Azure Log Stitching

[cpm2710]

Hello,

Have a hybrid environment, VM's in Azure in various subscriptions, hub contains NVA from vendors as well as LB. We have NAT also. Question is one of SNAT and log stitching to follow the following scenarios:

1. User logs onto VM, we have UDR to direct them through NVA etc to get to Internet along the way we have SNAT, logs from vendors need to be able to be stitched so we can follow the flows.

Trying to think of ways to achieve this, can think of some, but no great one as yet, this cannot be a unique situation, any suggestions please to consider?

[#2]

Hi @cpm2710,

I think that Azure Sentinel, our SIEM product, might be your solution here. For information on how to collect events see here (it does not list all your sources, but is a start):

• Formal documentation about the built-in connectors
• Syslog, CEF and other 3rd party connectors grand list
• Collecting telemetry from on-prem and IaaS server using the Log Analytics agent
• Collecting logs from Microsoft Services and Applications
• Creating Custom Connectors

Than you need to "Stitch", which in the SIEM jargon we call correlate. For that, see those blog posts: 

• Azure Sentinel correlation rules: Active Lists out; make_list() in, the AAD/AWS correlation example
• Azure Sentinel correlation rules: the join KQL operator
• Implementing Lookups in Azure Sentinel part #1: reference files
• Using KQL functions to speed up analysis in Azure Sentinel