In this demonstration, we'll do all our work in Microsoft Azure.
Specifically, we'll look at the Log Analytics workspace,
Microsoft Sentinel, and we'll revisit Defender for Cloud,
which we've used a bit in the past,
but it's always good to revisit to reintegrate our knowledge.
You're looking at the desktop of a Windows 10 domain‑joined workstation.
Not that it matters because as long as you've got an internet connection,
you can get into the Azure portal.
So here we are at portal.azure.com, and let's go over to Log Analytics.
Recall that the Log Analytics workspace is where all the
so‑called magic happens as far as collecting diagnostics logs
for not just your Azure resources, but your off‑cloud resources as well,
including your on‑premises servers.
So you can see here I have one infrastructure workspace
called tim‑laworkspace‑01 and another that I've created
specifically for Microsoft Sentinel.
That's what I called sentinel‑workspace.
Let's take a look at my infrastructure workspace. And just
to show you around here for a moment,
if we come down under Workspace Data Sources, an easy way to onboard your
Azure virtual machines is simply to come here. As you can see, I've got a
Windows Server virtual machine that's not connected currently. I can
deliver the Log Analytics agent to that machine very easily this way
directly through the portal.
Now,
ideally, you can also onboard the machine into Log
Analytics using the ARM template.
You can add the extension syntax there.
You also can configure your workspace itself for automatic onboarding.
You can do that also, come to think of it, in Microsoft Defender for Cloud.
So there's certainly lots of ways to ensure that your managed
Azure virtual machines will send their diagnostics into the
central Log Analytics workspace.
Now I want to say that although the workspace is
associated with an Azure region,
the VMs that you see here will be both Windows and Linux Azure
VMs in any location, that is any region, in any subscription
that trusts your Azure AD tenant.
Now as far as your off‑cloud machines, again, there's lots of different options.
The manual route is to come up to Agents management, and you can
download and install the Log Analytics agent right here. You can
grab the installer, and then when you run the installer on the
destination machine, you provide the workspace ID and primary key.
Now this is for Windows Server, not for Windows workstations, so I'm not sure,
I don't think it would work for this Windows 10 machine.
So, therefore, why don't I, through the magic of video editing,
come on over to one of my on‑premises Windows Server machines,
and let me just show you how this works.
It's a good thing to understand.
Now this is the Log Analytics agent, but notice that the executable is
MMASetup. That stands for a Microsoft Management Agent.
They're all synonymous terms. Please be aware of that.
So let's open up that file and run the installer again. You may very well
have something like Configuration Manager running on‑prem where you don't
need to worry about manually installing software.
I'm doing this intentionally to show you the flow.
So it goes under the software,
the agent goes under Program Files\Microsoft Monitoring
Agent. And we want to choose Connect the agent to Azure
Log Analytics. And as, again,
I told you, all the product name changes, Operations Management Sweet, or OMS,
was the original name for the product, so don't be thrown off by that. In
order to authenticate the agent into the workspace,
we're going to need the workspace ID and one of the two API keys. So
let me copy the workspace ID, and I'll Ctrl+V that in, and I'll just
grab one of the API keys. Notice the Regenerate buttons. Those are
very important because we want to ensure to cycle those every so often
to prevent leakage and possible unauthorized servers reporting into
the workspace.
I'm not on a Government, or sovereign, cloud.
I'm in Azure Commercial, so I'll leave that alone.
Click Next. And there you have it.
Now you might be wondering a couple things.
One,
how can you configure the Microsoft Monitoring Agent after it's installed
on a Windows machine that could be an EC2 instance in Amazon, could be a
physical or virtual machine running on‑premises? It doesn't matter a bit.
Well, the way you get to those agent properties on the workstation is
through Control Panel.
So let me open up the old‑fashioned Control Panel applet here, and
you want to find Microsoft Monitoring Agent. And this is something
important for the sake of Sentinel as well.
We'll go to Azure Log Analytics (OMS), and you can actually configure
Windows virtual machines to report to more than one Log Analytics
workspace. You could just do Add, and were given an opportunity to supply
another workspace ID and workspace key.
So this means this machine could simultaneously report to our
infrastructure Log Analytics instance, as well as our Microsoft
Sentinel instance, you see? All right,
so that is that. The other thing, let me come back into the portal
here, if we go to Agents configuration, this is where we can
customize the Windows event log streams that we're gathering, as
well as performance counters.
Now nothing is going to be collected by default, so you can add those in
and remove them when you don't need them anymore, and you can grab custom,
as well as built‑in logs and performance counters. You're wondering, is it
possible to have custom, custom logs, that is ones that your developers
have created from scratch?
Oh yeah, absolutely.
Right here, Custom logs. There's a good Docs article on this. Check the exercise files for more details on that