Question regarding Azure Sentinel Security Logs

Shinde, Balaji 116 Reputation points
2023-03-16T17:41:29.72+00:00

Hi All,

We are using azure policy to install AMA and assign data collection rule. the Log analytic workspace is linked to the sentinel.

Now, to collect windows security logs via Sentinel connector "Windows Security Events via AMA", do we have to specify the each resource that we need to collect security logs from? Or just creating DCR and enabling data connector is enough since we are already installing AMA and DCR seperately using azure policy. Because specifying resources or subscriptions in this new DCR will be very tedious task since we have lot of exceptions etc. and it also says you must select already selected resources.

Below is the screenshot of "Windows Security Events via AMA" DCR page.

SentinelDCR

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
Accepted answer
  1. Patchfox 3,376 Reputation points
    2023-03-16T21:01:13.84+00:00

    Hi Shinde, Balaji, I want to help you with this question.

    Yes, you need to select all possible resources in the settings mask shown, which will be linked to azure sentinal via the respective dcr.

    However, my recommendation is not to do this directly in the dcr configuration, as not all scopes (.e.g management groups etc). can be selected. So the scalability lacks here.

    The better alternative is to use the policy set "Deploy Windows Azure Monitor Agent with user-assigned managed identity-based auth and associate with Data Collection Rule". It is a builtIn PolicySet and configures the non compliant VMs to link to the defined dcr.

    If the reply was helpful, please don’t forget to upvote or accept it as an answer, thank you.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrew Blumhardt 9,491 Reputation points Microsoft Employee
    2023-03-20T02:17:13.63+00:00

    You can target the rule to a subscription or resource group.

    The data connectors create special DCR rule that sends these events to the SecurityEvents table. A standard DCR rules sends events to the Events table unless you use a transformation to redirect this to SecurityEvents. Note that URBA and all of the rules and workbooks in Sentinel are looking at SecurityEvents not Events.

    0 comments