Illusive Attack Surface Analysis and Incident Logs for Microsoft Sentinel

Solution: Illusive Platform

Illusive Platform Logo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Attribute	Value
Publisher	Illusive Networks
Support Tier	Partner
Support Link	https://illusive.com/support
Categories	domains
Version	3.0.1
Author	Illusive Networks
First Published	2022-05-25
Solution Folder	Illusive Platform
Marketplace	Azure Marketplace · Popularity: ⚪ Very Low (0%)
Pre-requisites	Common Event Format

The Illusive Platform solution for Microsoft Sentinel enables you to ingest Illusive Platform’s attack surface analysis data and incident logs into Microsoft Sentinel and view this information in dedicated dashboards that offer insight into your organization's attack surface risk (ASM Dashboard) and track unauthorized lateral movement in your organization's network (ADS Dashboard).

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

Pre-requisites
Data Connectors
Tables Used
Content Items

Pre-requisites

This solution depends on 1 other solution(s):

Solution
Common Event Format

Data Connectors

This solution provides 1 data connector(s) (plus 1 discovered⚠️):

Connectors from dependency solutions:

Common Event Format (CEF) (dependency on Common Event Format)
Common Event Format (CEF) via AMA (dependency on Common Event Format)

🔍 Discovered: This item was discovered by scanning the solution folder but is not listed in the Solution JSON file.

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`CommonSecurityLog`	Common Event Format (CEF) (dependency), Common Event Format (CEF) via AMA (dependency), [Deprecated] Illusive Platform via AMA, [Deprecated] Illusive Platform via Legacy Agent	Analytics, Workbooks

Content Items

This solution includes 3 content item(s):

Content Type	Count
Workbooks	2
Analytic Rules	1

Analytic Rules

Name	Severity	Tactics	Tables Used
Illusive Incidents Analytic Rule	Medium	Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, LateralMovement	`CommonSecurityLog`

Workbooks

Name	Tables Used
IllusiveADS	`CommonSecurityLog`
IllusiveASM	`CommonSecurityLog`

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.1	12-07-2024	Deprecating data connector
3.0.0	13-09-2023	Addition of new Illusive Platform AMA Data Connector