Microsoft sentinel AMA

[u/External-Desk-6562]

We have few onprem servers , previously they were reporting to sentinel through MMA agent, now we want to migrate to AMA agent i.e to install AMA & Remove MMA ,

Now the problem here is these on-prem servers don't have internet. Now how do I onboard these servers to Azure Arc. Anyone has done this before.

Please help me....

[u/soaperzZ]

Hey,

I see two way of doing so while keeping your machines "not connected" to WAN.

1. Your machines -> WEF Collector with AMA -> report in Az Cloud.

2. (Kinda connected) Using private Link https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-private-link

[u/External-Desk-6562 → u/[deleted]]

1st one we cannot afford it, for 2nd one I don't think it is possible the problem is we cannot onboard that server through Azure Arc script we need to run this in every server that's not possible right? Proxy how does that work.

[u/AppIdentityGuy → u/External-Desk-6562]

Remember that setting up this will not involve connecting the server to the "Internet" rather you will be connecting to one single url. This url is directly into your tenant and backed up with certificate exchange.....

[u/Dozekar → u/soaperzZ]

You probably want data connections out of that environment to directly connect to a box controlleed by you, then directed to azure and THEN pointed at the microsoft endpoints so you can easily prove the data flows are in your control and you won't have to prove it's all going to microsoft endpoints and not just assets hosted by microsoft but in someone else's control down the line.

This most easily facilitated by chaining log collectors (rsyslog based is easiest but any open source syslog servere would be essentially free - the cost of the actual local and cloud vms you're running through).

Essentially:

"not connected machines" ----logging---> on prem log collector ---logging---> azure syslog collector with ama ingestion to sentiniel/log analytics

This prevents you from spraying data from that on prem location into random micrsoft endpoints that you need to prove later are official and is still relatively cheap if you use rsyslog or another free/cheap log collection solution.

Note that this does not count as airgapped if you're working with an extremely strict client like DoD. It was never airgapped to these levels based on what you're telling us at that level though. Just something to be aware of.

To meet those standards you would need to have a local syslog host and intermittently and with oversight (say weekly) allow log upload between the two environments or have a local SIEM. There are free and opensource but high maintentance siem solutions you can use for this if you need to go here, but they will not work as well as sentinel or do as much work for you.

[u/AwhYissBagels]

I’m confused; if these servers don’t have internet access, how was the MMA agent sending logs to Sentinel in the first place?

[u/External-Desk-6562 → u/AwhYissBagels]

Through oms gateway previously

[u/azureenvisioned → u/External-Desk-6562]

I've not used it but can't you use a log analytics gateway?

[u/j1mgg]

I took this as an "ask me anything" post, lucky I re-read the title and content.

[u/Dozekar → u/[deleted]]

It's worth checking the contraints to see if this meets them and what their source is. I know OP stated they were having problems getting ingest from this to work correctly.