All Apps and Add-ons

Microsoft cloud service add-on: Onboarding VM logs?

Aleena
Explorer

Hi there,

Anyone pls advice how to onboard VM logs and Bastion logs from Azure to Splunk. I have installed the add on microsoft cloud services  but am only receiving  metrics log from these bastion event hub and VM event hub. Please let me know how to get VM logs and Bastion logs from azure to Splunk

thanks in advance

Labels (2)
0 Karma

rbaudish
Loves-to-Learn Everything

Hi Aleena,

When configuring Diagnostic settings for resources such as Azure Bastion, you can choose which"category" of data to forward/export  to a destination such as an event hub. For example, the two categories of data for Azure bastion are:

  • Bastion Audit Logs
  • AllMetrics

You need to edit the Diagnostic Settings to also forward the above audit logs to an event hub.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...