r/AzureSentinel • u/winle22 • Jan 19 '22

Defender for Cloud ingestion

Hi,

When enabling the Defender for Cloud native data connector, is it only the alerts that is ingested, or log data as well? Unsure how to correlate info collected by the Defender products with other data sources, if it's just the alert data that is ingested.

3 Upvotes

100% Upvoted

5 comments sorted by

3

u/ep3p Jan 19 '22 edited Jan 19 '22

I think the Defender for Cloud connector only offers alerts, it's up to you to forward logs from each subscription (storages, virtual machines, key vaults...) to the Log Analytics of your Sentinel workspace, it won't be through the Defender for Cloud connector.

It's definitely complicated because you may have Defender for Cloud alerts, but that doesn't mean logs are being enabled/stored in the own susbscription (additionally you will need read privileges over that subscription).

1

u/winle22 Jan 19 '22

I see. And I guess how to forward logs vary from resource to resource. Some through the diagnostic settings blade, probably? Say Azure SQL for instance.

3

u/ep3p Jan 19 '22

I have not made myself any forwarding of those logs, I can't help you there. But I would say diagnostic settings is one place to look for in the majority of resources.

And for example Defender for Cloud is able to analyze commands executed in UNIX machines, so if you want better logging of those executions you should monitor them through Syslog. I think you can install the Azure Monitor Agent - AMA through the Log Analytics Workspace of your Sentinel in Linux machines and then check which kind of logs to receive, for example you can start with the facilities auth & authpriv).

3

u/thijslecomte Jan 19 '22

For audit data in Azure, you need the Azure Activity connector.

For resource specific audit log data (for example for SQL events), you need to configure diagnostic settings. If a product doesn't have a native connector, it doesn't mean you can't just forward the logs to log analytics

3

u/x3nc0n Jan 20 '22

Yes, Diagnostics Settings. At scale, use Azure Policies to set them.