Azure Sentinel News
  • Home
    • Home – Layout 1
    • Home – Layout 2
    • Home – Layout 3
  • Security and Compliance
  • SOC
  • Threat Intelligence
  • Security Ochestration & Automated Response
  • SOAR
  • Security Operations
  • Artificial Intelligence
No Result
View All Result
  • Home
    • Home – Layout 1
    • Home – Layout 2
    • Home – Layout 3
  • Security and Compliance
  • SOC
  • Threat Intelligence
  • Security Ochestration & Automated Response
  • SOAR
  • Security Operations
  • Artificial Intelligence
No Result
View All Result
Azure Sentinel News
No Result
View All Result
Home Security Operations

Exporting Events from Disconnected Systems to Ingest into Azure Sentinel

Azure Sentinel News Editor by Azure Sentinel News Editor
January 1, 2021
in Security Operations
0
With new release, CrowdStrike targets Google Cloud, Azure and container adopters
2.2kViews
638 Shares Share on Facebook Share on Twitter

I had the occasion recently to work with a customer that had domain controllers that were disconnected from the Internet, but still wanted to ingest the server event logs into Azure Sentinel.

Sifting through research I found there’s a myriad of ways to do it (including standing up a Log Analytics gateway) but one of the requirements was to accomplish it quickly and easily. So, I immediately dusted off my PowerShell chops.

The simple PowerShell script contained below is used to export the event logs (Application, System, and/or Security) from a disconnected server to a folder that resides on a server/workstation that is connected. The Log Analytics agent is installed on the connected system and a Custom Log data source is configured in the Log Analytics workspace for Azure Sentinel. This procedure essentially turns a connected system into a Windows-based forwarder for disconnected systems.

PowerShell script

I’ve documented the PowerShell script pretty well. Note that I can’t take full credit for all the PowerShell components. Much of it was cobbled together from snippets I already had laying around in a scripting folder on OneDrive that I’ve been collecting for years.

Take note that you can:

  1. Schedule it to run periodically.
  2. Modify the number of days to retrieve events.
  3. Enter any number of hostnames (or just 1).
  4. Modify it to only retrieve the logs you want (it currently retrieves Application, System, and Security).
  5. Alter the types of events you want to export. If you want ALL events, just comment-out the TypesofEvents variable line up top and then also the -EntryType $TypesofEvents in the foreach loop.
  6. Change the folder to write the export to.
#Schedule it using this: PowerShell.exe -ExecutionPolicy ByPass -File eventexport.ps1

Set-Variable -Name EventAge -Value 1     #Sets the number of days that will be exported
Set-Variable -Name ServerNames -Value @("Server1", "Server2", "Server3", "Server4")   #Replace with your own Server name or names
Set-Variable -Name Logs -Value @("Application", "System", "Security")  # Checking app, system, and security logs - only use what you want/need
Set-Variable -Name TypesofEvents -Value @("Error", "Warning")  # Loading only Errors and Warnings
Set-Variable -Name ExportFolder -Value "C:\TEMP\"


$exportlog_c = @()   #consolidated error log
$now=get-date
$startdate=$now.adddays(-$EventAge)
$ExportFile=$ExportFolder + "exportlog" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  

foreach($comp in $ServerNames)
{
 foreach($log in $Logs)
 {
  Write-Host Processing $comp\$log
 $exportlog = get-eventlog -ComputerName $comp -log $log -After $startdate -EntryType $TypesofEvents
 $exportlog_c += $exportlog  #consolidating
  }
}
$explortlog_sorted = $explortlog_c | Sort-Object TimeGenerated    
Write-Host Exporting to $ExportFile
$explortlog_sorted|Select EntryType, TimeGenerated, Source, EventID, MachineName | Export-CSV $ExportFile -NoTypeInfo 
Write-Host Done!

Thoughts? Comments? Have a better way to do it? Let me know.

Reference: https://azurecloudai.blog/2020/05/08/exporting-events-from-disconnected-systems-to-ingest-into-azure-sentinel/

Azure Sentinel News Editor

Azure Sentinel News Editor

Related Posts

What’s new: Microsoft Teams connector in Public Preview
Security Operations

AMA for Azure Sentinel on the Microsoft Security Insights Podcast and Twitch Stream

January 25, 2021
What’s new: Microsoft Teams connector in Public Preview
Security Operations

How to Setup a Managed Identity for the Azure Sentinel Logic App Connector

January 21, 2021
Microsoft suspends 18 Azure accounts tied to China-based hackers
Security Operations

Azure Sentinel Daily Task: Hunting Queries and Bookmarks

January 1, 2021
Next Post
Microsoft’s newest sustainable datacenter region coming to Arizona in 2021

