Skip to content

Commit a249f3b

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #266615 from yelevin/yelevin/cef-ama-ga
CEF via AMA to GA
2 parents ab95adb + 07c5765 commit a249f3b

13 files changed

+813
-822
lines changed

‎.openpublishing.redirection.sentinel.json

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1055,6 +1055,21 @@
10551055
"redirect_url": "/azure/sentinel/normalization-schema-process-event",
10561056
"redirect_document_id": true
10571057
},
1058+
{
1059+
"source_path_from_root": "/articles/sentinel/connect-cef-ama.md",
1060+
"redirect_url": "/azure/sentinel/connect-cef-syslog-ama",
1061+
"redirect_document_id": false
1062+
},
1063+
{
1064+
"source_path_from_root": "/articles/sentinel/connect-cef-syslog.md",
1065+
"redirect_url": "/azure/sentinel/connect-cef-syslog-ama",
1066+
"redirect_document_id": false
1067+
},
1068+
{
1069+
"source_path_from_root": "/articles/sentinel/connect-cef-syslog-options.md",
1070+
"redirect_url": "/azure/sentinel/connect-cef-syslog-ama",
1071+
"redirect_document_id": false
1072+
},
10581073
{
10591074
"source_path_from_root": "/articles/sentinel/notebooks-with-synapse.md",
10601075
"redirect_url": "/azure/sentinel/notebooks-hunt",

‎articles/sentinel/TOC.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -816,12 +816,8 @@
816816
href: connect-azure-functions-template.md
817817
- name: CEF/Syslog
818818
items:
819-
- name: CEF/Syslog options
820-
href: connect-cef-syslog-options.md
821-
- name: CEF via AMA
822-
href: connect-cef-ama.md
823-
- name: CEF and Syslog
824-
href: connect-cef-syslog.md
819+
- name: CEF and Syslog via AMA
820+
href: connect-cef-syslog-ama.md
825821
- name: CEF over Syslog sources (legacy)
826822
href: connect-common-event-format.md
827823
- name: Deploy a log forwarder (legacy)
@@ -1236,6 +1232,8 @@
12361232
href: windows-security-event-id-reference.md
12371233
- name: DNS over AMA reference
12381234
href: dns-ama-fields.md
1235+
- name: Sample API requests for creating Data Collection Rules (DCRs)
1236+
href: api-dcr-reference.md
12391237
- name: Microsoft Purview Information Protection reference
12401238
href: microsoft-purview-record-types-activities.md
12411239
- name: Microsoft 365 Defender connector data type support

