Sending logs to Azure Sentinel

[pawellak (Pawel)]

Hi,

is there an easy way to send logs to Azure Sentinel? Has anyone tried to output logs to TCP Syslog and use CEF connector on Sentinel’s side? Or maybe a plugin to push it through Azure Event Hub?

[gsmith]

Hello && Welcome
Personally I have not but we do work with MS Azure.

There are a couple different Output available you could try.

With the enterprise version (under 5Gb day) its free . Maybe one of those Outputs might work for you.

[pawellak (Pawel)]

Yes, I am thinking about TCP Syslog and connecting with CEF connector on Sentinel’s side.

[gsmith]

Hello,
From the picture I showed above, perhaps try a Forwarder Output on your Stream

I believe this for a Enterprise license. I personal haven’t forward logs to another different remote device