{ "id": "ESI-ExchangeAdminAuditLogEvents", "title": "[Deprecated] Microsoft Exchange Logs and Events", "publisher": "Microsoft", "descriptionMarkdown": "Deprecated, use the 'ESI-Opt' dataconnectors. You can stream all Exchange Audit events, IIS Logs, HTTP Proxy logs and Security Event logs from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This is used by Microsoft Exchange Security Workbooks to provide security insights of your On-Premises Exchange environment", "graphQueries": [ { "metricName": "Total data received", "legend": "[Option1] ExchangeAuditLogs", "baseQuery": "Event | where EventLog == 'MSExchange Management'" }, { "metricName": "Total data received", "legend": "[Option 2] Exchange Eventlogs", "baseQuery": "Event | where EventLog == 'Application'" }, { "metricName": "Total data received", "legend": "[Option 3 & 4] Domain Controllers Security Logs", "baseQuery": "SecurityEvent" }, { "metricName": "Total data received", "legend": "[Option 5] Exchange IIS logs", "baseQuery": "W3CIISLog" }, { "metricName": "Total data received", "legend": "[Option 6] Exchange Message Tracking logs", "baseQuery": "MessageTrackingLog_CL" }, { "metricName": "Total data received", "legend": "[Option 7] Exchange HTTPProxy logs", "baseQuery": "ExchangeHttpProxy_CL" } ], "sampleQueries": [ { "description": "All Audit logs", "query": "Event | where EventLog == 'MSExchange Management' | sort by TimeGenerated" } ], "dataTypes": [ { "name": "Event", "lastDataReceivedQuery": "Event | where EventLog in ('MSExchange Management', 'Application', 'System') | summarize Time = max(TimeGenerated) | where isnotempty(Time)" }, { "name": "W3CIISLog", "lastDataReceivedQuery": "W3CIISLog | summarize Time = max(TimeGenerated) | where isnotempty(Time)" }, { "name": "MessageTrackingLog_CL", "lastDataReceivedQuery": "MessageTrackingLog_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)" }, { "name": "ExchangeHttpProxy_CL", "lastDataReceivedQuery": "ExchangeHttpProxy_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ "Event | where EventLog in ('MSExchange Management', 'Application', 'System') | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", "W3CIISLog | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", "MessageTrackingLog_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", "ExchangeHttpProxy_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)" ] } ], "availability": { "status": 1, "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "read and write permissions.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "read": true, "write": true, "delete": true } }, { "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", "providerDisplayName": "Keys", "scope": "Workspace", "requiredPermissions": { "action": true } } ], "customs": [ { "description": "Azure Log Analytics will be deprecated, to collect data from non-Azure VMs, Azure Arc is recommended. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" }, { "name": "Detailled documentation", "description": ">**NOTE:** Detailled documentation on Installation procedure and usage can be found [here](https://aka.ms/MicrosoftExchangeSecurityGithub)" } ] }, "instructionSteps": [ { "description": ">**NOTE:** This solution is based on options. This allows you to choose which data will be ingest as some options can generate a very high volume of data. Depending on what you want to collect, track in your Workbooks, Analytics Rules, Hunting capabilities you will choose the option(s) you will deploy. Each options are independant for one from the other. To learn more about each option: ['Microsoft Exchange Security' wiki](https://aka.ms/ESI_DataConnectorOptions)" }, { "title": "1. Download and install the agents needed to collect logs for Microsoft Sentinel", "description": "Type of servers (Exchange Servers, Domain Controllers linked to Exchange Servers or all Domain Controllers) depends on the option you want to deploy.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Deploy Monitor Agents", "description": "This step is required only if it's the first time you onboard your Exchange Servers/Domain Controllers", "instructions": [ { "parameters": { "title": "Select which agent you want to install in your servers to collect logs:", "instructionSteps": [ { "title": "[Prefered] Azure Monitor Agent via Azure Arc", "description": "**Deploy the Azure Arc Agent**\n> [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" }, { "title": "Install Azure Log Analytics Agent (Deprecated on 31/08/2024)", "description": "1. Download the Azure Log Analytics Agent and choose the deployment method in the below link.", "instructions": [ { "parameters": { "linkType": "InstallAgentOnNonAzure" }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "2. Deploy log injestion following choosed options", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "[Option 1] MS Exchange Management Log collection", "description": "Select how to stream MS Exchange Admin Audit event logs", "instructions": [ { "parameters": { "title": "MS Exchange Admin Audit event logs", "instructionSteps": [ { "title": "Data Collection Rules - When Azure Monitor Agent is used", "description": "**Enable data collection rule**\n> Microsoft Exchange Admin Audit Events logs are collected only from **Windows** agents.