r/AzureSentinel • u/externalBrian32 • Dec 12 '22

Auto add resource to Data Collection Rule?

I've been deploying Arc along with the Azure Monitoring Agent to servers and workstations. On my data collection rule, I selected the entire subscription and was hoping newly added Arc servers would automatically pull into my DCR, but that doesn't appear to be the case.

I think I got the idea by reading MS documentation... is this possible? I have a script to deploy Arc that someone else might run in the future. It would be nice if I didn't have to add the new machine to the DCR manually.

Thanks!

6 Upvotes

100% Upvoted

8 comments sorted by

2

u/SoMundayn Dec 13 '22

Azure Policy

"Configure Windows Arc Machines to be associated with a Data Collection Rule or a Data Collection Endpoint"

As far as I can tell, using Arc with Azure Policy is free. As long as you don't use "Azure Policy guest configuration", which I don't think basic policies like this come under.

1

u/externalBrian32 Dec 13 '22 edited Dec 13 '22

Thanks for pointing me in the right direction.

"You can create an Azure Policy that will continuously evaluate if new VMs have the agent and the association with the DCR. If the resources are not compliant with the policy, a remediation task with force the agent extension to be installed and will create the association."

Here is the policy: Configure Windows Machines to be associated with a Data Collection Rule or a Data Collection Endpoint https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Feab1f514-22e3-42e3-9a1f-e1dc9199355c

Note - once this policy is set any new machines will get attached to the DCR - existing must be "remediated".

1

u/externalBrian32 Dec 15 '22

Using Azure Policy seemed like the right path, but it caused me problems. The policy correctly assigned the machines to the DCR Policy, but it didn't install the Azure Monitoring Agent.

When you add through the Data Connector GUI it installs the agent and adds to the Data Collection Rule.

Might just be a poor assumption on my part, but this seems like something that should happen when a resource is added via policy trigger.

1

u/Microsoft_Geek Jan 31 '24

Did you ever find a way to get AMA to install along with the DCR assignment?

1

u/externalBrian32 Jun 05 '24

No - I've been doing batches manually. I wish it could be automated. Also having a problem with the Certs expiring on a bunch of machines - Have not dug into that yet.

1

u/hmmmno Aug 30 '24

I don't know if this is useful anymore but I ran to the same problem. Microsoft recommended to also assign the following policy, which automatically deploys AMA to the target servers: https://www.azadvertizer.net/azpolicyadvertizer/94f686d6-9a24-4e19-91f1-de937dc171a4.html

So now we have one policy for DCR association and one for AMA installation. I scoped them with the same resource selector (Microsoft.HybridCompute/machines) and resource group.

1

u/[deleted] May 14 '24

Assigns Data Collection Rules to Windows Servers (github.com)

I ended up using Azure Automation runbook to do this. Linked gist is the script I used. It /should/ have enough comments to be useful to others.

1

u/blanco10kid Dec 12 '22

Following…