Hello,
I am trying to use a GNS3 network as input data to Microsoft Sentinel. My GNS3 server with GNS3 network is running on a virtual Linux machine, so I can monitor it with Syslog connector successfully. However I am unable to detect anything from the GNS3 network. Any idead how to solve this? I would be grategul for any answer.
Hello @miloslavastn-0626, can you provide more detail about your GNS3 env and Sentinel/connector setup?
Hello, I solved it. Anyway, I have a virtual Linux machine running in Azure and there´s a GNS3 network on the machine.
config:
module(load="imuxsock") # provides support for local system logging
input(type="imuxsock" Socket="/var/run/rsyslog/dev/log" CreatePath="on")
module(load="immark") # provides --MARK-- message capability
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")
module(load="imklog" permitnonkernelfacility="on")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
Hi @Miloslavastn-0626
Microsoft Sentinel expects that any servers you want to monitor are running their monitoring agent.
In the Azure portal, type ‘log analytics workspace’ in the top search box.
Open the Log Analytics Workspace that is associated with your Sentinel configuration.
Select the ‘Agents’ section and go to the Linux tab.
You will see a curl command you can use to download and install the Azure Monitor (OMS) agent.
Once this agent is installed you should have logs showing up in Sentinel as described in the Windows Security Events connector configuration (in the Sentinel > Connectors UI)
Thank you, I had done it before I asked my question. I had to set logging on each device in the GNS3 network, so the logs were sent to agent.
Thank you for your help, I have eventually solved it.
2 people are following this question.
