Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

Onboarding Ivanti Application Control logs to Azure Sentinel

Copper Contributor

Hi all,
Just wondering if anyone has onboarded "Ivanti Application Control " logs to Azure Sentinel?

-Log source is  on-prem (No cloud presence, neither a connector available in Sentinel)
-Product does not support Syslog or CEF
-To extract logs from central management server you can use a data base query (DbConnect in Splunk World)
OR
-To extract logs from clients you can extract logs from every client in  either XML or CSV format

Has anyone on-boarded these logs before or have any suggestions ?
Thank you



2 Replies
best response confirmed by Aman_Khan (Copper Contributor)
Solution
Ended up forwarding Ivanti Logs to a Window Event Collector server:

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/forward-on-premises-windows-...

In my case filtered to only event IDs pertaining to AppSense i.e. 9*** .eg.
"ForwardedEvents!*[System[(EventID=9000)]]"

@Aman_Khan - Can you elaborate on this please as we have a requirement to do this. Ivanti doesnt write to eventlogs it keeps it in the Management Database? How are you forwarding / filtering these logs please? Any help appreciated.

1 best response

Accepted Solutions
best response confirmed by Aman_Khan (Copper Contributor)
Solution
Ended up forwarding Ivanti Logs to a Window Event Collector server:

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/forward-on-premises-windows-...

In my case filtered to only event IDs pertaining to AppSense i.e. 9*** .eg.
"ForwardedEvents!*[System[(EventID=9000)]]"

View solution in original post