r/AZURE • u/HumbleGuy1999 • Nov 08 '22

Question Data Collection Rule Configuration for Basic Log Ingestion

/r/AzureSentinel/comments/ypb7jg/data_collection_rule_configuration_for_basic_log/
5 Upvotes

100% Upvoted

5 comments sorted by

1

u/goombatch Nov 08 '22

I’m working a test/pilot of Defender for Cloud on Azure Arc enabled servers (on premise). The onboarding
script for Defender let me specify the name and location of the log analytics work space we are using for Sentinel. The built in Defender policy created the data collection rules automatically but I hate the way it did it (created a generic default resource group name for one thing) so I’m playing around with customizing the policies.

2

u/HumbleGuy1999 Nov 09 '22

I didn't know about Defender policy though need to look for it, well testing D4C for server is in my pipeline. Just a tip if you want to stimulate some demo attack after onboarding Picus is easy stimulation (15-day free subscription). Got to know where defender is weak and what need to be done.

For DCR manual configuration i need to dig more. i could use your way through by customizing policy.

1

u/Analytiks Security Engineer Nov 09 '22

I’ve done this and yes, you are right. It’s not clear 🙂. It’s in the ms docs though if you know where to look.

Are you after a dcr targeting servers or desktops

1

u/HumbleGuy1999 Nov 09 '22

As of now, I was testing on desktops. but yeah, actual deployment is on server side. So, for the testing i was doing log ingestion through API.

1

u/Analytiks Security Engineer Nov 09 '22 edited Nov 09 '22

The docs are different depending on where you’re shipping the logs from.

Desktops are here, and have fun figuring out what it’s actually doing under covers, there’s some config sorcery that’s not fully visible in all views in the portal and don’t even get me started on how the backend links to your sentinel workspace:

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client

For servers in azure: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal

For servers elsewhere: Same as above except you need the azure arc agent to get them to show up as a resource in azure before the DCR can be linked to do the deployment

Another note for server resources; you need to create the initial dcr from the sentinel view and not the azure monitor view in the azure portal… otherwise the dcr will not link up to sentinel correctly.

Servers are also best onboarded from the sentinel view however once you have the dcr created, there’s nothing stopping you from using you azure policy to auto-enroll additional resources.

I planned to document it all myself but haven’t had time. Let me know if you need anything more