Skip to main content

Varonis DatAdvantage

Varonis DatAdvantage monitors unstructured data — Windows and NAS file shares, SharePoint, Exchange and Active Directory — recording who accessed which files, what permissions exist, and how both change over time. Its value is a view no firewall or endpoint agent provides: which accounts can reach sensitive data, which of them actually do, and when that pattern shifts. The alerts it raises for mass file access, permission changes, sensitive-data exposure and suspicious directory activity are exactly the signals that identify insider risk and the file-encryption stage of ransomware, which is why they belong alongside identity and endpoint telemetry rather than in a separate console.

This page is the syslog path; there is now a template for the SaaS API

On-premise DatAdvantage has no application template. It sends syslog to a listener like the other devices in this section, but the parser has to be built by hand rather than supplied by a template — that is what this page covers.

The catalog does now carry a Varonis template, under Cloud-based Business Softwares. It is a different path to different data: it polls the Varonis SaaS API for DatAlert alerts and activity events over HTTPS, taking a tenant URL and an API key, and needs no syslog listener and no hand-built parser. If your Varonis deployment is the SaaS one, install that template and stop here. See the Integration Matrix for which products use which path.

Device-side setup​

Configure DatAdvantage to forward syslog to the listener described below, following Varonis's own documentation for its syslog export. Unlike the other devices in this section, the platform side is not a one-click template install — see Platform-side setup below.

Syslog configuration​

The Varonis server sends to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Platform → Administration → Syslog Ports shows the domain, the port range, and which protocol listens on which port — read the numbers off that page rather than assuming a standard one. A collector appliance listens by default on UDP/514, TCP/514, TLS on 6514 and TLS RFC 6587 on 7514, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration. Either TLS listener presents a certificate the sending device has to trust: the Download CA (ca.crt) button on the Syslog Ports page supplies it, and without it the handshake fails with nothing logged on the platform side.

Platform-side setup​

Varonis has no application template, so the pipeline is built by hand: add the syslog source, attach a parser processor, route it to the EventWatch sink, and connect source to router. No Varonis parser recipe ships with the manual — Passthrough is the starting point for seeing the raw records before writing one.