Azure Sentinel IP for WEST EUROPE

Question

Azure Sentinel IP for WEST EUROPE

MS Techie 2,751

Azure VM is protected by Sentinel

i need to find Azure Sentinel IPs . The intent is to whitelist these IPs from the Azure VM outbound IP

1 answer

Your answer

Answer 1

Stanislav Zhelyazkov 28,596 MVP Volunteer Moderator

Hi,
If you talking about the Log Analytics agent that is used by Azure Sentinel the firewall requirements are here. It is DNS records, not IPs as IPs change over time. For Azure VM it is better to use service tags. There is service tag for Azure Monitor. Read the documentation for it. Log Analytics is part of Azure Monitor and Azure Sentinel uses Log Analytics as platform for logs.

For qualys extension there is no Service Tag. The communication of the extension is available here. You will need to open to specific DNS records https://qagpublic.qg3.apps.qualys.com - Qualys' US data center, https://qagpublic.qg2.apps.qualys.eu - Qualys' European data center rather IPs. Both for port 443.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2021-11-29T18:45:47.99+00:00

@MS Techie
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
MS Techie 2,751 Reputation points

2021-11-30T17:49:28.553+00:00

Hi,
.in Azure service tag, I don't see the option for Azure Sentinel. So what option should I use in service tag to allow azure Sentinel to be connected to azure VM

2) What IP or dns should allow to connect from Azure vm to qualys deployed in azure
Stanislav Zhelyazkov 28,596 Reputation points MVP Volunteer Moderator

2021-12-01T07:39:45.17+00:00

Hi,
As mentioned: "If you talking about the Log Analytics agent that is used by Azure Sentinel the firewall requirements are here. It is DNS records, not IPs as IPs change over time. For Azure VM it is better to use service tags. There is service tag for Azure Monitor. Read the documentation for it. Log Analytics is part of Azure Monitor and Azure Sentinel uses Log Analytics as platform for logs." so the tag is Azure Monitor.
For qualys extension there is no Service Tag. The communication of the extension is available here. You will need to open to specific DNS records https://qagpublic.qg3.apps.qualys.com - Qualys' US data center, https://qagpublic.qg2.apps.qualys.eu - Qualys' European data center rather IPs. Both for port 443.

Share via

Azure Sentinel IP for WEST EUROPE

1 answer

Your answer