Can we send logs to Microsoft Sentinel through private network?

Question

Can we send logs to Microsoft Sentinel through private network?

Anusree Pal 0

Hi Everyone,

Is it possible to send the logs from on-prem server to sentinel through a private connection? We were trying to get the logs via private link for azure arc and azure monitor data collection endpoint. Is it even feasible??

Paul Promise Dzahini 200 Reputation points

2023-12-22T13:09:54.3366667+00:00
Here are some possible options:
https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/forward-on-premises-windows-security-event-logs-to-microsoft/ba-p/3040784

If you want to forward Windows security event logs, you can use Windows Event Forwarding (WEF) to collect the logs from your on-premises Windows machines and forward them to Microsoft Sentinel using Azure Arc and the Log Analytics agent1.

If you want to ingest Syslog and CEF logs, you can designate and configure a Linux machine that will collect the logs from your devices and forward them to Microsoft Sentinel using the Log Analytics agent 2. Note that the Log Analytics agent will be retired on 31 August, 2024 and you will need to migrate to the Azure Monitor Agent (AMA) for Microsoft Sentinel2.

"if it helps please accept it so others can references it.

1 answer

Your answer

Paul Promise Dzahini 200 Reputation points

2023-12-22T13:09:54.3366667+00:00

Here are some possible options:
https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/forward-on-premises-windows-security-event-logs-to-microsoft/ba-p/3040784

If you want to forward Windows security event logs, you can use Windows Event Forwarding (WEF) to collect the logs from your on-premises Windows machines and forward them to Microsoft Sentinel using Azure Arc and the Log Analytics agent1.

If you want to ingest Syslog and CEF logs, you can designate and configure a Linux machine that will collect the logs from your devices and forward them to Microsoft Sentinel using the Log Analytics agent 2. Note that the Log Analytics agent will be retired on 31 August, 2024 and you will need to migrate to the Azure Monitor Agent (AMA) for Microsoft Sentinel2.

"if it helps please accept it so others can references it.

Answer 1

JamesTran-MSFT 36,911 Microsoft Employee Moderator

@Pal, Anusree (External)

Thank you for your post!

When it comes to the Microsoft Sentinel side of things, it is possible to send logs from an on-premises server to Microsoft Sentinel through a private connection. To do this, you can use Azure Private Link to connect networks to Azure Monitor, which will then connect to your respective Log Analytics workspaces / Microsoft Sentinel.

For more info - Architectural Guidance – Azure Monitor private links with Microsoft Sentinel User's image

Additional Links:

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Anusree Pal 0 Reputation points

2023-12-23T06:14:03.45+00:00

Hi,

i have tried creating a privatelink for azure monitor.. do i have to enable the private endpoint for Azure arc as well?
Anusree Pal 0 Reputation points

2023-12-23T06:40:35.0533333+00:00

hi and also how can i connect from on-prem to to azure vnet privately? without using vpn s2s??
Rohit Mukherjee 0 Reputation points

2023-12-23T06:46:54.88+00:00
@JamesTran-MSFT

Thanks for the architectural diagram and the links. We have already gone through them while we are configuring it.

Could you please help us get the below resolution:

Sending the traffic from on-premise to Azure in a private network, which will further send the logs to sentinel via arc

The on-premise server is not domain joined, so what is the other method of connecting on-prem to azure log analytic workspace
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2024-01-03T21:49:38.4433333+00:00
Thank you both for following up on this and I apologize for the delayed response!

I'm not too familiar with Azure Arc or Private Link, but to ensure you receive clear and helpful answers to your questions, I'd recommend posting these individually within the respective communities.

Azure Arc Q&A Community

Azure Private Link

Azure Monitor

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Share via

Can we send logs to Microsoft Sentinel through private network?

1 answer

Your answer