Log in to the Data Infrastructure Insights Workload security system.

From the left navigation, select Admin > API Access.

Either create an API access token or use an existing one.

Copy the API access token.

From the BlueXP ransomware protection Settings menu, select Workload security connection.

Select Connect.

Enter the URL for the Data Infrastructure Workload security UI.

Enter the API access token that provides access to Workload security.

Select Connect.

From the BlueXP left navigation, select Protection > Ransomware protection.

Review the Dashboard's Recommended actions pane.

From the Dashboard, select Review and fix for the recommendation of "Prepare <backup provider> as a backup destination."

Continue with instructions depending on the backup provider.

In the Settings > Backup destinations page, select Add.

Enter a name for the backup destination.

Select StorageGRID.

Select the Down arrow next to each setting and enter or select values:

Select Add.

In the Settings > Backup destinations page, select Add.

Enter a name for the backup destination.

Select Amazon Web Services.

Select the Down arrow next to each setting and enter or select values:

Select Add.

In the Settings > Backup destinations page, select Add.

Enter a name for the backup destination.

Select Google Cloud Platform.

Select the Down arrow next to each setting and enter or select values:

Select Add.

In the Settings > Backup destinations page, select Add.

Enter a name for the backup destination.

Select Azure.

Select the Down arrow next to each setting and enter or select values:

Select Add.

Go to AWS IAM console.

Select Policies.

Create a policy using the following code in JSON format:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "NetAppSecurityHubFindings",
      "Effect": "Allow",
      "Action": [
        "securityhub:BatchImportFindings",
        "securityhub:BatchUpdateFindings"
      ],
      "Resource": [
        "arn:aws:securityhub:*:*:product/*/default",
        "arn:aws:securityhub:*:*:hub/default"
      ]
    }
  ]
}

Go to Microsoft Sentinel.

Create a Log Analytics workspace.

Enable Microsoft Sentinel to use the Log Analytics workspace you just created.

Go to Microsoft Sentinel.

Select Subscription > Access control (IAM).

Enter a Custom role name. Use the name BlueXP Ransomware Protection Sentinel Configurator.

Copy the following JSON and paste it into the JSON tab.

{
  "roleName": "BlueXP Ransomware Protection Sentinel Configurator",
  "description": "",
  "assignableScopes":["/subscriptions/{subscription_id}"],
  "permissions": [

  ]
}

Review and save your settings.

Go to Microsoft Sentinel.

Select Entra ID > Applications > App registrations.

For the Display name for the application, enter "BlueXP ransomware protection".

In the Supported account type field, select Accounts in this organizational directory only.

Select a Default Index where events will be pushed.

Select Review.

Select Register to save your settings.

Go to Microsoft Sentinel.

Select Certificates & secrets > Client secrets > New client secret.

Add a description for your application secret.

Select an Expiration for the secret or specify a custom lifetime.

A client secret lifetime is limited to two years (24 months) or less. Microsoft recommends that you set an expiration value of less than 12 months.

Select Add to create your secret.

Record the secret to use in the Authentication step. The secret is never displayed again after you leave this page.

Go to Microsoft Sentinel.

Select Subscription > Access control (IAM).

Select Add > Add role assignment.

For the Privileged administrator roles field, select BlueXP Ransomware Protection Sentinel Configurator.

This is the custom role that you created earlier.

Select Next.

In the Assign access to field, select User, group, or service principal.

Select Select Members. Then, select BlueXP Ransomware Protection Sentinel Configurator.

Select Next.

In the What user can do feld, select Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended).

Select Next.

Select Review and assign to assign the permissions.

Go to Microsoft Sentinel.

Enter the credentials:

Enter the Log Analytics workspace details for the application.

Go to Splunk Cloud.

Select Settings > Data Inputs.

Select HTTP Event Collector > Global Settings.

On the All Tokens toggle, select Enabled.

To have the Event Collector listen and communicate over HTTPS rather than HTTP, select Enable SSL.

Enter a port in HTTP Port Number for the HTTP Event Collector.

Go to Splunk Cloud.

Select Settings > Add Data.

Select Monitor > HTTP Event Collector.

Enter a Name for the token and select Next.

Select a Default Index where events will be pushed, then select Review.

Confirm that all settings for the endpoint are correct, then select Submit.

Copy the token and paste it in another document to have it ready for the Authentication step.

From the BlueXP menu, select Protection > Ransomware protection.

From the BlueXP ransomware protection menu, select the vertical …​ option at the top right.

Select Settings.

In the Settings page, select Connect in the SIEM connection tile.

Choose one of the SIEM systems.

Enter the token and authentication details you configured in AWS Security Hub or Splunk Cloud.

The information that you enter depends on the SIEM you selected.

Select Enable.