How to take the Network Security Group(NSG) logs to Azure Sentinel

Question

Hello,

I have Azure Sentinel, Kindly suggest the steps how to forward the NSG(Azure Firewall) logs to Sentinel.

Regards,
Chandan Prajapati

Answer 1

Hi @AnonUser,

It looks like someone asked this same question here.

As shared in that post, here is the guide for enabling NSG Flow logging.

You would turn on diagnostics logs on all Network Security Groups. To do this, go to Monitoring > select Diagnostics logs > select "Turn on diagnostics."

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log

Then collect logs for sentinel ("How can I collect from a supported Azure source?"):

https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources#map-data-types-with-azure-sentinel-connection-options

Let me know if this is what you are looking for or if you need additional information.