Azure Monitor - Log Analytics (part 4 of 4)

By Ashwin Venugopal -

 




To read part 1, please click here
To read part 2, please click here
To read part 3, please click here



Advanced Settings for Log Analytics

Firstly, you have open Log Analytics Overview page while selecting Windows, Linux or other sources to get to the advanced settings page. Its various menu options are listed below:

Connected Sources

Here, you can easily attach non-Azure Windows and Linux servers, Azure Storage, and System Center Operations Manager.
  • Windows Servers- helps you to attach a non-Azure Windows based VM to the workspace. 
  • Linux Servers- It is as same as the Windows Servers except for the wget command to download and install the application without any user interaction.
  • Azure Storage- It provides a list of all the Azure Storage accounts connected as well as the documentation link having the instruction to connect with the storage account. 
  • System Center- It allows you to connect System Center Operations Manager management groups or the entire deployment to your workspace with the help of just a few clicks instead of connecting each server individually.                                                                                                                                                                                                                                                               

The Data option

This section helps you to recognize the data to be imported from connected servers. Its different fields are as follows:
  • Windows Event Logs- Here you can search all the various logs that can be seen in the Windows Event viewer, along with the items to be included in the Log Analytics workspace like Application, Setup, and System logs.
  • Windows Performance Counters- It contains the list of all the Linux performance counters that will be included by default and the polling interval for those counters who uses it.
  • IIS Logs- It confirms if the W3C format IIS log files will be ingested from Windows web servers or not.
  • Custom Fields- It contains the list of all the added custom fields along with the logs they belong to as well as their data types. 
  • Custom Logs- It permits you add custom logs that you can't add by using other data sources.  

Computer Groups

This area contains all the custom computer groups that's created and offers a way to create your own. These groups can be easily used to create queries referencing a specific set of servers that can be readily changed without changing the query itself. The various fields under its group are:
  • Saved Groups- This page contains all the added custom groups with instructions to create a computer group from a query.
  • Active Directory- By selecting the Import Active Directory group memberships from computers checkbox you can import the groups from Active Directory. 
  • WSUS- By selecting the Import WSUS group memberships checkbox you can import the groups from Windows Server Update Service.
  • SCCM- By selecting the Import Configuration Manager collection memberships checkbox you can import the groups from SCCM. 






To read part 1, please click here
To read part 2, please click here
To read part 3, please click here








Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more