hi, has anyone been able to make a succesful integration with Azure Security Center: https://docs.microsoft.com/en-us/azure/security-center/security-center-integrating-alerts-with-log-integration It uses JSON as a log format, I tried with nxlog json parsing, but had problems.

I’m about to set this up too. From the looks of it you’re meant to set up a Windows server ($$), install some agent on it and that will download the JSON Azure logs into a directory structure? Then you’re trying to use NXLOG to parse those files and upload the data to graylog? That sounds exactl…

I use TCP with SSL, as with other log sources. The problem is somewhere else.

Our Ops team just installed the Azure audit agent and handed off to my team. I think I am now where you are and have the same problem I think the issue is due to Azure JSON data being multi-array? ie { “field”: { subfield1": “value”, “subfield2”:“value2”}} That isn’t support by graylog, so I gue…

I think we have stumbled on the same thing. I tried importing with nxlog, but it seems nxlog is not supporting it either, or then I just configured it the wrong way.

I wanted this working, and even though it’s a little crude, I did it with PowerShell. Basically I snag all the AzureAD files, parse them, and load them via GELF. $docs = Get-ChildItem C:\users\azlog\AzureActiveDirectoryJson -File #declare an array to hold results $results = @() foreach ($d in $d…

I have integrated other json Azure Metrics with: https://pablodav.github.io/post/graylog/logstash_input/ Probably same could be used for Security Center Log integration. Kind regards, Pablo.

Azure Security Center log integration

Graylog Central (peer support)

jason (Jason Haar) April 26, 2017, 12:21am 4

but then I started to get just segments of events, not full events.

Are you feeding that into graylog over TCP or UDP? I could imagine UDP
would be a bad option and would match your symptoms

Topic		Replies	Views
Configuring Graylog to view Azure NSG flow logs Graylog Add-ons	4	1035	October 28, 2022
Graylog integrating with Azure Graylog Central (peer support)	1	400	October 25, 2020
Active directory Logs Graylog Central (peer support)	2	633	November 14, 2023
IIS logs into graylog Graylog Central (peer support) sidecar , nxlog , nodatanx	33	23407	February 5, 2018
Linux machines monitoring from Azure Cloud Graylog Central (peer support) sidecar , filebeat-linux	2	907	May 1, 2018

Azure Security Center log integration

Related topics