Windows Logs to Sentinel Through Syslog Server

[msef280]

Hi Team,

I am trying to send the windows server, security, DNS logs to our syslog server & then push it to Azure Sentinel. If someone can provide me the steps that would be great. We are not using the agent method (data connectors) as our environment is trying to avoid that.

[#2]

You would then need some kind of syslog forwarder on the DNS server to then push it to the linux forwarder I guess. Like this: https://4sysops.com/archives/forward-windows-events-to-a-syslog-server-with-free-solarwinds-event-lo...

But why would you want to avoid the OOB data connectors? All the logic provided by sentinel solutions/connectors and.the community work etc are built upon the events as is (not being converted to syslog signals).

A bit like fueling a Formula 1 car with apple juice :)