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "Use this method for automated deployment of the DCR.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCROption1-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace Name** 'and/or Other required fields'.\n>4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." }, { "title": "Option 2 - Manual Deployment of Azure Automation", "description": "Use the following step-by-step instructions to deploy manually a Data Collection Rule.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCR, Type Event log", "description": "1. From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Click **+ Create** at the top.\n3. In the **Basics** tab, fill the required fields, Select Windows as platform type and give a name to the DCR. \n4. In the **Resources** tab, enter you Exchange Servers.\n5. In 'Collect and deliver', add a Data Source type 'Windows Event logs' and select 'Custom' option, enter 'MSExchange Management' as expression and Add it.\n6. 'Make other preferable configuration changes', if needed, then click **Create**." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Assign the DCR to all Exchange Servers", "description": "Add all your Exchange Servers to the DCR" } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Data Collection Rules - When the legacy Azure Log Analytics Agent is used", "description": "**Configure the logs to be collected**\n\nConfigure the Events you want to collect and their severities.\n\n1. Under workspace **Legacy agents management**, select **Windows Event logs**.\n2. Click **Add Windows event log** and enter **MSExchange Management** as log name.\n3. Collect Error, Warning and Information types\n4. Click **Save**.", "instructions": [ { "parameters": { "linkType": "OpenSyslogSettings" }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "instructionSteps": [ { "title": "[Option 2] Security/Application/System logs of Exchange Servers", "description": "Select how to stream Security/Application/System logs of Exchange Servers", "instructions": [ { "parameters": { "title": "Security Event log collection", "instructionSteps": [ { "title": "Data Collection Rules - Security Event logs", "description": "**Enable data collection rule for Security Logs**\nSecurity Events logs are collected only from **Windows** agents.\n1. Add Exchange Servers on *Resources* tab.\n2. Select Security log level\n\n> **Common level** is the minimum required. Please select 'Common' or 'All Security Events' on DCR definition.", "instructions": [ { "parameters": { "linkType": "OpenCreateDataCollectionRule", "dataCollectionRuleType": 0 }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "title": "Application and System Event log collection", "instructionSteps": [ { "title": "Data Collection Rules - When Azure Monitor Agent is used", "description": "**Enable data collection rule**\n> Application and System Events logs are collected only from **Windows** agents.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "Use this method for automated deployment of the DCR.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCROption2-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace Name** 'and/or Other required fields'.\n>4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." }, { "title": "Option 2 - Manual Deployment of Azure Automation", "description": "Use the following step-by-step instructions to deploy manually a Data Collection Rule.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCR, Type Event log", "description": "1. From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Click **+ Create** at the top.\n3. In the **Basics** tab, fill the required fields, Select Windows as platform type and give a name to the DCR. \n4. In the **Resources** tab, enter you Exchange Servers.\n5. In 'Collect and deliver', add a Data Source type 'Windows Event logs' and select 'Basic' option.\n6. For Application, select 'Critical', 'Error' and 'Warning'. For System, select Critical/Error/Warning/Information. \n7. 'Make other preferable configuration changes', if needed, then click **Create**." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Assign the DCR to all Exchange Servers", "description": "Add all your Exchange Servers to the DCR" } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Data Collection Rules - When the legacy Azure Log Analytics Agent is used", "description": "**Configure the logs to be collected**\n\nConfigure the Events you want to collect and their severities.\n\n1. Under workspace advanced settings **Configuration**, select **Data** and then **Windows Event logs**.\n2. Click **Add Windows event log** and search **Application** as log name.\n3. Click **Add Windows event log** and search **System** as log name.\n4. Collect Error (for all), Warning (for all) and Information (for System) types\n5. Click **Save**.", "instructions": [ { "parameters": { "linkType": "OpenSyslogSettings" }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "instructionSteps": [ { "title": "[Option 3 and 4] Security logs of Domain Controllers", "description": "Select how to stream Security logs of Domain Controllers. If you want to implement Option 3, you just need to select DC on same site as Exchange Servers. If you want to implement Option 4, you can select all DCs of your forest.