While agents are not yet integrated, can we get a recommended reference setup for running both on one on-prem machine?
The goal is to pass one Syslog stream from on-prem firewall to both agents. This can be done by:
1. Sending Syslog stream to Linux,
2. copy the stream to loopback port (for MCAS)
3. saving to local file for Sentinel OMS agent.
Just want to get "certified" config for rsyslog or/and syslog-ng to deliver this agent co-existence use case. And want to avoid time wasting troubleshooting any well known issues.
We would like to stick with defaults as much as possible avoid modification to appliance like MCAS software container, it is pre-built to listen on port 514. If there is syslog-ng daemon runing on the host machine the default port can be busy. Docker can be tuned by updating initiation string like this "... docker run --name MCASAGENT -p 1514:514/udp ..."
Looks like this is discussed for at least 2 years, but there is no visible progress with this.
references - previous discussions on the subject:
Any plan to integrate/send MCAS activity events to Sentinel
Linux Connectors - MCAS & Sentinel
Cloud Discovery Data Import - Sentinel vs Cloud App Sec
