Log Streaming to Microsoft Sentinel

Updated 2 years ago by admin

The Log Streaming service allows enriched logs from the USS platform to be streamed to external services such as SIEM solutions, analytics platforms and SoC services. To request access to the Log Streaming service, please contact your service provider.

This article requires a Microsoft Azure and a Microsoft Sentinel subscription.
  1. Log in to the Microsoft Azure portal
  2. Navigate to Microsoft Sentinel
If this is your first time using Microsoft Sentinel, you will be required to create a Workspace and add Microsoft Sentinel to the new workspace. At the time of writing, a free trial is available for up to 10 GB per day for 30 days (see Microsoft article for more information) after which charges will apply from Microsoft.
  1. Select your Microsoft Sentinel workspace
  2. Navigate to Configuration in the left hand menu, then Settings (at the bottom) and then Workspace settings tab
  3. Select the Agents option from the left menu
  4. Expand the Log Analytics Agent Instructions panel (for either Windows or Linux)
  1. Copy the Workspace ID and Primary Key and send them to service provider along with the name of the product(s) you wish to stream in to Microsoft Sentinel
  2. Wait for confirmation from your service provider that the log stream has been configured
  3. Navigate to Microsoft Sentinel again and select your Microsoft Sentinel instance and select Logs. Close any pop-up windows until you can see the Query editor

Note that it could take up to an hour for Microsoft Sentinel to index data for the first time. In most cases it is 10-15 minutes.

Once data is available, you should see a new table representing the streamed products under the Custom Logs expansion item. The table name will be in the format clouduss_<product_code>_CL (CL for "Custom Log" in Sentinel). If you are streaming multiple products or sub-logs of a product, each will have a separate table.

  1. The log stream is now set up and you can continue to query the data in Microsoft Sentinel.

How did we do?