MongoDB Atlas Solution for Microsoft Sentinel

The MongoDB Atlas Solution for Sentinel allows to bring the MongoDB Atlas Database logs into Sentinel for Security events detection and analysis. It uses the MongoDB Atlas API to retrieve MongoDB logs for an user provided Atlas Project and Cluster on a timer frequency which is also set by the user.

*NOTE:** This connector uses Azure Functions to connect to 'MongoDB Atlas' to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the Azure Functions pricing page for details.

For more details on the MongoDB Atlas connector, refer to MongoDB Solution Release Notes.

This Solution includes one Data Connector.

Pre-requisites for using MongoDB Sentinel Connector:

1. An Azure subscription, Resource Group and a Log analytics workspace onboarded to Microsoft Sentinel.

2. MongoDB Altas service account Client ID and Client Secret are required to authenticate the Atlas Admin API. [See the documentation to learn more about creating a service account]

3. Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys]

4. Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions]

5. [Optional] An existing Key Vault, if used, to store the MongoDB Atlas client secret, should be created within the same RG with the vault access policy permission model.