All Apps and Add-ons

Microsoft cloud service add-on: Onboarding VM logs?


Hi there,

Anyone pls advice how to onboard VM logs and Bastion logs from Azure to Splunk. I have installed the add on microsoft cloud services  but am only receiving  metrics log from these bastion event hub and VM event hub. Please let me know how to get VM logs and Bastion logs from azure to Splunk

thanks in advance

Labels (2)
0 Karma

Loves-to-Learn Everything

Hi Aleena,

When configuring Diagnostic settings for resources such as Azure Bastion, you can choose which"category" of data to forward/export  to a destination such as an event hub. For example, the two categories of data for Azure bastion are:

  • Bastion Audit Logs
  • AllMetrics

You need to edit the Diagnostic Settings to also forward the above audit logs to an event hub.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...