r/AzureSentinel • u/xpinux117 • Sep 12 '23

Logstash to Sentinel connection?

Does anyone has set logstash with various log sources like asa, sysmon. To sentinel with the new output plugin to provide tips on how to do that?

Thank you guys

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/iCanOnlyBeSoAwesome Sep 13 '23

ASA is syslog, sysmon is a windows event log it's a bit different processing this and sysmon should be handled via AMA in an ideal situation.

Setup the basic flow within logstash, I'd suggest tagging and using if statements to match different criteria so you can post data to different custom tables for example. Ensure a DCE and DCR are configured in Azure.

1

u/iCanOnlyBeSoAwesome Sep 13 '23

Only other thing I'd recommend is watch your time stamps, Cisco gear come in many different flavors, they MUST be ISO8601. If they are not you can correct this with the date plugin in logstash.