|
| 1 | +--- |
| 2 | +id: varonis |
| 3 | +title: Varonis |
| 4 | +sidebar_label: Varonis |
| 5 | +description: The Sumo Logic app for Varonis provides insights into your organization's cybersecurity practices to strengthen security. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/integrations/misc/varonis-logo.png')} alt="thumbnail icon" width="100"/> |
| 11 | + |
| 12 | +The Sumo Logic app for Varonis provides a centralized view of threat intelligence and detection activity across your Varonis environment. It helps you quickly evaluate threat volume, confidence levels, types, and associated detection sources and techniques. |
| 13 | + |
| 14 | +## Log types |
| 15 | + |
| 16 | +This app uses Sumo Logic’s [Varonis source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/varonis-source/) to collect the alerts from the Varonis platform. |
| 17 | + |
| 18 | +## Sample log messages |
| 19 | + |
| 20 | +<details> |
| 21 | +<summary>Varonis Alert</summary> |
| 22 | + |
| 23 | +```json |
| 24 | +{ |
| 25 | + "escalationType": null, |
| 26 | + "eventsCount": 1, |
| 27 | + "hasSensitiveResource": false, |
| 28 | + "hasTaggedResource": false, |
| 29 | + "id": "EBB74744-5D3A-47B5-8CD3-81C4B70026A0", |
| 30 | + "isAssignedToVaronis": false, |
| 31 | + "status": "NEW", |
| 32 | + "closedBy": { |
| 33 | + "name": null |
| 34 | + }, |
| 35 | + "closeReason": { |
| 36 | + "id": "0", |
| 37 | + "name": null |
| 38 | + }, |
| 39 | + "dataSource": [ |
| 40 | + { |
| 41 | + "id": "9", |
| 42 | + "name": "psg49574-Proxy1", |
| 43 | + "type": "PROXY" |
| 44 | + } |
| 45 | + ], |
| 46 | + "generationTime": { |
| 47 | + "dateTimeUtc": "2025-11-04T12:13:52.034Z" |
| 48 | + }, |
| 49 | + "note": null, |
| 50 | + "policy": { |
| 51 | + "category": "EXFILTRATION", |
| 52 | + "id": "89", |
| 53 | + "name": "Abnormal behavior: an unusual amount of data was uploaded to email websites", |
| 54 | + "severity": "HIGH" |
| 55 | + } |
| 56 | +} |
| 57 | +``` |
| 58 | +</details> |
| 59 | + |
| 60 | +## Sample queries |
| 61 | + |
| 62 | +```sql title="Total Alerts" |
| 63 | +_sourcecategory=*varonis* |
| 64 | +| json "id", "dataSource", "policy.category", "policy.severity", "policy.name", "generationTime.dateTimeUtc", "escalationType", "status" as threat.id, detection.source, detection.technique, detection.confidence, threat.name, event.time, event.type, finding.status nodrop |
| 65 | +| where detection.confidence !=NULL |
| 66 | + |
| 67 | +| timeslice 1d |
| 68 | +| count as frequency by _timeslice, detection.confidence |
| 69 | +| fillmissing timeslice, values all in detection.confidence |
| 70 | +| transpose row _timeslice column detection.confidence |
| 71 | +``` |
| 72 | + |
| 73 | +## Collection configuration and app installation |
| 74 | + |
| 75 | +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; |
| 76 | + |
| 77 | +<CollectionConfiguration/> |
| 78 | + |
| 79 | +:::important |
| 80 | +Use the [Cloud-to-Cloud Integration for Varonis](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/varonis-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Varonis app is properly integrated and configured to collect and analyze your Varonis data. |
| 81 | +::: |
| 82 | + |
| 83 | +### Create a new collector and install the app |
| 84 | + |
| 85 | +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; |
| 86 | + |
| 87 | +<AppCollectionOPtion1/> |
| 88 | + |
| 89 | +### Use an existing collector and install the app |
| 90 | + |
| 91 | +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; |
| 92 | + |
| 93 | +<AppCollectionOPtion2/> |
| 94 | + |
| 95 | +### Use an existing source and install the app |
| 96 | + |
| 97 | +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; |
| 98 | + |
| 99 | +<AppCollectionOPtion3/> |
| 100 | + |
| 101 | +## Viewing the Varonis dashboards |
| 102 | + |
| 103 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 104 | + |
| 105 | +<ViewDashboards/> |
| 106 | + |
| 107 | +### Security Overview |
| 108 | + |
| 109 | +The **Varonis - Security Overview ** dashboard provides a unified view of security threats detected across your environment. It surfaces key insights such as threat volume, confidence levels, detection techniques, and data sources including Active Directory, SharePoint, and Exchange Online. You can easily spot spikes in activity, monitor emerging or ongoing threats, and identify recurring issues such as abnormal data uploads or policy violations. The detailed threat summary table enables deeper investigation by presenting event-level data, detection methods, and associated confidence levels. Together, these capabilities help security teams assess risk exposure and prioritize incident response more effectively. < br/><img src={useBaseUrl('img/integrations/saas-cloud/Varonis-SecurityOverview.png')} alt="Varonis - Security Overview Dashboard" /> |
| 110 | + |
| 111 | +## Upgrading the Varonis app (Optional) |
| 112 | + |
| 113 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 114 | + |
| 115 | +<AppUpdate/> |
| 116 | + |
| 117 | +## Uninstalling the Varonis app (Optional) |
| 118 | + |
| 119 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 120 | + |
| 121 | +<AppUninstall/> |
0 commit comments