Skip to main content

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Microsoft Sentinel (via Event Hub) Cloud Collector

Before you configure the Microsoft Sentinel (via Event Hub) Cloud Collector you must complete the following prerequisites:

  • Configure Microsoft Sentinel and Log Analytics workspace in Azure portal.

  • Obtain the consumer group name to be entered while configuring the Cloud Collector.

  • Obtain the connection string to be entered while configuring the Cloud Collector.

  • (Optional) Configure your Event Hub setup for enabling sufficient egress. Consider referring to the tip in this section.

  • Add supported data connectors to Microsoft Sentinel.

  • Ensure that you have Azure subscription with standard, or premium, or dedicated tier of Azure Event Hubs. Cloud Collectors do not support the Basic tier of Azure Event Hubs for event ingestion. For more information about various tiers of Azure Event Hubs, see Compare Azure Event Hubs tiers in the Microsoft documentation.

    Note

    Parsing of data collected from Microsoft Sentinel is only supported for New Scale Search and Advanced Analytics i63 or later.

Configure Microsoft Sentinel and Log Analytics Workspace

To ingest logs from Microsoft Sentinel via Azure Event Hub, you must configure Microsoft Sentinel. Add Microsoft Sentinel to an existing workspace or create a new Log Analytics workspace. For more information, see Microsoft Documentation.

Obtain the Consumer Group Name and Connection String

Before configuring the Microsoft Sentinel (via Event Hub) Cloud Collector, use the following steps to obtain the Consumer Group Name and Connection String for your Event Hub endpoint.

  1. To obtain the name of the consumer group of the Event Hub, perform the following steps.

    1. On the Azure portal, navigate to the Event Hubs namespace in which the Event Hub with the data you want to retrieve resides.

      EventHub_1_1.png
      EventHub_1_2.png

    2. Select the EventHub where your data to be retrieved resides.

      Eventhub_5.png

      Note

      If connection errors occur after the Cloud Collector configuration, enable local authentication for a given Event Hubs namespace.

      Event_hub_5_local_authentication.png

    3. Navigate to Consumer groups to note the name of the consumer group.

      If only Exabeam is going to read data from the Event Hub, use the default consumer group. Otherwise, create a dedicated consumer group for Exabeam.

      consumer_group1.png

      Note

      Ensure that you create and use a unique consumer group. If you use the same consumer group for two cloud collector instances, it may result in event loss and ingestion issues.

  2. Create a SAS policy with listen-only permissions for Exabeam:

    1. In Event Hub, navigate to Shared access policies.

    2. Click + Add to add a new Policy on the Add SAS Policy page and enable the Listen or Manage permission based on your requirement.

    3. Provide a descriptive name for the token which is listen-only, then click Create.

    4. After you see the confirmation message (for example Creating SAS Policy successful), access the policy you just created and note the following.

      • SAS policy name

      • Primary key value

        Note

        The Connection string primary key acts as a connection string for the Azure Event Hub Cloud Collector.

      Event_Hub_4_2.png

      Proceed to configure the Microsoft Sentinel (via Event Hub) Cloud Collector.

    Tip

    To configure your Event Hub setup for enabling sufficient egress, refer to the following tips.

    • Examine the incoming number of bytes per second, by navigating to the Event Hub page on the Azure portal.

    • Set up the Event Hub with a good throughput capacity. The egress and ingress capacity of Event Hubs is measured by throughput units (TU). Ensure that your Event Hub provides 1 Throughput Unit (TU) per 2MB/sec egress and 1MB/sec ingress capacity.

    • Ensure that your Event Hub has 32 partitions and at least 1 TU per partition.

      If you notice that your workload requirement exceeds the maximum value recommended for Event Hub Premium which is 32 partitions and 40 TU, you need to migrate to a Dedicated Event Hub Cluster.

    • Consider using the Auto-inflate throughput feature. You can enable Auto-inflate on the Event Hub namespace to automatically increase the number of TUs based on the load. For more information about throughput units, limits, and associated billing, see Event Hubs FAQs and Azure Event Hubs quotas and limits.

Add Supported Data Connectors

To start ingesting logs into Microsoft Sentinel, add data connectors by following instructions mentioned in the Microsoft Sentinel data connectors topic in the Microsoft documentation.

Create a data export rule that defines the destination and tables for which data is exported. Microsoft Sentinel supports specific tables to be exported. See the list of Supported tables in the Microsoft documentation.

To forward the ingested logs from Microsoft Sentinel to Event Hub, navigate to the Log Analytics workspace that you created and click Data export. Create a rule by clicking New export rule in which you add Event Hub details.