Integrating Cato Events with Microsoft Sentinel Using the Microsoft Content Hub (EA)

Note: This is an Early Availability (EA) feature that is only available for limited release. For more information, contact your Cato Networks representative or send an email to ea@catonetworks.com.

Overview

This integration is installed from the Microsoft Sentinel Content Hub rather than from the CMA. It suits organizations that want the Entra application registered under their own control and that prefer to grant Cato the narrowest possible access: permission to write events into one Data Collection Rule, and nothing else.

Cato is listed in the Content Hub as a Microsoft-supported partner connector, built on the Codeless Connector Framework (CCF). This means the connector appears in the Sentinel data connectors gallery with native connector health monitoring, alongside your other Sentinel connectors. You keep the event schema current.

Cato also offers a native turnkey integration that you install from the CMA. With that method, Cato creates and maintains the app registration in your tenant, rotates its certificate, and can keep the event schema current for you. For a full comparison, review the guidance in Integrating Cato Events with Microsoft Sentinel.

Process and Owners

Prerequisites

• An existing Log Analytics workspace with Microsoft Sentinel enabled, and read and write permissions on that workspace.

• Permission in Microsoft Entra ID to register an application and create a client secret. This typically requires the Application Developer role or higher.

• Permission in Azure to assign the Monitoring Metrics Publisher role on a Data Collection Rule. This typically requires the Owner or User Access Administrator role.

• Editor permission for Integrations (in the Resources section) in the CMA. For more information, see Managing Admin Roles Using RBAC.

• Review the prerequisites for all Cato event integrations in Getting Started with Event Integrations.

The MS Tenant connector is not required for this integration. That connector exists so that Cato can create app registrations in your tenant. With this integration method, you create the application yourself.

What the Deployment Creates

Everything below is created in your subscription by the Deploy action on the connector page. You do not create any of it manually.

Setting Up the Integration

Installing and Deploying the Connector

To install and deploy the connector:

1. In Microsoft Sentinel, select your workspace and go to Content management > Content hub.

2. Search for Cato Networks and install the solution.

   In the installation wizard, select the subscription, resource group, and workspace that hold your Sentinel deployment, and then click Review + create. You can also view the solution as Cato Networks for Microsoft Sentinel in the Microsoft Marketplace.

3. Go to Configuration > Data connectors and select Cato Networks Events (Push).

4. Click Open connector page.

   If you cannot see Open connector page or Deploy, zoom the browser out. The connector page can render below the visible area of the window, with no page scrollbar.

5. Copy the Tenant ID. This value is available before you deploy.

6. Click Deploy, review the resources listed, and confirm.

   A warning appears first, explaining that a data collection endpoint will be created if one does not already exist. This is expected.

Copying the Connection Values

When the deployment finishes, the connector page shows six values, each with a copy button.

Warning:

Copy the Entra App Registration Secret as soon as the deployment finishes. The connector page reloads automatically within about a minute, and the secret is not shown again: Microsoft never displays a client secret after it is created, and the page has no option to reveal it. Handle and store it as you would any other credential.

If you miss it, you do not have to reinstall the solution. See What if I lose the client secret? in the FAQ for the two ways to recover.

Creating the Integration in the CMA

To create the Sentinel integration:

1. From the CMA's navigation menu, select Resources > Integrations.

2. On the Configured Integrations tab, click New. The New Integration panel opens.

3. Select Microsoft Sentinel.

4. In the Auth field, select Content Hub (CCF push) authentication for Microsoft Sentinel.
   

5. Enter a Name for this integration, and optionally a Description.

6. Enter the values you copied from the connector page:

   • Directory (Tenant) ID

   • Application (Client) ID

   • Client Secret

   • Data Collection Endpoint Uri

   • Data Collection Rule Immutable ID

   • Events Stream Name

7. Optional: Add filters to control which Cato events are sent to Microsoft Sentinel, as described below.

8. Click Save.

Keeping the Event Schema Up to Date

The solution in the Content Hub carries the event schema as it stood when that version was published. Cato adds event fields more often than the solution is republished, so after installing, you apply the current schema separately.