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "[Option 3] List only Domain Controllers on the same site as Exchange Servers for next step", "description": "**This limits the quantity of data injested but some incident can't be detected.**" }, { "title": "[Option 4] List all Domain Controllers of your Active-Directory Forest for next step", "description": "**This allows collecting all security events**" } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "title": "Security Event log collection", "instructionSteps": [ { "title": "Data Collection Rules - Security Event logs", "description": "**Enable data collection rule for Security Logs**\nSecurity Events logs are collected only from **Windows** agents.\n1. Add chosen DCs on *Resources* tab.\n2. Select Security log level\n\n> **Common level** is the minimum required. Please select 'Common' or 'All Security Events' on DCR definition.", "instructions": [ { "parameters": { "linkType": "OpenCreateDataCollectionRule", "dataCollectionRuleType": 0 }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "instructionSteps": [ { "title": "[Option 5] IIS logs of Exchange Servers", "description": "Select how to stream IIS logs of Exchange Servers", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Data Collection Rules - When Azure Monitor Agent is used", "description": "**Enable data collection rule**\n> IIS logs are collected only from **Windows** agents.", "instructions": [ { "type": "AdminAuditEvents" }, { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "Use this method for automated deployment of the DCE and DCR.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCE (If not already created for Exchange Servers)", "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCEExchangeServers)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. You can change the proposed name of the DCE.\n5. Click **Create** to deploy." }, { "title": "B. Deploy Data Connection Rule", "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCROption5-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID** 'and/or Other required fields'.\n>4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Option 2 - Manual Deployment of Azure Automation", "description": "Use the following step-by-step instructions to deploy manually a Data Collection Rule.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCE (If not already created for Exchange Servers)", "description": "1. From the Azure Portal, navigate to [Azure Data collection Endpoint](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionEndpoints).\n2. Click **+ Create** at the top.\n3. In the **Basics** tab, fill the required fields and give a name to the DCE. \n3. 'Make other preferable configuration changes', if needed, then click **Create**." }, { "title": "B. Create DCR, Type IIS log", "description": "1. From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Click **+ Create** at the top.\n3. In the **Basics** tab, fill the required fields, Select Windows as platform type and give a name to the DCR. Select the created DCE. \n4. In the **Resources** tab, enter you Exchange Servers.\n5. In 'Collect and deliver', add a Data Source type 'IIS logs' (Do not enter a path if IIS Logs path is configured by default). Click on 'Add data source'\n6. 'Make other preferable configuration changes', if needed, then click **Create**." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Assign the DCR to all Exchange Servers", "description": "Add all your Exchange Servers to the DCR" } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Data Collection Rules - When the legacy Azure Log Analytics Agent is used", "description": "**Configure the logs to be collected**\n\nConfigure the Events you want to collect and their severities.\n\n1. Under workspace advanced settings **Configuration**, select **Data** and then **IIS Logs**.\n2. Check **Collect W3C format IIS log files**\n5. Click **Save**.", "instructions": [ { "parameters": { "linkType": "OpenSyslogSettings" }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "instructionSteps": [ { "title": "[Option 6] Message Tracking of Exchange Servers", "description": "Select how to stream Message Tracking of Exchange Servers", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Data Collection Rules - When Azure Monitor Agent is used", "description": "**Enable data collection rule**\n> Message Tracking are collected only from **Windows** agents.", "instructions": [ { "parameters": { "text": "**Attention**, Custom logs in Monitor Agent is in Preview. The deployment doesn't work as expected for the moment (March 2023).", "inline": false }, "type": "InfoMessage" }, { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "Use this method for automated deployment of the DCE and DCR.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCE (If not already created for Exchange Servers)", "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCEExchangeServers)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. You can change the proposed name of the DCE.