Share via

Sending syslog from windows syslog server running kiwi

Yash 21 Reputation points
2022-03-01T15:24:22.727+00:00

We currently having a windows syslog server running Kiwi syslog. Rather than creating a new VM, I would like to use this server to forward the logs to Azure Sentinel. Is this possble?
It looks like the agent Azure provides only runs on Linux machines.

What are the options we have to forward syslogs that are collected in a windows server and if not what are the other possible ways.

Any help would be greatly appreciated.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,065 questions
0 comments
Accepted answer
  1. Andrew Blumhardt 9,776 Reputation points Microsoft Employee
    2022-03-01T16:15:33.533+00:00

    You might check out LogStash. That is supported. If you don't run Linux on-premises it is easy to standup a Linux VM in Azure as a log collector. It may be possible to collect Syslog on Windows with the new AMA agent at some point in the future.

    Keep in mind that this data will arrive in Sentinel in a custom table if not collected with the collector agent. This is limiting since many workbooks, alert rules, hunter queries, and more are expecting Syslog to be in the standard table. Changing everything to use a CL is difficult and in some cases impossible. Best to use the standard ingestion method. Also the agent collector has buffering, compression, etc. that add value.

    https://learn.microsoft.com/en-us/azure/sentinel/connect-logstash

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest