|
1 | | -You need to designate and configure a Linux machine to forward the logs from your security solution to your Microsoft Sentinel workspace. This machine can be physical or virtual in your on-premises environment, an Azure VM, or a VM in another cloud. Using the link provided, you'll run a script on the designated machine that performs the following tasks: |
| 1 | +You need to designate and configure a Linux machine to forward logs from your security solution to your Microsoft Sentinel workspace. This machine can be physical or virtual in your on-premises environment, an Azure VM, or a VM in another cloud. |
2 | 2 |
|
3 | | -Installs the Log Analytics agent for Linux (also known as the OMS agent) and configures it for the following purposes: |
| 3 | +The **Common Event Format (CEF) via AMA** connector uses a **Data Collection Rule (DCR)** to configure the **Azure Monitor Agent (AMA)** on your Linux forwarder. AMA handles both agent installation and log forwarding — no manual script installation is required. |
4 | 4 |
|
5 | | -- Listening for CEF messages from the built-in Linux Syslog daemon on TCP port 25226 |
| 5 | +When configured, AMA on the Linux forwarder: |
6 | 6 |
|
7 | | -- Sending the messages securely over TLS to your Microsoft Sentinel workspace, where they're parsed and enriched |
| 7 | +- Listens for CEF messages from the built-in Linux Syslog daemon on TCP port 514 |
| 8 | +- Forwards CEF messages to your Microsoft Sentinel workspace, where they're parsed and enriched |
8 | 9 |
|
9 | | -Configures the built-in Linux Syslog daemon (rsyslog.d/syslog-ng) for the following purposes: |
| 10 | +## Set up the CEF via AMA connector |
10 | 11 |
|
11 | | -- Listening for Syslog messages from your security solutions on TCP port 514 |
| 12 | +To configure the connector: |
12 | 13 |
|
13 | | -- Forwarding only the messages it identifies as CEF to the Log Analytics agent on localhost using TCP port 25226 |
| 14 | +1. In the Microsoft Sentinel portal, select **Data connectors**. |
14 | 15 |
|
15 | | -## Run the deployment script |
| 16 | +1. Search for and select **Common Event Format (CEF) via AMA**. |
16 | 17 |
|
17 | | -To view the connector page: |
| 18 | +1. Select **Open connector page** on the details pane. |
18 | 19 |
|
19 | | -1. Select Data connectors page. |
| 20 | +1. Under **Configuration**, select **+Create data collection rule**. |
20 | 21 |
|
21 | | -1. Select Common Event Format (CEF). |
| 22 | +1. On the **Basic** tab, enter a name for the data collection rule, then select your subscription and resource group. |
22 | 23 |
|
23 | | -1. select the Open connector page on the preview pane. |
| 24 | +1. On the **Resources** tab, select the Linux machine you designated as the log forwarder. |
24 | 25 |
|
25 | | -1. Verify that you have the appropriate permissions as described under Prerequisites. |
| 26 | +1. On the **Collect** tab, confirm the CEF facility and log level settings. |
26 | 27 |
|
27 | | -1. Copy the "sudo wget …" command and run with elevated permissions on the dedicated Linux VM. |
| 28 | +1. Select **Review + create**, then select **Create**. AMA is automatically installed on the Linux forwarder if it isn't already present. |
28 | 29 |
|
29 | | -:::image type="content" source="../media/common-event-format-connector.png" alt-text="Screenshot of the C E F Connector Page." lightbox="../media/common-event-format-connector.png"::: |
| 30 | +1. Configure each network appliance to forward its syslog events to your Linux forwarder on UDP or TCP port 514. |
30 | 31 |
|
31 | | -### Using the same machine to forward both plain Syslog and common event format messages |
| 32 | +:::image type="content" source="../media/common-event-format-connector.png" alt-text="Screenshot of the Common Event Format via AMA connector page in Microsoft Sentinel." lightbox="../media/common-event-format-connector.png"::: |
32 | 33 |
|
33 | | -If you plan to use this log forwarder machine to forward Syslog messages as CEF, then to avoid the duplication of events to the Syslog and CommonSecurityLog tables: |
| 34 | +## Use the same machine to forward both plain Syslog and CEF messages |
34 | 35 |
|
35 | | -On each source machine that sends logs to the forwarder in CEF format, you must edit the Syslog configuration file to remove the facilities used to send CEF messages. |
| 36 | +If you plan to use this log forwarder machine to forward both plain Syslog messages and CEF messages, edit the Syslog configuration file on each source machine that sends logs in CEF format. Remove the facilities used to send CEF messages to avoid duplicate events in the Syslog and CommonSecurityLog tables. |
36 | 37 |
|
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments