SmartConnector for Microsoft Azure Monitor Event Hub

Daniela Bonilla
2 Likes

The Microsoft Azure Monitor Event Hub guide can be found here. 

Labels:

SmartConnector
Smart Connectors
Comment List
Parents

  • Hi all,

    By testing with a major Azure client, we don't believe it is the right way to go.

    First of all, it seems that ArcSight isolated the JAR files from the SmartConnector, to put it in an Azure Service Plan. So it is practically a SmartConnector running "natively" on Azure, that gets its input from an Azure EventHub. The output should of course go to a syslog-ng somewhere, so it makes sense.

    The problem is that the setup is very complex and had much troubleshooting, just to get the "supported" logs from one Azure subscription.

    I think the best way is to get your hands dirty and right with Python a script that is able to extract logs from either:

    1. Azure Graph API / Insights API
    2. Or send the Azure logs to Azure Log Analytics (OMS) and query the analytics API

    Of course, you have to create the CEF format within the code you create.

    It has difficulties of course, but you totally control the pipeline this way.

Comment

  • Hi all,

    By testing with a major Azure client, we don't believe it is the right way to go.

    First of all, it seems that ArcSight isolated the JAR files from the SmartConnector, to put it in an Azure Service Plan. So it is practically a SmartConnector running "natively" on Azure, that gets its input from an Azure EventHub. The output should of course go to a syslog-ng somewhere, so it makes sense.

    The problem is that the setup is very complex and had much troubleshooting, just to get the "supported" logs from one Azure subscription.

    I think the best way is to get your hands dirty and right with Python a script that is able to extract logs from either:

    1. Azure Graph API / Insights API
    2. Or send the Azure logs to Azure Log Analytics (OMS) and query the analytics API

    Of course, you have to create the CEF format within the code you create.

    It has difficulties of course, but you totally control the pipeline this way.

Children
No Data
Related
Recommended

Resources

Support
Documentation
Training
CyberRes Academy
Partner Portal
Contact us
Compliance
Help
Company
Privacy Policy
Terms of Use
Accessibility
Anti-Slavery Statement
Support
How To Buy
Careers
Investor Relations
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.