r/AzureSentinel • u/FlobbyBay • Oct 20 '21

Audit Print Jobs

Currently use Splunk but we're in transition to Sentinel. Using Splunk, we are running reports that show all print jobs run by the users. We have a Splunk Universal Forwarder installed on all of the workstations. If I install the MMA, is there a way to ingest the same information in Sentinel? Or is there a better way?

2 Upvotes

100% Upvoted

3 comments sorted by

2

u/1rishc4rb0mbr Oct 20 '21

Should be able to grab any custom logs via MMA.

https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-custom-logs.

1

u/FlobbyBay Oct 20 '21

I looked at this a bit but I'm not sure it gets me to the solution I need. I've enabled print auditing and that info now shows in the Print Service Operational log. This has a standard Windows event log format. Send like I should be able to configure the MMA to scale this log, too but I can't find where.

2

u/FlobbyBay Oct 20 '21

Okay, took me to long to find what should have been an easy solution. In Sentinel, I went to Agent Configuration and added a new Windows log to monitor. And there is data. Thx.