Do this once as part of setup, and again whenever you want fields that Cato has added since. Installing a newer version of the solution does not do it for you: the table and Data Collection Rule belong to your subscription and were created by your Deploy action, so only this template changes them.

To apply the current schema:

1. Open the schema update template. In the Keeping the schema up to date section of the connector page, click Deploy the schema update. Alternatively, go to the Cato Sentinel CCF repository and click Deploy to Azure.

2. Select the subscription and the resource group that holds your Sentinel workspace.

3. Enter the workspace name. This is the only value you supply.

4. Click Review + create.

The update preserves your ingestion endpoint, Data Collection Rule immutable ID, Entra application, client secret, table retention, and all data already ingested. Nothing has to be re-entered in the CMA, and ingestion continues throughout.

A Log Analytics workspace holds one Cato connector, so if you run the connector in more than one workspace, apply the update once per workspace.

Allow up to 30 minutes for new fields to start arriving. The ingestion endpoint caches the previous schema briefly, and during that window events are accepted normally with the new fields left empty. Verify with a query rather than assuming the update failed:

CatoNetworksEvents_CL
| where TimeGenerated > ago(1h)
| take 10

If the new fields are still empty after an hour, contact Cato support with your account ID and the name of your Log Analytics workspace.

The schema only ever grows. Columns are added, never removed or retyped, so an update cannot break an existing workbook, analytics rule, or saved query.

Verifying the Integration Is Working

After setup, confirm:

• The table CatoNetworksEvents_CL appears in your Log Analytics workspace under Tables

• The connector page in Sentinel shows the connector as Connected

• Events appear within a few minutes of traffic. Query with CatoNetworksEvents_CL | take 10 in Log Analytics

Note:

The Connected status in Sentinel is based on data arriving in the table over the previous seven days, not on whether the credentials are still valid. A connector whose secret has expired can continue to show as Connected for up to seven days. Use a query against the table to confirm that events are still arriving.

Configure Filters

Use filters to control which Cato events are exported to Microsoft Sentinel. This helps reduce ingestion costs, minimize noise, and focus investigations on the events that are most relevant to specific sites, users, or regions. You can also use filters to route different subsets of events to different SIEM environments.

Use filter groups to define filters based on any Event Field or combination of fields. Conditions within each group use AND logic. OR logic is applied between groups. The filters in the screenshot configure the integration to export:

• Events that originate from Paris or Madrid, are of sub-type Internet Firewall, and resulted in actions other than Monitor or Prompt

• Username contains Test

Event Field Reference

The columns in CatoNetworksEvents_CL mirror the Cato event fields. See Cato Event Schema for the fields each event type carries, and Understanding Event Fields for the field definitions.

Two names differ because Log Analytics reserves them:

Known Limitations

• The packaged schema is a starting point. The solution carries the event schema as of its release. Fields that Cato adds afterwards reach your table only when you apply the schema update. See Keeping the Event Schema Up to Date.

• One connector per workspace. The Data Collection Rule and the custom table are named from the workspace, so deploying the connector again in the same Log Analytics workspace reuses the existing resources rather than creating a second set. Events from several Cato accounts can share one connector, and are distinguished by account_id and account_name. To keep feeds in separate tables, with their own retention or access control, use a separate workspace for each.

• Fixed table name. Events are always written to CatoNetworksEvents_CL. The table name is fixed by the published solution and cannot be changed, because the connector's health status in Sentinel is determined by a query against that table.

• Large event limitation. Some XOps events can include extensive story information in the raw_data field, which may cause the event to exceed Microsoft Sentinel ingestion size limits (approximately 1 MB). When this occurs, Cato still forwards the event to Sentinel, but omits the raw_data field.

• Uninstalling does not clean up. Deleting the connector leaves the Data Collection Rule, the custom table and its data, and the Entra application in place. Remove them in Azure if you no longer need them.