Skip to content

Commit be273a8

Browse files
limwainsteinlimwainstein
committed
Reviewing
1 parent 677d349 commit be273a8

File tree

3 files changed

+77
-76
lines changed

3 files changed

+77
-76
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -262,9 +262,10 @@
262262
href: connect-azure-windows-microsoft-services.md
263263
- name: AMA migration for Microsoft Sentinel
264264
href: ama-migrate.md
265-
- name: CEF/Syslog options
266-
href: connect-cef-syslog-options.md
265+
- name: CEF/Syslog
267266
items:
267+
- name: CEF/Syslog options
268+
href: connect-cef-syslog-options.md
268269
- name: CEF via AMA
269270
href: connect-cef-ama.md
270271
- name: Syslog via AMA

‎articles/sentinel/connect-cef-syslog-options.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ In this article, you can find the relevant option for streaming and filtering lo
1717
|Scenario |Options |
1818
|---------|---------|
1919
|Are your logs in raw Syslog, in Common Event Format (CEF), or both? |• [Syslog](connect-syslog.md)<br>• [CEF](connect-cef-ama.md)<br>• [CEF and Syslog](connect-cef-syslog.md) |
20-
|Are you sending logs to Microsoft Sentinel directly from your device/appliance, or via a log forwarder? |**Send logs directly via CEF**:<br>• To send logs directly with the [new AMA connector](connect-cef-ama.md), skip the Configure a log forwarder step.<br> • To send logs directly via CEF with the [legacy connector](connect-common-event-format.md), skip the Designate a log forwarder and install the Log Analytics agent step.<br><br>**Send logs [directly via Syslog](connect-syslog.md)**<br><br>**[Configure a log forwarder](connect-log-forwarder.md)** |
21-
|Are you sending logs using the new Azure Monitor agent (AMA) or the legacy Log Analytics agent? |**CEF**:<br>• [New AMA connector](connect-cef-ama.md)<br>• [legacy agent](connect-common-event-format.md)<br><br>**Syslog**:<br>• To ingest logs over Syslog with the AMA, [create a DCR](/azure-monitor/essentials/data-collection-rule-structure).<br>• Ingest logs via the [legacy agent](connect-common-event-format.md). |
20+
|Are you sending logs to Microsoft Sentinel directly from your device/appliance, or via a log forwarder? |**Send logs directly via CEF**:<br><br>• To send logs directly with the [new AMA connector](connect-cef-ama.md), skip the Configure a log forwarder step.<br> • To send logs directly via CEF with the [legacy connector](connect-common-event-format.md), skip the Designate a log forwarder and install the Log Analytics agent step.<br><br>**Send logs [directly via Syslog](connect-syslog.md)**<br><br>**[Configure a log forwarder](connect-log-forwarder.md)** |
21+
|Are you sending logs using the new Azure Monitor agent (AMA) or the legacy Log Analytics agent? |**CEF**:<br>• [New AMA connector](connect-cef-ama.md)<br>• [Legacy agent](connect-common-event-format.md)<br><br>**Syslog**:<br>• To ingest logs over Syslog with the AMA, [create a DCR](../azure-monitor/essentials/data-collection-rule-structure.md).<br>• Ingest logs via the [legacy agent](connect-common-event-format.md). |
2222

2323
## Next steps
2424

‎articles/sentinel/connect-cef-syslog.md

Lines changed: 72 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ ms.author: lwainstein
1010

1111
# Stream logs in both the CEF and Syslog format
1212

13-
This article describes how to stream and filter logs in both the CEF and Syslog format to your Microsoft Sentinel workspace from multiple on-premises appliances. This process is relevant when your organization uses different appliances that ingest logs over both CEF and Syslog, and you want to ingest both types of data without duplications.
13+
This article describes how to stream and filter logs in both the CEF and Syslog format to your Microsoft Sentinel workspace from multiple on-premises appliances. If your organization uses some appliances that ingest logs over CEF and other appliances that ingest logs over Syslog, you can use this process to ingest both types of data without duplications.
1414

15-
During this process, you use the Azure Monitor Agent (AMA), which uses Data Collection Rules (DCRs). With DCRs, you can filter the logs before they're ingested, for quicker upload, efficient analysis, and querying. Data Collection Rules (DCRs) to filter the logs before they're ingested, for quicker upload, efficient analysis, and querying.
15+
During this process, you use the Azure Monitor Agent (AMA) and Data Collection Rules (DCRs). With DCRs, you can filter the logs before they're ingested, for quicker upload, efficient analysis, and querying. Data Collection Rules (DCRs) to filter the logs before they're ingested, for quicker upload, efficient analysis, and querying.
1616

