Appendix F - Microsoft Sentinel HTTP Log Delivery - DCR ARM Template

In Microsoft Sentinel, Data Collection Rule (DCR) play a vital role in managing how and where logs and telemetry data are ingested. A DCR defines the routing and transformation of incoming data, ensuring it is appropriately processed and directed to the right destination, such as a Log Analytics workspace.

This section will guide you through creating a DCR using a custom Azure Resource Manager (ARM) template. By deploying this template, you can configure a rule to enable Snare Central to send event logs via HTTP log delivery to Microsoft Sentinel. The process involves using the Azure portal to load, customize, and deploy the template, connecting it to your Log Analytics workspace and Data Collection Endpoint.

1. Access the Azure Custom Template Service:

   • Navigate to the Azure portal and open the Deploy a custom template service.

2. Load the DCR ARM Template:

   • Click Build your own template in the editor

   • Copy one of the DCR ARM Template content and paste it to the template editor window.

     • DCR ARM Template For Single Table (WindowsEvent)

     • DCR ARM Template For Single Table (SecurityEvent)

     • DCR ARM Template For Single Table (Syslog)

     • DCR ARM Template For Multiple Tables (WindowsEvent, SecurityEvent, Syslog)

     • Alternatively, you can just download the file and use the Load file function of the template editor.

3. Save the Template:

   • After you paste or load the template, click Save to proceed.

4. Configure the Subscription and Resource Group:

   • Select the appropriate Subscription and Resource group used by your organization.

5. Configure the Instance details:

   • Set the appropriate Region.

   • Enter a descriptive name for the new Dcr Name (Data Collection Rule Name).

     • e.g. SnareCentral-DCR

   • Provide the Dce Resource Id (Data Collection Endpoint Resource ID).

     • e.g. /subscriptions/01xxxxxx-xxxx-xxxx-…/resourceGroups/…/dataCollectionEndpoints/Sample-sentinel-log-ingestion-name

   • Provide the Log Analytics Workspace Resource Id.

     • e.g. /subscriptions/01xxxxxx-xxxx-xxxx-…/resourcegroups/…/workspaces/Sample-log-analytics-workspace-name

   • Check Xxxx Columns definitions and adjust as needed.

   • Provide Xxxx Transform Kql as needed.

     • see: Create a transformation in Azure Monitor

6. Review and Deploy the DCR:

   • Review the configuration details.

   • Review the tables, column definition and modify as necessary.

     • e.g. Windows Event Columns

   • Click Review + create.

   • Once the validation is successful, click Create to deploy the DCR.

7. Add role assignment

   • Once your deployment is complete, click Go to resource.

   • Once you are in the newly created DCR page, select Access control (IAM).

   • In the Check access page, look for the Grant access to this resource and click Add role assignment.

   • In the Add role assignment page, select Monitoring Metrics Publisher then click Next.

   • Select User, group or service principal for Assign access to.

   • Click Select members and in the Select members page, search for the App name you use in Microsoft Entra App registration step and choose it, then click Select.

   • Click Review + assign and verify the details then click Review + assign to save your role assignment.

   • Wait for around 15 to 30 minutes (sometimes it takes more than an hour) for the permission to take effect.

This guide will help you to quickly modify the existing DCR ARM Template to support additional stream declaration and data flow routing. Whether you're looking to route ingested event logs to a new stream or direct them to a new target table in Microsoft Sentinel, this guide will provide you with the essentials to quickly tailor your DCR configuration to suit your needs.

To add new stream that will enable Snare Central’s HTTP Log Delivery to send event logs to a new Azure Monitor Log Analytics log tables, follow this quick step below to Modify the DCR ARM Template content:

1. Create the columns definition of the target Azure Log Analytics table.

   • In the "parameters" section of the DCR ARM Template, create a new entry similar to windowsEventColumns to define the columns coming from Snare Central, e.g. to send event logs from Snare Central to Azure Log Analytics Syslog table, see Sample syslog table columns definition entry below.

2. Add new streamDeclarations that will be used by Snare Central’s HTTP Log Delivery to send events.

   • Under "resources" > "properties" > "streamDeclarations" create a new entry similar to "Custom-WindowsEvent-Stream" e.g. Custom-Syslog-Stream.

3. Add new dataFlows that will define the flow of event logs from Snare Central to the target Azure Log Analytics table.

   • Under "resources" > "properties" > "dataFlows" create a new entry for the newly created streamDeclarations in the previous step e.g "Custom-Syslog-Stream".

4. Redeploy the modified DCR ARM Template.

   • Just follow the same steps in Creating a Data Collection Rule for Snare Central’s HTTP Log Delivery to Microsoft Sentinel but use the DCR ARM Template you modified instead.