Integrate Aruba Central with Microsoft Sentinel

[geniusg1205]

Hello everyone.

I am trying to integrate the Aruba Central platform for event monitoring into Microsoft Sentinel. Because there is no data connector for this solution, a case was escalated to Microsoft support. The information requested by Aruba Central to make the connection:

The Microsoft engineer conducted the investigation and the team's response was as follows:

“ _If the Aruba Central console requests a URL to send data, you must construct the URL as follows:

• https://WorkspaceID.ods.opinsights.azure.com/api/logs?api-version=2016-04-01. Replace with the ID of your workspace.
• Index: This refers to the name of the type of record that will appear in log Analytics. You can use any descriptive name, for example, ArubaCentralEvents.
• Token: Authentication is done using the Shared Key of the Log Analytics workspace._ "

Tests were made with the information sent by Microsoft but the result of the Aruba Central console shows that the destination is unreachable.

Due to issues beyond MS's control, the final customer took a long time to answer so MS closed the case, before reopening the case, I wanted to consult this blog to see if you can help me.

[v-rusraut]

Hi @geniusg1205 , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!