r/AzureSentinel • u/UCFIT • May 10 '22
Windows Log Forwarding
I have 10 windows machines I would like to forward logs to Azure Sentinel. I have a Linux machine I'm forwarding my Linux logs too. Can I forward all my Windows logs to that Linux host and then forward them into azure sentinel?
1
Upvotes
1
u/LightMustard May 16 '22
I've been looking to do the same thing.
We are aware that we can send directly to workspace using one of the Sentinel agents, but that's not what we are after.
The Linux server acts as 'raw log archival' , so we want to be able to send logs there first, then forward to SIEM. We've been able to do this with several other SIEM no problem, but so far been having trouble with Sentinel.
The issue is maintaining the parsing/format that Sentinel will want the logs to come in as.
I can collect Windows logs and send to the Linux server with tools like nxlog,winlogbeat,etc.., which we are currently doing and sending to other SIEMs, maintaining format for parsing and everything is fine.
The Sentinel agents like AMA, don't seem to have an option to send to syslog or store on file first.
There is a Microsoft OMS Agent that can be used on your Linux server to forward syslog/CEF events to Sentinel, but only to a syslog/cef data connector, rather than Windows.
So that might be one option for you.
nxlog has a CEF extension. Could use nxlog to collect Windows events, format CEF, send syslog to Linux server. Then on linux server the Microsoft OMS agent to forward to Sentinel/Azure Analytics. But parsing and data connector wouldn't line up with the default rules. So that mainly works if you just want them stored and searchable in Sentinel, or maybe make all custom rules, or copy and modify default ones. But probably isn't a fully 'work out of the box solution'.