Getting Azure VM event logs into Eventhubs

0
votes

We are currently investigating methods in getting our Security log data out of our Azure VM's and into our SIEM for analysis.

Currently I have been able to get the logs from the VM to log analytics work-space but I'm no sure how to get them from the log analytics workspace to the eventhub to then pull down the events.

Has anyone faced a similar challenge before / how did you overcome this challenge?

I'm currently pull the data into a Log analytics workspace

2
azureazure-virtual-machineazure-eventhub

2 Answers

0
votes

Welcome to Stackoverflow!

Azure diagnostic logs can be streamed in near real time to any application using the built-in “Export to Event Hubs” option in the Portal, or by enabling the Event Hub Authorization Rule ID in a diagnostic setting via the Azure PowerShell Cmdlets or Azure CLI.

What you can do with diagnostics logs and Event Hubs:

Here are just a few ways you might use the streaming capability for Diagnostic Logs:

  • Stream logs to 3rd party logging and telemetry systems – You can stream all of your diagnostic logs to a single event hub to pipe log data to a third-party SIEM or log analytics tool.
  • View service health by streaming “hot path” data to Power BI – Using Event Hubs, Stream Analytics, and Power BI, you can easily transform your diagnostics data in to near real-time insights on your Azure services.
  • Build a custom telemetry and logging platform – If you already have a custom-built telemetry platform or are just thinking about building one, the highly scalable publish-subscribe nature of Event Hubs allows you to flexibly ingest diagnostic logs.

After data is displayed in the event hub, you can access and read the data in two ways:

Configure a supported SIEM tool. To read data from the event hub, most tools require the event hub connection string and certain permissions to your Azure subscription. Third-party tools with Azure Monitor integration included.

For more details, refer "Stream Azure Diagnostic Logs to an event hub" and "How to integrate Azure Monitor with SIEM tools".

Hope this helps.

0
votes

You can’t pull the VM data from log analytics to an event hub, you can use windows/Linux diagnostic extensions to route data to an event hub.

Stream Azure monitoring data to an event hub for consumption by an external tool