1717
> [!IMPORTANT]
1818
>
@@ -34,14 +34,14 @@ Before you begin, verify that you have:
3434

3535
## Separate your facilities
3636

37-
To avoid data duplication, each DCR you configure in the next steps uses a separate facility for CEF and Syslog. To ensure that data isn't duplicated, make sure that the appliance that sends Syslog data and the appliance that sends CEF data do so on different facilities, for example `local1` ad `local2`.
37+
To avoid data duplication, make sure that the appliance that sends Syslog data and the appliance that sends CEF data do so on different facilities, for example `local1` ad `local2`. Make sure that each DCR you configure in the next steps uses the relevant facility for CEF or Syslog respectively.
3838

3939
## Create a DCR for your CEF logs
4040

41-
- Create the DCR: via the UI:
41+
- Create the DCR via the UI:
4242
1. [Open the connector page and create the DCR](connect-cef-ama.md#open-the-connector-page-and-create-the-dcr).
43-
1. [Define resources (VMs)](connect-cef-ama.md#define-resources-vms)
44-
1. [Select the data source type and create the DCR](connect-cef-ama.md#select-the-data-source-type-and-create-the-dcr)
43+
1. [Define resources (VMs)](connect-cef-ama.md#define-resources-vms).
44+
1. [Select the data source type and create the DCR](connect-cef-ama.md#select-the-data-source-type-and-create-the-dcr).
4545

4646
> [!NOTE]
4747
> **Using the same machine to forward both plain Syslog *and* CEF messages**
@@ -50,17 +50,17 @@ To avoid data duplication, each DCR you configure in the next steps uses a separ
5050
>
5151
> On each source machine that sends logs to the forwarder in CEF format, you must edit the Syslog configuration file to remove the facilities that are being used to send CEF messages. This way, the facilities that are sent in CEF won't also be sent in Syslog.
5252
53-
1. [Run the installation script](connect-cef-ama.md)
53+
1. [Run the installation script](connect-cef-ama.md).
5454

5555
- Create the DCR via the API:
56-
1. [Create the request URL and header](connect-cef-ama.md#request-url-and-header)
57-
1. [Create the request body](connect-cef-ama.md#request-body)
56+
1. [Create the request URL and header](connect-cef-ama.md#request-url-and-header).
57+
1. [Create the request body](connect-cef-ama.md#request-body).
5858

59-
See [examples of facilities and log levels sections](connect-cef-ama.md#examples-of-facilities-and-log-levels-sections).
59+
See [examples of facilities and log levels sections](connect-cef-ama.md#examples-of-facilities-and-log-levels-sections).
6060

6161
## Create a DCR for your Syslog logs
6262

63-
Create the DCR for your Syslog logs using the [guidelines](/azure-monitor/essentials/data-collection-rule-overview) and [structure](/azure-monitor/essentials/data-collection-rule-structure). Review the [best practices](/azure-monitor/essentials/data-collection-rule-best-practices) if needed.
63+
Create the DCR for your Syslog-based logs using the Azure Monitor [guidelines](../azure-monitor/essentials/data-collection-rule-overview) and [structure](../azure-monitor/essentials/data-collection-rule-structure). Review the [best practices](../azure-monitor/essentials/data-collection-rule-best-practices) if needed.
6464

6565
## Create a DCR for both Syslog and CEF logs
6666

@@ -83,73 +83,73 @@ Create the DCR for your Syslog logs using the [guidelines](/azure-monitor/essent
8383
- Add the filter and facility log levels in the `facilityNames` and `logLevels` parameters.
8484

