iboss via AMA

Configure AMA Data Connector

Steps to configure the iboss AMA Data Connector

Kindly follow the steps to configure the data connector

Step A. Gather Required Configuration Details in Azure Arc

1. Navigate to Azure Arc ---> Azure Arc Resources ---> Machines. 2. Add a machine ---> Add a single server ---> Generate script. 3. Select the resource group, this should be the same group as the Log Analytics Workspace for your Microsoft Sentinel instance you will be using 4. Select a region and ensure it is in the same region as your Log Analytics Workspace 5. Select Linux as Operating System 6. Click Next 7. Download the script and use this information for the next step when configuring your Microsoft Sentinel AMA integration iboss side. 8. Navigate to the Log Analytics Workspace of your Microsoft Sentinel instance and find it's resource group, workspace name, and workspace id

Step B. Forward Common Event Format (CEF) logs

Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. (Ensure you have the information gathered from the previous section) >1. Navigate to the Integrations Marketplace inside your iboss Console >2. Select Microsoft Sentinel AMA Log Forwarding >3. Select Add Integration 4. Use the information from the script and your log analytics workspace to configure the integration. 5. Add the integration >6. An email with be sent to your iboss alerts email to authenticate. Please do so within five minutes 7. After authenticating, wait 15 to 20 minutes and ensure the Microsoft Sentinel Status of your integration is successful.

Step C. Validate connection

1. Follow the instructions to validate your connectivity: 2. Open Log Analytics to check if the logs are received using the CommonSecurityLog schema. 3. It may take about 20 minutes until the connection streams data to your workspace.