Injecting Cisco Meraki logs to Azure Sentinel

Sing Kit Cheng 46 Reputation points
2021-04-14T19:12:48.07+00:00

Hello Everyone,

I would like to inject logs from our Meraki devices into Azure Sentinel. From everything I've read, a Linux syslog server is needed to act as a log collector/forwarder to collect logs from the Meraki devices and then forward them to Sentinel.

I've built a Linux Ubuntu vm in Azure. I've also connected the Linux vm to Azure Sentinel connector. I've also installed the Azure monitoring agent on the Linux server.

I have some questions:

  1. what do I need to do on the Linux server to make sure that it is collecting logs from the Meraki devices
  2. how do I check to see if the logs are coming in to the Linux server
  3. how do I see the logs in Azure Sentinel

I am not a Linux guy at all so detail step by step instructions will be greatly appreciated here.

Thank you in advance.
Kit Cheng

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
986 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson - MSFT 106 Reputation points
    2021-04-15T11:13:22.733+00:00

    Please see instructions at: Azure Sentinel Grand List

    1. You will see the Logs in the Logs Blade within Azure Sentinel in the Syslog table. https://learn.microsoft.com/en-us/azure/sentinel/connect-syslog
  2. Clive Watson - MSFT 106 Reputation points
    2021-04-15T16:17:15.797+00:00

    Hi Kit, The Log collector (syslog server) will have (or need to have) the Azure Sentinel agent installed on it and that would be configured to send the data to Log Analytics / Azure Sentinel, which you have already done.

    The most simple way and mainly using the UI to query the data, is to Open the Logs blade, Double Click on Syslog (under the "LogsManagement" folder, and then press Run

    88259-screenshot-2021-04-15-170548.jpg

    Any (working) agent will also write to the Heartbeat Table, once again in the Logs Blade again you can paste this query and press run. You should be able to see your Linux server in the list and it will show the last record received. If you don't, then it means no data has been sent from the Linux server to Azure Sentinel yet.

    Heartbeat
    | where OSType == "Linux"
    | summarize arg_max(TimeGenerated,*) by Computer

    A lot of queries can be written without knowing the code language and using the UI, but we can discuss that, when you have data in the Syslog table.

  3. Clive Watson - MSFT 106 Reputation points
    2021-04-16T13:48:12.637+00:00

    Have you checked Syslog or the required facility is enabled for collection (the only Facility I see in your screen shot is authpriv, but that maybe just the snapshot you are showing)?
    https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog#configure-syslog-in-the-azure-portal

  4. Sing Kit Cheng 46 Reputation points
    2021-04-20T15:55:37.417+00:00

    Hi CliveWatson-3295,

    I called Microsoft and followed an article they provided to create a custom log and now I am able to see the logs that I was looking for. Here's the article in case anyone needs it - Collect custom logs with Log Analytics agent in Azure Monitor - Azure Monitor | Microsoft Learn

    Thanks for your help.
    Kit

    0 comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more