What's new in Cayosoft Guardian integration with Microsoft Sentinel

Cayosoft Guardian integration with Microsoft Sentinel connects Cayosoft Guardian's hybrid identity threat detection directly to your security operations platform. With this integration, threat alerts generated by Cayosoft Guardian are automatically delivered into Microsoft Sentinel, where they become incidents, analytics, and dashboards that your SOC team can act on without leaving the tools they already use.

The integration is delivered as a complete, packaged Microsoft Sentinel Solution. Rather than requiring manual setup of individual components, it provides everything needed to begin monitoring Guardian threats in one deployment: a dedicated data connector, a normalized data table, scheduled analytics rules, automatic incident creation, and a prebuilt monitoring workbook. Alerts flow from the Windows Event Log on the Guardian host into Sentinel through the Azure Monitor Agent, are parsed and normalized in transit, and are then enriched with severity levels, Threat ID grouping, and MITRE ATT&CK tactic mapping.

The sections below describe what's included in this release: