Log/syslog forwarding to Microsoft Azure/Sentinel

dmoore-acc360 — Fri, 06 May 2022 22:08:54 GMT

Entire company uses log analytics and Sentinel for logging.

Found this excellent article below on how to accomplish this task.

https://davicruz.com/en-US/azure-sentinel/2021/03/rsyslog-sentinel-log-forwarder

Has anyone done this before?

I have stand-alone PA's that are now dumping sylog to Splunk.

Splunk is being replaced with log analytics.

Thanks

Re: Log/syslog forwarding to Microsoft Azure/Sentinel

aleksandar.astardzhiev — Mon, 09 May 2022 21:43:30 GMT

Hi @dmoore-acc360 ,

I would assume that you have figured out how to setup the collector - Enabling the connector in AZ Sentinel should give you all the steps of installing and preparing the syslog listener.

From firewall prespective you need first to create Syslog profile with customized formatting. Because Sentinel expect CEF, you need to tell the firewall to use CEF for each log type (that you want to forward to Sentinel).

On the following link you will find documentation how to define CEF format for each log type based on PanOS version. - https://docs.paloaltonetworks.com/resources/cef

I have notice some issues with 9.1, which I have described here - https://live.paloaltonetworks.com/t5/globalprotect-discussions/pan-os-9-1-globalprotect-cef-format/m-p/475444#M2620

topic Log/syslog forwarding to Microsoft Azure/Sentinel in General Topics

Log/syslog forwarding to Microsoft Azure/Sentinel

Re: Log/syslog forwarding to Microsoft Azure/Sentinel