Some pointers to setting up Sentinel to monitor an App Service please for suspect traffic?

[SamStaveley]

Hi All,

I am exploring Sentinel, and wanting to understand the best way to set it up to monitor incoming traffic into a PaaS App Service Web Application, to spot and alert on suspect traffic. We just want to monitor traffic that is getting throught our non MS WAF at present. We do not use the MS WAF or gateway.

Thanks.

[#2]

Is the PaaS App Service on Azure? Does the same service (assuming Azure) allow you to write to log analytics/App Insights or azure diagnostics? if not, does it have an api we could use to get the data?

[#3]

@Clive_Watson 

Hi Clive,

Really appreciate the reply. The App Service is a standard Azure App Serivce running a .Net MVC Web Application against SQL Azure. We use Log analytics / monitoring and Application Insights. However probably not using Log Analytics as much as we should.Thoughts?

Thanks.

[#4]

@SamStaveley 

Ah good, so your App Service, will already write to AzureActivity (so you can check that table to see some data), and you can also enable Diagnostic logging, sending teh data to a Log Analytics workspace managed by Sentinel.

Enable diagnostics logging - Azure App Service | Microsoft Docs

[#5]

Clive,,

This is most helpful. I have now got my AppServiceHtmlLogs coming through. I assume that AppServiceLogs are redundant with Diagnostic Settings in use to send HTMLLogs to Sentinel?

Thanks