Share via

What is the best way to ingest custom syslog data into Sentinel?

Nirali Shah 156 Reputation points
2023-03-08T12:40:20.1733333+00:00

We have a use case to collect syslog data from a custom source and ingest into Sentinel. I got to know about Syslog DataConnector from here and referred its official Microsoft document which describes to use Log analytics agent(OMS agent) but from this document and other Microsoft document only I came to know about deprecation of Log analytic agent by 2024.

So, now Can you please suggest the best way to use for ingesting syslog data into sentinel received via custom syslog source and which can be certified by Microsoft to make it available on Microsoft Sentinel Repository?

Microsoft Security Microsoft Sentinel

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 7,866 Reputation points MVP Volunteer Moderator
    2023-03-08T12:59:30.1566667+00:00

    Hello,

    Please see the AMA that replaces the MMA: https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-ama This solution is available in the Portal (as a preview). If a preview isn't suitable then you can use the MMA option "legacy agent" until then.

    User's image

    If this helps, please "accept" the answer

  2. Bill Clarkson-Antill 15 Reputation points MVP
    2023-03-14T20:14:27.39+00:00

    @Nirali Shah A syslog forwarder or Logstash forwarder are solid ways to push data into Sentinel for CEF/Syslog type. Logstash is almost the preferred way due to the data transformation feature you can leverage on Logstash, it has some really useful features where you can shape and drop logs that you simply don't need.

    See reference below

    https://learn.microsoft.com/en-us/azure/sentinel/connect-logstash-data-connection-rules

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.