英文:
Azure Sentinel: How to convert the existing log analytics as Azure Sentinel workspace?
问题
我有一个集中式的日志分析工作区，所有的日志都被发送到其中，包括：
- 活动日志
- 网络日志
- 资源日志
- 系统度量
- 应用程序日志
- 应用程序洞察
现在，我想将这个日志分析工作区用作哨兵工作区，以便不必连接各个资源。
这是否可行？如果是的话，怎么做？
英文:
I have a centralized log analytics workspace to which all the logs are being sent including:
- Activity Logs
- Network Logs
- Resource Logs
- System Metrics
- Application Logs
- Application Insights
Now, I want to use this log analytics workspace as a sentinel workspace so that I don't have to connect the individual resources.
Is this achievable? If so, how?
答案1
得分: 0
是的，一个集中的日志分析工作区可以作为Sentinel工作区，用于加速日志分析和监控，而无需单独连接不同的资源。
要实现这一点，在门户中创建一个Microsoft Sentinel，同时在创建Sentinel时链接需要链接的工作区，并启用UEBA，详细步骤请参考MSDoc。
要启用此功能，转到Microsoft Sentinel -> 配置 -> 设置。您需要具有全局管理员或安全管理员权限，如下所示。
要将工作区日志连接到Sentinel，滚动到数据连接器，然后搜索需要与Sentinel链接的Azure活动日志。然后，如所示，它会将您重定向到连接器页面。
完成后，您可以创建工作簿和分析规则，允许您创建一个可视化数据并通知安全警报的仪表板。
您还可以查询与Sentinel链接的各个工作区日志，如下所示。
有关此需求的更多相关方法，请参考这些Microsoft Sentinel 和 Microsoft Q&A。
英文:
Yes, a centralized log analytics workspace can be used as a Sentinel workspace to expedite log analysis and monitoring without having to connect to different resources separately.
To achieve this, create a Microsoft sentinel in the portal, link the workspaces that need to be linked while creating the sentinel, and enable UEBA. as detailed in MSDoc.
To enable this, go to Microsoft sentinel -> configuartion -> settings. you need to have either a global administrator or a security administrator privilege as shown.
To connect the workspace logs to sentinel, scroll to Data connectors then search for Azure activity logs that need to be linked with sentinel. Then as shown, it redirects you to the connector page.
Once it is done, you can create workbooks and analytic rules which allows you to create a dashboard to visualize data and notify security alerts.
You can also query the individual workspace logs linked to the Sentinel as shown below.
Refer these Microsoft sentinel & Microsoft Q&A for more relevant approaches for this requirement.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论