Blog Post

Microsoft Sentinel Blog
12 MIN READ

Azure Sentinel: The connectors grand (CEF, Syslog, Direct, Agent, Custom and more)

Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Aug 14, 2019
(Last updated Apr 20th, 2021)   Please note that as the built-in list of connectors in Azure Sentinel is growing, this list is not actively maintained anymore. Refer to the Azure Sentinel connect...
Updated Sep 30, 2021
Version 171.0
connectors
Arunkumar_Azure's avatar
Arunkumar_Azure
Copper Contributor
May 04, 2021

Team,

I have one question reg. SYSLOG -> Azure Sentinel setup. 

One of our customers already has SYSLOG setup in on-premise that gathers events/messages from various machines (Linux, Windows), Networking devices, and Firewalls.  

We are going to Azure Sentinel as SEIM solution, and used OMS Linux agent installed on that one machine that already consolidated logs from various machines and loaded them to Azure Sentinel. 

 

Question:

1) Is there any way that Azure Sentinel can "Auto-discover" hosts/device that actually sent the message and classify them as messages or events from networking device / Windows servers / Linux servers etc.,?

If not, is there any way in SYSLOG templates we need to include that tag or clue?

2) If the above is not possible, Should we recommend installing Microsoft monitoring agents in every machine/device On-premise to send events/logs to Azure sentinel individually rather than RSYSLOG?

 

Could you please share your thoughts?