Fortra Agari Data Connector (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | AgariConnector |
| Publisher | Microsoft |
| Used in Solutions | Agari |
| Collection Method | CCF |
| Connector Definition Files | Agari_ConnectorDefinition.json |
| DCR Definition Files | Agari_DCR.json |
| CCF Configuration | Agari_PollerConfig.json |
| CCF Capabilities | OAuth2, Paging, Nested |
| Microsoft Learn | View on Learn |
The Fortra Agari Data Connector allows ingesting logs from Fortra Agari APIs into Microsoft Sentinel. This connector integrates with Agari Brand Protection (BP), Phishing Defense (APD), and Phishing Response (APR) products. It supports DCR-based ingestion time transformations for efficient query execution. Refer to Agari API documentation for more information.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
AgariAPDPolicyLog_CL |
? | ✓ | ? |
AgariAPDTCLog_CL |
? | ✓ | ? |
AgariAPRInvestigationsLog_CL |
? | ✓ | ? |
AgariBPAlertsLog_CL |
✗ | ✓ | ✗ |
AgariBPThreatFeedSubs_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Configuration steps for the Agari API
Follow the instructions below to obtain your Agari API credentials.
1. Retrieve API URL
Log in to your Agari Console and navigate to the API section. The default API URL is https://api.agari.com
2. Retrieve Client Credentials
Obtain your Client ID and Client Secret from the API credentials section in your Agari account. Note that different Agari products (Brand Protection, Phishing Defense, Phishing Response) may require separate API credentials.
3. Select Data Streams
Choose which Agari data streams you want to collect. You can select one or more streams based on your subscription and requirements.
- Base API URL: https://api.agari.com
- Client ID: Your Client ID
- Client Secret: (password field)
- Data Streams to Collect (multi-select)
- Brand Protection Alerts (with nested details)
- Phishing Defense Policy Events
- Phishing Defense Threat Categories
- Brand Protection Threat Feed URL Submissions (IoC)
- Phishing Response Investigation Attachments
- Click 'Connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