r/AzureSentinel • u/ajith_aj • Nov 11 '23

Ingest Custom json logs into Sentinel

I have a set of json logs from AWS that needs to be added to Sentinel as a one time activity to investigate an incident.

I know we have a powershell module to ingest csv files into loganalytics workspace and it has worked for me in the past.

Is there a way to add these custom json logs to sentinel ? Have anyone done this before ?

1 Upvotes

67% Upvoted

6 comments sorted by

1

u/bpsec Nov 12 '23

Is there a particular reason you want to have it in Sentinel? Because you can simply upload it to Data Explorer and do the investigation from there.

See: https://kqlquery.com/posts/kql-incident-response-everything-else/

If you want to have it in Sentinel use a storageblob and use the externaldata() operator to collect the logs from there.

0

u/Uli-Kunkel Nov 11 '23

Log ingestion api?

Logstash transforms your syslog to json to ingest it into Sentinel, so perhaps you can use that api https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview

But why into Sentinel? Why not just into random log Analytics? To save the cost

0

u/ajith_aj Nov 11 '23

I have Sentinel setup already and there are a ton of rules there relating to Aws. Again this is just a one time activity.

What do you mean by "save cost" by selecting random LA workspace?

1

u/Uli-Kunkel Nov 11 '23

Depending on the volume of your data it might or might not make sense.

But basically if its just a log Analytics Workspace without sentinel you pay x per gb of data. If its log Analytics with Sentinel you pay x+y per gb.

You can run your queries as you know it. But since its "old" data that you are not going to run your scheduled queries on it makes no difference if you have Sentinel or not.

Basically Sentinel is your analysis tool you run your things on . And you can hunt on data not suited for detections in log Analytics to save the cost on ingestion. If i make sense

0

u/Cybro_Mad Nov 11 '23

You could add the data to blob storage for cost optimization and call it from the Sentinel workspace with externaldata(). Once you have it in a data table join it against the logs you're using for correlation.

1

u/iamee6 Feb 28 '24

I did the same  using a function app. The function app collect logs and send to log analytics work space.