how to Deploy Sysmon To Receive Logs In Azure Sentinel?

Question

how to Deploy Sysmon To Receive Logs In Azure Sentinel?

Shital Khatri - AzureAdmin 101

Ravi Pandey 0 Reputation points

2024-06-25T12:39:46.2033333+00:00
You mention MMA this is inaccurate since its replaced with AMA.

Couple of questions:

Is there specific Data Connector?

Sysmon logs with their own unique Event IDs is there configuration to apply where Windows Event IDs are retained. This is where things get confusing as coreleation searches are dependent upon Windows Event IDs not Sysmon. Searchihng for 1 to 1 relatable Events that match Sysmon Event ID 1 is equal to Windows Event ID 4662 is pain in the rear if you ask me.

Accepted answer

0 additional answers

Your answer

Ravi Pandey 0 Reputation points

2024-06-25T12:39:46.2033333+00:00

You mention MMA this is inaccurate since its replaced with AMA.

Couple of questions:

Is there specific Data Connector?

Sysmon logs with their own unique Event IDs is there configuration to apply where Windows Event IDs are retained. This is where things get confusing as coreleation searches are dependent upon Windows Event IDs not Sysmon. Searchihng for 1 to 1 relatable Events that match Sysmon Event ID 1 is equal to Windows Event ID 4662 is pain in the rear if you ask me.

Answer 1

@Shital Khatri - AzureAdmin Thanks for reaching out.

Sysmon tool can be deployed by using group policy if you have a local AD setup, if you manage them using Intune, You can use Intune to setup the Sysmon on devices.
Followed by MMA agent which will pick all these information from the machine and send it upto the Log analytic workspace where Sentinel is enabled.

A more detailed approach with step by step instructions can be found at : https://m365internals.com/2021/05/17/how-to-deploy-sysmon-and-mma-agent-to-receive-logs-in-azure-sentinel/

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Share via

how to Deploy Sysmon To Receive Logs In Azure Sentinel?

0 additional answers

Your answer