Microsoft Sentinel

The Files.com integration with Microsoft Sentinel uses Sentinel's Logs Ingestion API in Azure Monitor to efficiently transfer Files.com logs into your Sentinel environment. The forwarded logs are stored by default in Azure Monitor's Log Analytics, which serves as the foundation of the Microsoft Sentinel workspace. From there, you can access the logs and use Kusto Query Language (KQL) to execute queries for threat detection and network activity monitoring.

This integration ensures that your data is consistently updated for real-time analysis. You have the flexibility to configure the integration to send various types of log data to Sentinel, enhancing your capability to monitor, analyze, and respond to security events with greater accuracy and speed.