Forum Discussion
Azure Cloud integration with SIEM Tools
- May 13, 2020
Akshaya_Kumar In order for you to evaluate 3rd party SIEM tools (like Splunk etc) to ingest data from Azure, you need to think what all you will ingest. You can categorize data sources into 3 buckets:
1.) Azure platform data: logs from O365, AAD, Activity logs etc fall into this bucket
2.) Azure reource data: this is where you diagnostic data from VMs etc will come from
3.) Finally you need to think of guest OS data like security logs, syslog etc
All this data need to be quantified as Splunk or any tool for that matter will charge you on data ingested per day. This is needed for not only licensing for SIEM tools but for Azure Event Hub where the data will hit before getting forwarded to SIEM tool. If you want to use Splunk, there is a Azure monitor addon for Splunk that can gather data from Azure event hub. Check Azure price calculator for Event hub costing. If you are hosting SIEM on azure, there will be IaaS, disk cost etc.
Hope this helps
Akshaya_Kumar In order for you to evaluate 3rd party SIEM tools (like Splunk etc) to ingest data from Azure, you need to think what all you will ingest. You can categorize data sources into 3 buckets:
1.) Azure platform data: logs from O365, AAD, Activity logs etc fall into this bucket
2.) Azure reource data: this is where you diagnostic data from VMs etc will come from
3.) Finally you need to think of guest OS data like security logs, syslog etc
All this data need to be quantified as Splunk or any tool for that matter will charge you on data ingested per day. This is needed for not only licensing for SIEM tools but for Azure Event Hub where the data will hit before getting forwarded to SIEM tool. If you want to use Splunk, there is a Azure monitor addon for Splunk that can gather data from Azure event hub. Check Azure price calculator for Event hub costing. If you are hosting SIEM on azure, there will be IaaS, disk cost etc.
Hope this helps
If yes what all should the organization consider interms of cost , risks , issues when using Azure Sentinel or any other SIEM tool.