\n5. Click **Create** to deploy." }, { "title": "B. Deploy Data Connection Rule and Custom Table", "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCROption6-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID** 'and/or Other required fields'.\n>4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Option 2 - Manual Deployment of Azure Automation", "description": "Use the following step-by-step instructions to deploy manually a Data Collection Rule.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCE (If not already created for Exchange Servers)", "description": "1. From the Azure Portal, navigate to [Azure Data collection Endpoint](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionEndpoints).\n2. Click **+ Create** at the top.\n3. In the **Basics** tab, fill the required fields and give a name to the DCE, like ESI-ExchangeServers. \n3. 'Make other preferable configuration changes', if needed, then click **Create**." }, { "title": "B. Create Custom DCR Table", "description": "1. Download the Example file from [Microsoft Sentinel GitHub](https://aka.ms/Sentinel-Sample-ESI-MessageTrackingExampleFile).\n2. From the Azure Portal, navigate to [Workspace Analytics](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.OperationalInsights%2Fworkspaces) and select your target Workspace.\n3. Click in 'Tables', click **+ Create** at the top and select **New Custom log (DCR-Based)**.\n4. In the **Basics** tab, enter **MessageTrackingLog** on the Table name, create a Data Collection rule with the name **DCR-Option6-MessageTrackingLogs** (for example) and select the previously created Data collection Endpoint.\n5. In the **Schema and Transformation** tab, choose the downloaded sample file and click on **Transformation Editor**.\n6. In the transformation field, enter the following KQL request :\n*source\n| extend TimeGenerated = todatetime(['date-time'])\n| extend\n clientHostname = ['client-hostname'],\n clientIP = ['client-ip'],\n connectorId = ['connector-id'],\n customData = ['custom-data'],\n eventId = ['event-id'],\n internalMessageId = ['internal-message-id'],\n logId = ['log-id'],\n messageId = ['message-id'],\n messageInfo = ['message-info'],\n messageSubject = ['message-subject'],\n networkMessageId = ['network-message-id'],\n originalClientIp = ['original-client-ip'],\n originalServerIp = ['original-server-ip'],\n recipientAddress= ['recipient-address'],\n recipientCount= ['recipient-count'],\n recipientStatus= ['recipient-status'],\n relatedRecipientAddress= ['related-recipient-address'],\n returnPath= ['return-path'],\n senderAddress= ['sender-address'],\n senderHostname= ['server-hostname'],\n serverIp= ['server-ip'],\n sourceContext= ['source-context'],\n schemaVersion=['schema-version'],\n messageTrackingTenantId = ['tenant-id'],\n totalBytes = ['total-bytes'],\n transportTrafficType = ['transport-traffic-type']\n| project-away\n ['client-ip'],\n ['client-hostname'],\n ['connector-id'],\n ['custom-data'],\n ['date-time'],\n ['event-id'],\n ['internal-message-id'],\n ['log-id'],\n ['message-id'],\n ['message-info'],\n ['message-subject'],\n ['network-message-id'],\n ['original-client-ip'],\n ['original-server-ip'],\n ['recipient-address'],\n ['recipient-count'],\n ['recipient-status'],\n ['related-recipient-address'],\n ['return-path'],\n ['sender-address'],\n ['server-hostname'],\n ['server-ip'],\n ['source-context'],\n ['schema-version'],\n ['tenant-id'],\n ['total-bytes'],\n ['transport-traffic-type']*\n\n8. Click 'Run' and after 'Apply'.\n9. Click **Next**, then click **Create**." }, { "title": "C. Modify the created DCR, Type Custom log", "description": "1. From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Select the previously created DCR, like **DCR-Option6-MessageTrackingLogs**.\n3. In the **Resources** tab, enter you Exchange Servers.\n4. In **Data Sources**, add a Data Source type 'Custom Text logs' and enter 'C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\*.log' in file pattern, 'MessageTrackingLog_CL' in Table Name.\n6.in Transform field, enter the following KQL request :\n*source\n| extend TimeGenerated = todatetime(['date-time'])\n| extend\n clientHostname = ['client-hostname'],\n clientIP = ['client-ip'],\n connectorId = ['connector-id'],\n customData = ['custom-data'],\n eventId = ['event-id'],\n internalMessageId = ['internal-message-id'],\n logId = ['log-id'],\n messageId = ['message-id'],\n messageInfo = ['message-info'],\n messageSubject = ['message-subject'],\n networkMessageId = ['network-message-id'],\n originalClientIp = ['original-client-ip'],\n originalServerIp = ['original-server-ip'],\n recipientAddress= ['recipient-address'],\n recipientCount= ['recipient-count'],\n recipientStatus= ['recipient-status'],\n relatedRecipientAddress= ['related-recipient-address'],\n returnPath= ['return-path'],\n senderAddress= ['sender-address'],\n senderHostname= ['server-hostname'],\n serverIp= ['server-ip'],\n sourceContext= ['source-context'],\n schemaVersion=['schema-version'],\n messageTrackingTenantId = ['tenant-id'],\n totalBytes = ['total-bytes'],\n transportTrafficType = ['transport-traffic-type']\n| project-away\n ['client-ip'],\n ['client-hostname'],\n ['connector-id'],\n ['custom-data'],\n ['date-time'],\n ['event-id'],\n ['internal-message-id'],\n ['log-id'],\n ['message-id'],\n ['message-info'],\n ['message-subject'],\n ['network-message-id'],\n ['original-client-ip'],\n ['original-server-ip'],\n ['recipient-address'],\n ['recipient-count'],\n ['recipient-status'],\n ['related-recipient-address'],\n ['return-path'],\n ['sender-address'],\n ['server-hostname'],\n ['server-ip'],\n ['source-context'],\n ['schema-version'],\n ['tenant-id'],\n ['total-bytes'],\n ['transport-traffic-type']* \n7. Click on 'Add data source'." