Forum Discussion

SimonR's avatar
SimonR
Brass Contributor
Apr 17, 2020

Separating Logs for RBAC

Hi,   I'm in the process of setting up Sentinel with a number of log sources being sent via CEF. It appears that all the logs will go into the CommonSecurityEvents table which I need to separate ou...
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Apr 26, 2020

SimonR : Reading your post, I think you are doing thing right and I am not sure why you can't find your VM in the scope selector. Might be worth a support ticket. If they don't help, I can try to have you work with the Azure Arc PM team - this is a new technology and maybe there are some corner cases to understand. 

SimonR's avatar
SimonR
Brass Contributor
Apr 27, 2020

Thanks Ofer_Shezaf Have logged a ticket, I think this is more a Log Analytics RBAC issue than Arc but I'll update here with any resolution. Thanks very much for your help.

  • SoniaCuff's avatar
    SoniaCuff
    Icon for Microsoft rankMicrosoft
    Apr 28, 2020

    SimonR SimonR Thanks Simon and yes, very interested in the result!

Resources