‎articles/sentinel/api-dcr-reference.md

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
---
2+
title: Microsoft Sentinel API request examples for creating Data Collection Rules (DCRs)
3+
description: See samples of API requests for creating Data Collection Rules and their associations, for use with the Azure Monitor Agent.
4+
author: yelevin
5+
ms.author: yelevin
6+
ms.topic: reference
7+
ms.date: 03/01/2024
8+
ms.service: microsoft-sentinel
9+
---
10+
# API request examples for creating Data Collection Rules (DCRs)
11+
12+
This article presents some examples of API requests and responses for creating Data Collection Rules (DCRs) and DCR Associations (DCRAs) for use with the Azure Monitor Agent (AMA).
13+
14+
## Syslog/CEF
15+
16+
The following examples are for DCRs using the AMA to collect Syslog and CEF messages.
17+
18+
### Syslog/CEF DCR
19+
20+
These examples are of the API request and response for creating a DCR.
21+
22+
#### Syslog/CEF DCR creation request URL and header
23+
24+
Example:
25+
26+
```http
27+
PUT https://management.azure.com/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01?api-version=2022-06-01
28+
```
29+
30+
#### Syslog/CEF DCR creation request body
31+
32+
The following is an example of a DCR creation request. For each stream—you can have several in one DCR—change the value of the `"Streams"` field according to the source of the messages you want to ingest:
33+
34+
| Log source | `"Streams"` field value |
35+
| --- | --- |
36+
| **Syslog** | `"Microsoft-Syslog"` |
37+
| **CEF** | `"Microsoft-CommonSecurityLog"` |
38+
| **Cisco ASA** | `"Microsoft-CiscoAsa"` |
39+
40+
```json
41+
{
42+
"location": "centralus",
43+
"kind": "Linux",
44+
"properties": {
45+
"dataSources": {
46+
"syslog": [
47+
{
48+
"name": "localsSyslog",
49+
"streams": [
50+
"Microsoft-Syslog"
51+
],
52+
"facilityNames": [
53+
"auth",
54+
"local0",
55+
"local1",
56+
"local2",
57+
"local3",
58+
"syslog"
59+
],
60+
"logLevels": [
61+
"Critical",
62+
"Alert",
63+
"Emergency"
64+
]
65+
},
66+
{
67+
"name": "authprivSyslog",
68+
"streams": [
69+
"Microsoft-Syslog"
70+
],
71+
"facilityNames": [
72+
"authpriv"
73+
],
74+
"logLevels": [
75+
"Error",
76+
"Alert",
77+
"Critical",
78+
"Emergency"
79+
]
80+
}
81+
]
82+
},
83+
"destinations": {
84+
"logAnalytics": [
85+
{
86+
"workspaceResourceId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/Contoso",
87+
"workspaceId": "11111111-2222-3333-4444-555555555555",
88+
"name": "DataCollectionEvent"
89+
}
90+
]
91+
},
92+
"dataFlows": [
93+
{
94+
"streams": [
95+
"Microsoft-Syslog"
96+
],
97+
"destinations": [
98+
"DataCollectionEvent"
99+
]
100+
}
101+
]
102+
}
103+
}
104+
```
105+
106+
#### Syslog/CEF DCR creation response
107+
108+
Here's the response you should receive according to the sample request above:
109+
110+
```json
111+
{
112+
"properties": {
113+
"immutableId": "dcr-0123456789abcdef0123456789abcdef",
114+
"dataSources": {
115+
"syslog": [
116+
{
117+
"streams": [
118+
"Microsoft-Syslog"
119+
],
120+
"facilityNames": [
121+
"auth",
122+
"local0",
123+
"local1",
124+
"local2",
125+
"local3",
126+
"syslog"
127+
],
128+
"logLevels": [
129+
"Critical",
130+
"Alert",
131+
"Emergency"
132+
],
133+
"name": "localsSyslog"
134+
},
135+
{
136+
"streams": [
137+
"Microsoft-Syslog"
138+
],
139+
"facilityNames": [
140+
"authpriv"
141+
],
142+
"logLevels": [
143+
"Error",
144+
"Alert",
145+
"Critical",
146+
"Emergency"
147+
],
148+
"name": "authprivSyslog"
149+
}
150+
]
151+
},
152+
"destinations": {
153+
"logAnalytics": [
154+
{
155+
"workspaceResourceId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/Contoso",
156+
"workspaceId": "11111111-2222-3333-4444-555555555555",
157+
"name": "DataCollectionEvent"
158+
}
159+
]
160+
},
161+
"dataFlows": [
162+
{
163+
"streams": [
164+
"Microsoft-Syslog"
165+
],
166+
"destinations": [
167+
"DataCollectionEvent"
168+
]
169+
}
170+
],
171+
"provisioningState": "Succeeded"
172+
},
173+
"location": "centralus",
174+
"kind": "Linux",
175+
"id": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01",
176+
"name": "Contoso-DCR-01",
177+
"type": "Microsoft.Insights/dataCollectionRules",
178+
"etag": "\"00000000-0000-0000-0000-000000000000\"",
179+
"systemData": {
180+
}
181+
}
182+
```
183+
184+
### Syslog/CEF DCRA
185+
186+
#### Syslog/CEF DCRA creation request URL and header
187+
188+
```http
189+
PUT
190+
https://management.azure.com/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/LogForwarder-VM-1/providers/Microsoft.Insights/dataCollectionRuleAssociations/contoso-dcr-assoc?api-version=2022-06-01
191+
```
192+
193+
#### Syslog/CEF DCRA creation request body
194+
195+
```json
196+
{
197+
"properties": {
198+
"dataCollectionRuleId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01"
199+
}
200+
}
201+
```
202+
203+
#### Syslog/CEF DCRA creation response
204+
205+
```json
206+
{
207+
"properties": {
208+
"dataCollectionRuleId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01"
209+
},
210+
"id": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/LogForwarder-VM-1/providers/Microsoft.Insights/dataCollectionRuleAssociations/contoso-dcr-assoc",
211+
"name": "contoso-dcr-assoc",
212+
"type": "Microsoft.Insights/dataCollectionRuleAssociations",
213+
"etag": "\"00000000-0000-0000-0000-000000000000\"",
214+
"systemData": {
215+
}
216+
}
217+
```
218+

0 commit comments

Comments
 (0)