can I configure multiple data connectors on the same linux cef forwarder?

Question

can I configure multiple data connectors on the same linux cef forwarder?

Georges Hayek 46

Hello,

I want to configure different data connectors with the same database table (CommonSecurityLogs). However, for a different data connector. is it feasible?

It will be appreciated if someone can help me with this.

Thank you,

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-07-31T19:01:53.8866667+00:00

@Georges Hayek

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

1 answer

Your answer

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-07-31T19:01:53.8866667+00:00

@Georges Hayek

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Hello @Georges Hayek ,

Welcome to Microsoft Q&A again and thank you for posting your questions here.

For a clarity, you were asking, if possible and if it is feasible for you to configure multiple data connectors on the same linux cef forwarder,

Absolutely Yes! Using multiple data connectors for a table required more work out-of-the-box experience. To start with if you will want to forward multiple logs to Microsoft Sentinel workspace for the purpose of CEF forwarder.

You'll need to designate and configure a Linux machine that will collect the logs from your devices and forward them to your Microsoft Sentinel workspace. This machine can be a physical or virtual machine in your on-premises environment, an Azure VM, or a VM in another cloud. This machine has two components that take part in this process: A syslog daemon, either rsyslog or syslog-ng, that collects the logs. The Log Analytics Agent (also known as the OMS Agent), that forwards the logs to Microsoft Sentinel.

Also, to configure multiple data connectors for a table, you can use Excel to create and edit connections to external data sources that are stored in a workbook or in a connection file. You can easily manage these connections, including creating, editing, and deleting them using the current Queries & Connections pane or the Workbook Connections dialog box (available in previous versions)

The best examples are discussed in the following links:

I hope this is helpful! You can vote for this answer if you found it useful.

PS: Do not hesitate to let me know if you have any other questions.

Best Regards,

Sina Salam

Georges Hayek 46 Reputation points

2023-07-27T10:29:54.79+00:00

it is possible to use the same port 514 during collecting data from multiple syslog devices through rsyslog.

can you help me with the configuration? I am gathering logs from different firewall vendors. do I need to change the receiving port 514?

Regards,
Sina Salam 22,031 Reputation points Volunteer Moderator

2023-07-27T13:55:21.1466667+00:00

Hello

Thank you for asking more questions.

You can configure the built-in Linux Syslog daemon (rsyslog.d/syslog-ng) for the following purposes: listening for Syslog messages from your security solutions on TCP port 514 forwarding only the messages it identifies as CEF to the Log Analytics agent on localhost using TCP port 25226.

Each data connector will have its own set of prerequisites, such as required permissions on your Azure workspace, subscription, or policy, and so on, or other requirements for the partner data source you're connecting to. Prerequisites for each data connector are listed on the relevant data connector page in Microsoft Sentinel, on the Instructions tab.

I hope this helps!

Regards,

Sina Salam

Share via

can I configure multiple data connectors on the same linux cef forwarder?

1 answer

Your answer