Forum Discussion

SimonR's avatar
SimonR
Brass Contributor
Apr 17, 2020

Separating Logs for RBAC

Hi,   I'm in the process of setting up Sentinel with a number of log sources being sent via CEF. It appears that all the logs will go into the CommonSecurityEvents table which I need to separate ou...
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Apr 19, 2020

SimonR

 

To seperate to differnt tables you will need to use Logstach as outlined here. That said, you can use resource RBAC as outlined here with a single table.

 

~ Ofer 

SimonR's avatar
SimonR
Brass Contributor
Apr 20, 2020

Ofer_Shezaf  thanks for this, I'd rather not deploy LogStash if I don't have to, the only reason for separate table would be if I couldn't split the logs in any other way, but it looks like resource RBAC might work for us.

 

Based on what I've read from you link, I'd need a separate collector VM for each access boundary. For example if both the firewall and web proxy logs will only be accessed by the Network team then I'll send them via the same Collector VM. 

 

Is there a way to set the resource ID on an on-prem collector without using Azure Arc? I'd like to get up and running with this and while Arc maybe a long term solution for us if I can test without it that would be great.

 

Simon

Resources