Forwarding events to Microsoft Sentinel

Forescout Cloud can forward Indicator and Detection events to Microsoft™ Sentinel™.

Prerequisite: You have obtained the Forescout Microsoft DataForwarder application tar file from your Forescout representative:

Data Constraints: This feature uses the Azure Monitor HTTP Data Collector API. As described here, the API has the following data constraints:

• Max payload size: 30 MB
• Max field value size: 32 KB
• Max characters for column names: 45

To enable this feature, complete the following task list (these procedures assume familiarity with the Microsoft Sentinel UI and CLI, administrator access, and are derived from vendor documentation):

1. Obtain a Workspace ID and Shared Key from the Azure Portal.
2. Generate an Forescout Cloud Application API Key.
3. Creating an Azure application service.
4. Upload the Sentinel Forwarder Application Package.
5. Configure Required Environment Variables and Start the New App Service.