Azure Sentinel Tip for Table Details and Descriptions

Microsoft is quietly becoming a cybersecurity powerhouse

Tip: Keeping Track of Azure Sentinel GitHub Updates

Microsoft suspends 18 Azure accounts tied to China-based hackers

Azure Sentinel Daily Task: Hunting Queries and Bookmarks

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Follow Us

  • 21.8M Fans
  • 81 Followers

Recommended

Microsoft suspends 18 Azure accounts tied to China-based hackers

How to Monitor Compliant and Non-compliant Systems for Zerologon Using Azure Sentinel

2 months ago
BlueVoyant acquires Managed Sentinel, builds out Microsoft MSS offerings

BlueVoyant acquires Managed Sentinel, builds out Microsoft MSS offerings

4 months ago
Hunting for Barium using Azure Sentinel

Hunting for Barium using Azure Sentinel

4 months ago
Microsoft’s John Thompson and VMware’s Sanjay Poonen share a similar view of the security landscape

Westpac and Microsoft team up to ‘catapult’ digital banking

3 months ago

Instagram

    Please install/update and activate JNews Instagram plugin.

Categories

  • AI & ML
  • Artificial Intelligence
  • Incident Response
  • IR
  • KQL
  • Security and Compliance
  • Security Ochestration & Automated Response
  • Security Operations
  • SIEM
  • SOAR
  • SOC
  • Threat Intelligence
  • Uncategorized

Topics

anomaly automation Azure Azure DevOps Azure Security Center Azure Sentinel Azure Sentinel API Azure Sentinel Connector BlueVoyant Call cybersecurity Detection file GitHub Hunting Huntingy IAC incident response Incident Triage infrastructure as code Investigation jupyter LAQueryLogs MDR Microsoft microsoft 365 mssp Multitenancy Notebooks Pester Playbooks PowerShell python Records Security Sentinel Sharing SIEM signin Supply Chain teams Threat hunting Watchlists Workbooks XDR
No Result
View All Result

Highlights

New Items of Note on the Azure Sentinel GitHub Repo

Tuning the MCAS Analytics Rule for Azure Sentinel: System Alerts and Feature Deprecation

New Search Capability for Azure Sentinel Incidents

Follow-up: Microsoft Tech Talks Practical Sentinel : A Day in the Life of a Sentinel Analyst

Changes in How Running Hunting Queries Works in Azure Sentinel

Azure Sentinel can now Analyze All Available Azure Active Directory Log Files

Trending

What’s new: Microsoft Teams connector in Public Preview
IR

How to Generate Azure Sentinel Incidents for Testing

by Azure Sentinel News Editor
February 26, 2021
0

Do you want to generate an Incident in Azure Sentinel for testing/demoing? Here’s a couple easy ways...

What’s new: Microsoft Teams connector in Public Preview

Azure Sentinel Notebooks Loses It’s Preview Tag

February 25, 2021
Microsoft’s newest sustainable datacenter region coming to Arizona in 2021

The Holy Grail of Azure Sentinel Data Connections: The Azure Service Diagnostic Setting

February 22, 2021
Microsoft’s newest sustainable datacenter region coming to Arizona in 2021

New Items of Note on the Azure Sentinel GitHub Repo

February 18, 2021
Microsoft’s newest sustainable datacenter region coming to Arizona in 2021

Tuning the MCAS Analytics Rule for Azure Sentinel: System Alerts and Feature Deprecation

February 17, 2021

We bring you the best, latest and perfect Azure Sentinel News, Magazine, Personal Blogs, etc. Visit our landing page to see all features & demos.
LEARN MORE »

Recent News

  • How to Generate Azure Sentinel Incidents for Testing February 26, 2021
  • Azure Sentinel Notebooks Loses It’s Preview Tag February 25, 2021
  • The Holy Grail of Azure Sentinel Data Connections: The Azure Service Diagnostic Setting February 22, 2021

Categories

  • AI & ML
  • Artificial Intelligence
  • Incident Response
  • IR
  • KQL
  • Security and Compliance
  • Security Ochestration & Automated Response
  • Security Operations
  • SIEM
  • SOAR
  • SOC
  • Threat Intelligence
  • Uncategorized

[mc4wp_form]

Copyright © 2020 - Azure Sentinel News

No Result
View All Result
  • Home
  • Security and Compliance
  • SOC
  • Threat Intelligence
  • Security Ochestration & Automated Response
  • SOAR
  • Security Operations
  • Artificial Intelligence

Copyright © 2020 Azure Sentinel News