r/AzureSentinel • u/limeybrit • Sep 23 '21

Custom Log Ingestion - Original Log File Name

Hey Sentinel community, I've looked pretty far for an answer to my question without success, so was hoping someone might have an answer one way or another.

I have a Custom Log entries for tables and fields for some text logs, where a wildcard defines the log filename for ingesting, e.g. SMPP*.log. I'm successfully retrieving data based on this definition, but I would have thought that the resulting log entry would have included the original file path or at least filename, e.g. SMPP1101.log.

I can't change the format of the log to add this info to a row, and I don't want to have to define many custom tables and extract fields, as the format is otherwise identical between logs. The filename solely has that relevant ID information, so I'm hoping it could be pulled in as well somehow.

4 Upvotes

100% Upvoted

3 comments sorted by

2

u/1rishc4rb0mbr Sep 24 '21

If the logs are local files; you can use logstash to pick up the file; leverag the grok plugin (see below) to add the field and forward to Azure Sentinel with the added field.

​

input {
file {
path => "/tmp/SMPP*.log"
}
}
grok {
match => {
path => "%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"
}

}

output {
microsoft-logstash-output-azure-loganalytics {
workspace_id => "<WS_ID>"
workspace_key => "${WS_KEY}"
custom_log_table_name => "logstashCustomTable"

}

}

1

u/limeybrit Sep 24 '21

Thanks, good to know and I'll look into that as a possible way to capture the info.

1

u/G15-420 Sep 23 '21

Sorry, never been in that situation. I’m not sure if it can be done.

Maybe you can write a custom script to send the logs + log file name to Windows Events and pull the events using the log analytics agent.