Varonis DatAdvantage
Varonis DatAdvantage monitors unstructured data (Windows and NAS file shares, SharePoint, Exchange and Active Directory), recording who accessed which files, what permissions exist, and how both change over time. Its value is a view no firewall or endpoint agent provides: which accounts can reach sensitive data, which of them actually do, and when that pattern shifts. The alerts it raises for mass file access, permission changes, sensitive-data exposure and suspicious directory activity are exactly the signals that identify insider risk and the file-encryption stage of ransomware, which is why they belong alongside identity and endpoint telemetry rather than in a separate console.
On-premise DatAdvantage has no application template. It sends syslog to a listener like the other devices in this section, but the parser has to be built by hand rather than supplied by a template; that is what this page covers.
The catalog also carries a Varonis template (v1: Install Application From Template), under Cloud-based Business Softwares. It is a different path to different data: it polls the Varonis SaaS API for DatAlert alerts and activity events over HTTPS, taking a tenant URL and an API key, and needs no syslog listener and no hand-built parser. If your Varonis deployment is the SaaS one, install that template and stop here. See the Integration Matrix for which products use which path.
Device-side setup
Configure DatAdvantage to forward syslog to the listener described below, following Varonis's own documentation for its syslog export. Unlike the other devices in this section, the platform side is not a one-click template install; see Platform-side setup below.
Syslog configuration
The Varonis server sends to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports) shows the domain, the port range, and which protocol listens on which port; read the numbers off that page rather than assuming a standard one. A collector appliance listens on UDP/514 and TCP/514 by default; a TLS listener (usually 6514 for TLS, 7514 for TLS RFC 6587) is one you add on its Syslog Ports tab and open in the collector's firewall, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration.
Platform-side setup
Varonis has no application template, so the pipeline is built by hand: add the syslog source, attach a parser processor, route it to the EventWatch sink, and connect source to router. Start with Passthrough, which shows the raw records before you write a parser for them.
Related
- On-Prem / Syslog: other syslog sources.
- Parser cookbooks: start from Passthrough to see the raw records; the firewall recipes there do not apply to Varonis data.
- Syslog Import and Syslog Ports: the transport and listener.
- Windows Active Directory: directory telemetry that correlates with Varonis file activity.