Check Point CloudGuard CNAPP Connector for Microsoft Sentinel
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CloudGuardCCPDefinition |
| Publisher | CheckPoint |
| Used in Solutions | Check Point CloudGuard CNAPP |
| Collection Method | CCF |
| Connector Definition Files | CloudGuard_DataConnectorDefinition.json |
| DCR Definition Files | CloudGuard_DCR.json |
| CCF Configuration | CloudGuard_PollingConfig.json |
| CCF Capabilities | Basic, Paging, POST |
| Microsoft Learn | View on Learn |
The CloudGuard data connector enables the ingestion of security events from the CloudGuard API into Microsoft Sentinel™, using Microsoft Sentinel’s Codeless Connector Platform. The connector supports DCR-based ingestion time transformations which parses incoming security event data into custom columns. This pre-parsing process eliminates the need for query-time parsing, resulting in improved performance for data queries.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
CloudGuard_SecurityEvents_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- CloudGuard API Key: Refer to the instructions provided here to generate an API key.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect CloudGuard Security Events to Microsoft Sentinel
To enable the CloudGuard connector for Microsoft Sentinel, enter the required information below and select Connect.
- API Key ID: api_key
- API Key Secret: (password field)
- CloudGuard Endpoint URL: e.g. https://api.dome9.com
- Filter: Paste filter from CloudGuard
- Click 'Connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