Forum Discussion

Usama_Saleem's avatar
Usama_Saleem
Brass Contributor
Aug 26, 2023

Azure DDOS Protection connector not ingesting logs

Hello,

I am having issues ingesting Azure DDOS protection logs into Sentinel. I have connected by enabling Diagnostics Logs on All Public Addresses but still it is not ingesting logs.

 

 

data collection
integration
siem

4 Replies

  • elieelkarkafi's avatar
    elieelkarkafi
    MVP
    Aug 28, 2023

    Usama_Saleem the connector will become active one you have data ingested to sentinel, you need to simulate an alert from your DDos protection so that alert will be ingested to sentinel through the connector and check then if the connector will become connected and the Azure diagnostics data type will turn green 

    • Usama_Saleem's avatar
      Usama_Saleem
      Brass Contributor
      Aug 29, 2023
      Is it necessary to perform simulation? Why the data is not ingested although I have enabled diagnostic settings of all the Public IP addresses?
      • elieelkarkafi's avatar
        elieelkarkafi
        MVP
        Aug 29, 2023
        you can check the data ingested from the log analytics workspace used with sentinel, but to be able to trigger an alert in sentinel you need to simulate an attack to one of your IP addresses

Resources