Azure Monitor - Security Logs to Log Analytics

Question

Azure Monitor - Security Logs to Log Analytics

Sumeetha Mogasati 126

Hi,

The solution requirement is to store Audit Logs (Security logs) from the Azure Monitor in Azure Log Analytics.

After installing an agent for Azure Monitor and checking the collected logs, it is understood that Security logs are not captured/collected. Azure processes Security Logs through satellite or Windows Defender. It is feasible to process the logs locally on the file server but requires a 3rd party application, which involves cost, licensing, etc.

Currently, there is no native support from Azure Monitor for Security Logs.

Help appreciated meeting the above requirements natively without using any 3rd party services.

Thanks,

Accepted answer

0 additional answers

Your answer

Answer 1

Andrew Blumhardt 10,051 Microsoft Employee

Log Analytics does not support Windows security event log collection (when using the MMA agent). It is not listed in the custom event log collection list. At least not using the MMA agent directly. You need to use Defender for Cloud or Sentinel for security event collection. Though it appears that the new Data Collection Rules used with the new AMA agent do allow security event collection as well.

Sumeetha Mogasati 126 Reputation points

2022-03-27T18:31:31.393+00:00

Hi Andrew,

Thanks for your help.

Can you elaborate the Data Collection Rules with the new AMA agent option with relevant resources/urls, please?

Thanks,
Andrew Blumhardt 10,051 Reputation points Microsoft Employee

2022-03-27T19:45:02.93+00:00

Try this: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-overview
Sumeetha Mogasati 126 Reputation points

2022-03-28T11:26:57.03+00:00

Thanks, Andrew for your help and insight.

Please note that the required logs are for the 'File Access' on the VM.

Regards
Andrew Blumhardt 10,051 Reputation points Microsoft Employee

2022-03-30T01:01:03.44+00:00

File access is recorded by the Windows audit policy as event 4663. That is part of the minimal security event collection. Assuming the audit policy is enabled the event can be collected with the methods described above.

https://morgantechspace.com/2014/11/How-to-monitor-or-track-File-Access-in-Windows.html

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects

https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference

Share via

Azure Monitor - Security Logs to Log Analytics

0 additional answers

Your answer