JBoss Enterprise Application Platform connector for Microsoft Sentinel
The JBoss Enterprise Application Platform data connector provides the capability to ingest JBoss events into Microsoft Sentinel. Refer to Red Hat documentation for more information.
This is autogenerated content. For changes, contact the solution provider.
Connector attributes
Connector attribute | Description |
---|---|
Log Analytics table(s) | JBossLogs_CL |
Data collection rules support | Not currently supported |
Supported by | Microsoft Corporation |
Query samples
Top 10 Processes
JBossEvent
| summarize count() by ActingProcessName
| top 10 by count_
Vendor installation instructions
Note
This data connector depends on a parser based on a Kusto Function to work as expected JBossEvent which is deployed with the Microsoft Sentinel Solution.
Note
This data connector has been developed using JBoss Enterprise Application Platform 7.4.0.
- Install and onboard the agent for Linux or Windows
Install the agent on the JBoss server where the logs are generated.
Logs from JBoss Server deployed on Linux or Windows servers are collected by Linux or Windows agents.
- Configure the logs to be collected
Configure the custom log directory to be collected
- Select the link above to open your workspace advanced settings
- Click +Add custom
- Click Browse to upload a sample of a JBoss log file (e.g. server.log). Then, click Next >
- Select Timestamp as the record delimiter and select Timestamp format YYYY-MM-DD HH:MM:SS from the dropdown list then click Next >
- Select Windows or Linux and enter the path to JBoss logs based on your configuration. Example:
- Linux Directory:
Standalone server: EAP_HOME/standalone/log/server.log
Managed domain: EAP_HOME/domain/servers/SERVER_NAME/log/server.log
After entering the path, click the '+' symbol to apply, then click Next >
Add JBossLogs as the custom log Name and click Done
Check logs in Microsoft Sentinel
Open Log Analytics to check if the logs are received using the JBossLogs_CL Custom log table.
NOTE: It may take up to 30 minutes before new logs will appear in JBossLogs_CL table.
Next steps
For more information, go to the related solution in the Azure Marketplace.