Azure Firewall Logs streams to Splunk via EventHub

Question

Azure Firewall Logs streams to Splunk via EventHub

Pravendra Rajput 56

Wehave integrated Splunk with splunk app 3110 for Splunk Add-on for Microsoft Cloud Services (https://splunkbase.splunk.com/app/3110).

Created AD app, given the required permission.

Generated the secret.

created Even hub and name space

Provided role on Azure firewall to the azure AD app.

enabled and streamed logs for azure event hub,

integrated with Splunk

however still splunk is not capturing logs for azure Firewall.

Looking for immediate assistance.

PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-07-07T06:38:22.63+00:00

@Pravendra Rajput - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-07-10T05:59:45.7433333+00:00

@Pravendra Rajput - Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-07-07T06:38:22.63+00:00

@Pravendra Rajput - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-07-10T05:59:45.7433333+00:00

@Pravendra Rajput - Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

@Pravendra Rajput - Thanks for the question and using MS Q&A platform.

It seems like you have followed the correct steps to stream Azure Firewall logs to Splunk via Event Hub, but you are still not able to capture the logs in Splunk. Here are some troubleshooting steps that you can try:

Check if the Azure Firewall logs are being sent to the Event Hub. You can use the Azure Portal orcheck if the logs are being sent to the Event Hub. You can also use the Azure Event Hub Monitor tool to monitor the Event Hub and check if the logs are being received. For more details, Monitor Azure Event Hubs
Check if the Azure AD app has the correct permissions. Make sure that the Azure AD app has the necessary permissions to access the Event Hub and read the logs. You can check the permissions in the Azure Portal .
Check if the Splunk Add-on for Microsoft Cloud Services is configured correctly. Make sure that the add-on is configured correctly to receive the logs from the Event Hub.
Check if the Event Hub is configured correctly. Make sure that the Event Hub is configured correctly to send the logs to the Splunk Add-on. You can check the configuration in the Azure Portal.
Check if there are any network issues. Make sure that there are no network issues that are preventing the logs from being sent to Splunk. You can check the network configuration in the Azure Portal.

If none of the above steps work, you can share the document or steps which you have followed and along with the screenshot of monitor Azure Event Hubs for further assistance.

PRADEEPCHEEKATLA 90,651 Reputation points Moderator

2023-07-13T04:19:43.52+00:00

@SupportProfSw - Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

Azure Firewall Logs streams to Splunk via EventHub

1 answer

Your answer