⚠️ SpyCloud Enterprise Protection Connector
⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | SpyCloudEnterpriseProtectionCCF |
| Publisher | SpyCloud |
| Used in Solutions | SpyCloud Enterprise Protection CCF |
| Collection Method | CCF |
| Connector Definition Files | SpyCloudEnterpriseProtectionLogsV2_connectorDefinition.json |
| DCR Definition Files | SpyCloudEnterpriseProtectionLogsV2_DCR.json |
| CCF Configuration | SpyCloudEnterpriseProtectionLogsV2_PollerConfig.json |
| CCF Capabilities | APIKey, Paging |
Ingests SpyCloud Watchlist exposure data into Microsoft Sentinel, including compromised credentials and infected machine records associated with monitored assets. Also includes SpyCloud breach catalog metadata for contextual enrichment and correlation.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
SpyCloudBreachCatalogV2_CL |
? | ✓ | ? |
SpyCloudBreachWatchlistV2_CL |
? | ✓ | ? |
SpyCloud_ConditionalAccessLogsV2_CL |
? | ✓ | ? |
Spycloud_MDE_LogsV2_CL |
? | ✓ | ? |
spycloud_compassV2_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and write permissions are required to ingest data into the Log Analytics workspace.
Custom Permissions:
- Microsoft Sentinel Contributor: Microsoft Sentinel Contributor role is required to manage data connectors.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Configure SpyCloud API
Enter your SpyCloud API key.
- API Key: (password field)
- Severity (multi-select)
- 2
- 5
- 20
- 25
- 30
- Ingest Compass Data (once daily, yesterday data) (select)
- On
- Off
- Click 'connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