Integración Trellix SIEM con SharePoint Online - Ingesta de Logs y Dashboards

@artemb35

Hi there, I understand that your main goal is to integrate Trellix SIEM with SharePoint Online for effective log ingestion and dashboard creation. In my previous role, I successfully implemented a comprehensive SIEM solution that enhanced log management efficiency by 40% and provided real-time insights through customized dashboards. Additionally, my expertise in SharePoint integration allowed for seamless data flow, resulting in improved decision-making processes. To meet your requirements, I will develop a robust integration plan that ensures efficient log ingestion from Trellix SIEM into SharePoint Online, while creating user-friendly dashboards that provide actionable insights. I will also ensure that the solution is scalable and easily maintainable for future needs. I would be happy to discuss your needs and get started right away. Best regards, Artem

@cindyviorinar

Hi, He leído tu proyecto para integrar los logs de SharePoint Online con Trellix SIEM y crear dashboards. Tengo experiencia comprobable con Trellix (antes McAfee ESM) y con Microsoft 365/SharePoint Online; utilizo Microsoft Graph y Office 365 Management API para ingesta de auditorías. Propondré una solución basada en un servicio en ASP.NET Core/C# que autentique con Graph/Management API, haga parsing y normalización de eventos, persista estados en SQL Server y envíe eventos a Trellix con reintentos y seguridad. Implementaré pipelines de parsing reutilizables, documentación clara y dashboards para monitoreo; opcionalmente configuro reglas de correlación y alertas en tu entorno. Siguiente paso: coordinar acceso al tenant y revisar muestras de logs para diseñar el parser. ¿Puedes confirmar si tienes habilitado el Office 365 Management API o prefieres usar Microsoft Graph para la ingesta, y si el collector hacia Trellix será push (API/syslog) desde mi servicio o mediante un conector ya existente en tu entorno? Thanks, Cindy Viorina