records used by the workbook's Incidents & recent alerts table.

Troubleshooting

If threat alerts are not displayed in Microsoft Sentinel, check the following items:

• Confirm that Windows Event Log for Alerts is enabled in Cayosoft Guardian.
• Confirm that threat alerts are being written to the custom Cayosoft Guardian Alerts log on the Cayosoft Guardian server.
• Confirm that the Azure Monitor Agent is installed and healthy.
• Confirm that the server is connected through Azure Arc or is running as an Azure virtual machine.
• Confirm that the Data Collection Rule is associated with the correct machine.
• Confirm that the DCR is collecting Event ID 2 from the Cayosoft Guardian Alerts log.
• Confirm that the destination table CayosoftThreatAlerts_CL exists in the Log Analytics workspace.
• Run a query against CayosoftThreatAlerts_CL to verify that data is being ingested.

For more information about Cayosoft Guardian Threat alerts, see Threat Alerts Directory.