8585
```rest
86-
{
87-
"properties": {
88-
"immutableId": "dcr-c7847b758fb0484b88b51c5d907796a6",
89-
"dataSources": {
90-
"syslog": [
91-
{
92-
"streams": ["Microsoft-Syslog"],
93-
"facilityNames": ["auth"],
94-
"logLevels": [
95-
"Info",
96-
"Notice",
97-
"Warning",
98-
"Error",
99-
"Critical",
100-
"Alert",
101-
"Emergency"
102-
],
103-
"name": "sysLogsDataSource--1469397783"
86+
{
87+
"properties": {
88+
"immutableId": "dcr-c7847b758fb0484b88b51c5d907796a6",
89+
"dataSources": {
90+
"syslog": [
91+
{
92+
"streams": ["Microsoft-Syslog"],
93+
"facilityNames": ["auth"],
94+
"logLevels": [
95+
"Info",
96+
"Notice",
97+
"Warning",
98+
"Error",
99+
"Critical",
100+
"Alert",
101+
"Emergency"
102+
],
103+
"name": "sysLogsDataSource--1469397783"
104+
},
105+
{
106+
"streams": ["Microsoft-CommonSecurityLog"],
107+
"facilityNames": [
108+
"local4"
109+
],
110+
"logLevels": [
111+
"Warning"
112+
],
113+
"name": "sysLogsDataSource-1688419672"
114+
}
115+
]
104116
},
105-
{
106-
"streams": ["Microsoft-CommonSecurityLog"],
107-
"facilityNames": [
108-
"local4"
109-
],
110-
"logLevels": [
111-
"Warning"
112-
],
113-
"name": "sysLogsDataSource-1688419672"
114-
}
115-
]
116-
},
117-
"destinations": {
118-
"logAnalytics": [
119-
{
120-
"workspaceResourceId": "/subscriptions/<sub-id>/resourceGroups/<resourceGroup>/providers/Microsoft.OperationalInsights/workspaces/<WS>",
121-
"workspaceId": "<WS-ID>",
122-
"name": "la--591870646"
123-
}
124-
]
125-
},
126-
"dataFlows": [
127-
{ "streams": ["Microsoft-Syslog", "Microsoft-CommonSecurityLog"], "destinations": ["la--591870646"] }
128-
],
129-
"provisioningState": "Succeeded"
130-
},
131-
"location": "eastus",
132-
"tags": {},
133-
"kind": "Linux",
134-
"id": "/subscriptions/<sub-id>/resourceGroups/<resourceGroup>/providers/Microsoft.Insights/dataCollectionRules/<DCR-Name>",
135-
"name": "<DCR-Name>",
136-
"type": "Microsoft.Insights/dataCollectionRules",
137-
"etag": "\"6d00bdde-0000-0100-0000-62c177f70000\"",
138-
"systemData": {
139-
"createdBy": someuser@microsoft.com,
140-
"createdByType": "User",
141-
"createdAt": "2022-07-03T11:05:27.2454015Z",
142-
"lastModifiedBy": someuser@microsoft.com,
143-
"lastModifiedByType": "User",
144-
"lastModifiedAt": "2022-07-03T11:05:27.2454015Z"
145-
}
146-
}
117+
"destinations": {
118+
"logAnalytics": [
119+
{
120+
"workspaceResourceId": "/subscriptions/<sub-id>/resourceGroups/<resourceGroup>/providers/Microsoft.OperationalInsights/workspaces/<WS>",
121+
"workspaceId": "<WS-ID>",
122+
"name": "la--591870646"
123+
}
124+
]
125+
},
126+
"dataFlows": [
127+
{ "streams": ["Microsoft-Syslog", "Microsoft-CommonSecurityLog"], "destinations": ["la--591870646"] }
128+
],
129+
"provisioningState": "Succeeded"
130+
},
131+
"location": "eastus",
132+
"tags": {},
133+
"kind": "Linux",
134+
"id": "/subscriptions/<sub-id>/resourceGroups/<resourceGroup>/providers/Microsoft.Insights/dataCollectionRules/<DCR-Name>",
135+
"name": "<DCR-Name>",
136+
"type": "Microsoft.Insights/dataCollectionRules",
137+
"etag": "\"6d00bdde-0000-0100-0000-62c177f70000\"",
138+
"systemData": {
139+
"createdBy": someuser@microsoft.com,
140+
"createdByType": "User",
141+
"createdAt": "2022-07-03T11:05:27.2454015Z",
142+
"lastModifiedBy": someuser@microsoft.com,
143+
"lastModifiedByType": "User",
144+
"lastModifiedAt": "2022-07-03T11:05:27.2454015Z"
145+
}
146+
}
147147
```
148148
1. After you finish editing the template, use `POST` or `PUT` to deploy it:
149149

150150
```rest
151151
PUT
152-
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dataCollectionRuleName}?api-version=2019-11-01-preview
152+
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dataCollectionRuleName}?api-version=2019-11-01-preview
153153
```
154154

155155
See [examples of facilities and log levels sections](connect-cef-ama.md#examples-of-facilities-and-log-levels-sections).

0 commit comments

Comments
 (0)