Share via

Microsoft Sentinel Integration with syslog server

Bhagyesh Telang 1 Reputation point
2022-01-31T11:36:30.003+00:00

I have been trying to connect a solution to syslog server and then to sentinel.
SOC solution --> Syslog Server --> Microsoft Sentinel

I have been getting the logs in Syslog server from port 6515 from the SOC solution(Log format RFC 5424), I have set the soc solution and syslog server with TLS certificates, and I am able to see the soc logs in my syslog server, But those logs are not getting forwarded to Sentinel,although the MOCK messages sent by cef_troubleshoot.py are visible in Sentinel, what could be the possible cause of this? The regex format given in security_events_config.conf file is not applicable for my logs. Kindly assist.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 7,866 Reputation points MVP Volunteer Moderator
    2023-01-30T14:43:59.6+00:00

    Have you enabled the Syslog data connector in Sentinel? Are you using MMA or AMA? https://learn.microsoft.com/en-gb/azure/azure-monitor/agents/data-sources-syslog

    1 person found this answer helpful.
    0 comments
  2. Kristian Ward 0 Reputation points
    2024-02-05T10:51:57.7266667+00:00

    If you're using the legacy MMA or LAA then you will need to go to the Log Analytics Wokspace, under Legacy Agent Management and check that the facilities that the logs are coming in on are being collected for the correct severity. If you're using rhe AMA agent you will need to check that your DCR is set to receive the facilities on thre correct severity. This will most likely be the source of your issue; if not, there may be an issue with the formatting of the syslog message.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.