With SentinelOne Singularity Data Lake, organizations can clearly see data across the enterprise, ingest data from third-party sources, and easily perform real-time analytics to drive informed actions that protect their most critical assets. With the Acronis integration for SentinelOne Singularity DataLake, MSPs can now enrich their customers’ telemetry with Acronis protection data, to make more informed decisions – faster.
This integration is enabled through the Acronis SIEM Connector. The SIEM Connector uses the Acronis agent as a log writer, enabling MSPs to store Acronis Alerts, Events, Activities, and Audit Log on any endpoint in the customer network from where they can be ingested by the SIEM, or send those logs to a syslog server. The Connector supports CEF and JSON log formats.
Improve threat actor risk mitigation by ingesting and enriching data in your SentinelOne Singularity Data Lake with Acronis alert and audit log information, for both backup and security. Having direct access to Acronis EDR incident information and any failed backups next to all information you already have in your SentinelOne Singularity Data Lake, cuts time needed to take an informed response decision.
The integration lets you easily switch between receiving all alerts, or just a subset that contains only the information you are interested in. Want to see only audit log information, that is possible too!
Acronis supports syslog in Common Event (CEF) format, which can be directly ingested by SentinelOne Singularity Data Lake. Setup configuration is simple and straightforward, all that is required is a syslog server.
