Share via

Ingesting Audit and security logs from Azure security center to Sumo logic

Ponugoti Narendra 41 Reputation points
2021-05-23T16:56:45.007+00:00

we are in azure platform monitoring cloud assets through azure security center. We are planning to ingest some important log sources from azure to Sumo logic .I am searching on some important audit and security logs from azure. If any one have any inputs Please share

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Sentinel
0 comments
Accepted answer
  1. VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee
    2021-05-24T03:51:46.453+00:00

    @Ponugoti Narendra Thanks for reaching out.

    Azure monitor is the service which is used to collect the security logs across Azure Services. These data are streamed to Azure Event hub,
    You can create a Azure Function which can be triggered by Event hub to send logs to Sumo HTTP source.

    The setup would look something like this :

    98943-image.png

    You can follow this for the setup : https://help.sumologic.com/03Send-Data/Collect-from-Other-Data-Sources/Azure_Monitoring/Collect_Logs_from_Azure_Monitor

    -----------------------------------------------------------------------------------------------------------------

    If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.