Arc Private Link Scope and AMPLS

Question

Has anyone had any luck getting logs sent over AMPLS to Sentinel with the Security Events via AMA connector? I have tested and validated DNS entries on my Arc servers, but I despite the DCR being up and AMPLS being fully configured I am still not receiving logs on Sentinel.

Does the Security Events via AMA connector support AMPLS?

Answer 1

Hi @Patrick M. Williams ,

Thank you for reaching out to Microsoft Q&A for this question.

As mentioned in the link below, the Azure Monitor Agent supports AMPLs using Data Collection endpoints - Azure Monitor Private Links requirement

Also, the Log Analytics workspace forms the data store for monitoring data collected through AMA OR Log Analytics agent for Microsoft Sentinel. Therefore, please check that the data is getting ingested to Log Analytics workspace from the specified Arc-enabled machine. You can use the query below to get the latest data in there:

union *   
| order by TimeGenerated  desc  

Note that the output would contain column Type which would show the type of data being ingested. Furthermore, I am including high level steps/suggestions below that should help troubleshoot this issue:

1. Ensure that the steps here were followed and the machine is onboarded to Azure Arc - Planning your Private Link setup

2. Configure Azure Monitor Private Link and ensure the log analytics workspace is connected to this AMPLS.

3. Review and validate your Private Link setup

4. Finally, the Azure Monitor Agent uses Data Collection endpoint for secure communication with Log Analytics Workspace. Ensure that is created and used when creating the Data Collection rule, as mentioned here - Private link configuration using data collection endpoints

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Answer 2

My issue lied with the fact that DCE's create another DNS entry in your Private DNS that needs to be added to your on prem DNS server. IMO this article(https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal#private-link-configuration-using-data-collection-endpoints) should mention that. I believe I found the DNS information in a general article about DCEs.