question

DhawalPatel-3201 avatar image
0 Votes"
DhawalPatel-3201 asked vipulsparsh-MSFT answered

Azure Sentinel with AWS RDS DB Table as Data Source

Hi,
I want to use the Azure Sentinel For SIEM purpose. The challenge i am facing is that the Data is present in a AWS Oracle RDS table. I am not able to find any good way to ingest this table directly to Azure Sentinel.

One way to do it is,
1. Create a DB trigger on RDS table and log the insert queries into a file and save it to S3.
2. Push the S3 file to Azure Sentinel periodically via "HTTP Data Collector API" provided by Azure.

My Questions are:
1. Is there any better ways to do it?
2. The "HTTP Data Collector API" is in the public preview mode. Do we know when can it be a part of general release? It is in public preview for like more then a year.
3. Is there any way that Azure Sentinel can pull (instead of me pushing the data) from S3 Bucket (Or any File Storage)?







azure-sentinel
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

vipulsparsh-MSFT avatar image
0 Votes"
vipulsparsh-MSFT answered

@DhawalPatel-3201 Thanks for reaching out. Apologies for delay on this.

You can certainly use the method of pushing the S3 to data collection API. More information about general release is not available yet.
With the features developing so fast in Sentinel, there might be some more options in this scenario, please keep checking our Whats new Sentinel page :
https://docs.microsoft.com/en-us/azure/sentinel/whats-new

Please open a support case or reach out to your Microsoft accounts team if you want to know what is further in this context as this is under NDA.




Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.