Archer integration with Microsoft Sentinel (SIEM)

[mykgang1]

Hi All,

Our client wants to integration Microsoft Sentinel SIEM solution with Archer. Please let me know if this is possible and how?

Thanks

[DavidPetty]

@mykgang1 it depends on how you can get the data out of Microsoft Sentinel SIEM.  What data export options does it have; APIs, database, file export, etc.?  Depending on the how, you can use a data feed to ingest the data.

[mykgang1]

Thanks @DavidPetty . Also, is there any way to export or push Archer (SaaS) logs to Microsoft Sentinel (SIEM)?

[DavidPetty]

Anytime : D

Unfortunately, no.

[mykgang1]

@DavidPetty then I think there is only on way to do this by leveraging Archer API. Is my understanding correct?

[DavidPetty]

Without knowing the whole use case, it hard to tell.

If it's Archer to SIEM it would probably be a JS transport data feed.

If it's SIEM to Archer, yes it would be leveraging Archer's APIs.

Alternatively, you could have middleware that talks between the two.

[mykgang1]

@DavidPetty Thanks.