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Assign the DCR to all Exchange Servers", "description": "Add all your Exchange Servers to the DCR" } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Data Collection Rules - When the legacy Azure Log Analytics Agent is used", "description": "**Configure the logs to be collected**\n\n1. Under workspace **Settings** part, select **Tables**, click **+ Create** and click on **New custom log (MMA-Based)**.\n2. Select Sample file **[MessageTracking Sample](https://aka.ms/Sentinel-Sample-ESI-MessageTrackingLogsSampleCSV)** and click Next\n3. Select type **Windows** and enter the path **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\*.log**. Click Next.\n4. Enter **MessageTrackingLog** as Table name and click Next.\n5. Click **Save**.", "instructions": [ { "parameters": { "linkType": "OpenSyslogSettings" }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" }, { "parameters": { "instructionSteps": [ { "title": "[Option 7] HTTP Proxy of Exchange Servers", "description": "Select how to stream HTTP Proxy of Exchange Servers", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Data Collection Rules - When Azure Monitor Agent is used", "description": "**Enable data collection rule**\n> Message Tracking are collected only from **Windows** agents.", "instructions": [ { "parameters": { "text": "**Attention**, Custom logs in Monitor Agent is in Preview. The deployment doesn't work as expected for the moment (March 2023).", "inline": false }, "type": "InfoMessage" }, { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "Use this method for automated deployment of the DCE and DCR.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCE (If not already created for Exchange Servers)", "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCEExchangeServers)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. You can change the proposed name of the DCE.\n5. Click **Create** to deploy." }, { "title": "B. Deploy Data Connection Rule", "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESI-DCROption7-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID** 'and/or Other required fields'.\n>4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Option 2 - Manual Deployment of Azure Automation", "description": "Use the following step-by-step instructions to deploy manually a Data Collection Rule.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "A. Create DCE (If not already created for Exchange Servers)", "description": "1. From the Azure Portal, navigate to [Azure Data collection Endpoint](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionEndpoints).\n2. Click **+ Create** at the top.\n3. In the **Basics** tab, fill the required fields and give a name to the DCE. \n3. 'Make other preferable configuration changes', if needed, then click **Create**." }, { "title": "B. Create Custom DCR Table", "description": "1. Download the Example file from [Microsoft Sentinel GitHub](https://aka.ms/Sentinel-Sample-ESI-HTTPProxyExampleFile).\n2. From the Azure Portal, navigate to [Workspace Analytics](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.OperationalInsights%2Fworkspaces) and select your target Workspace.\n3. Click in 'Tables', click **+ Create** at the top and select **New Custom log (DCR-Based)**.\n4. In the **Basics** tab, enter **ExchangeHttpProxy** on the Table name, create a Data Collection rule with the name **DCR-Option7-HTTPProxyLogs** (for example) and select the previously created Data collection Endpoint.\n5. In the **Schema and Transformation** tab, choose the downloaded sample file and click on **Transformation Editor**.\n6. In the transformation field, enter the following KQL request :\n*source\n| extend TimeGenerated = todatetime(DateTime)\n| project-away DateTime\n*\n\n8. Click 'Run' and after 'Apply'.\n9. Click **Next**, then click **Create**." }, { "title": "C. Modify the created DCR, Type Custom log", "description": "1. From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Select the previously created DCR, like **DCR-Option7-HTTPProxyLogs**.\n3. In the **Resources** tab, enter you Exchange Servers.\n4. In **Data Sources**, add a Data Source type 'Custom Text logs' and enter 'C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Autodiscover\\*.log' in file pattern, 'ExchangeHttpProxy_CL' in Table Name.\n6.in Transform field, enter the following KQL request :\n*source\n| extend TimeGenerated = todatetime(DateTime)\n| project-away DateTime* \n7. Click on 'Add data source'." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Assign the DCR to all Exchange Servers", "description": "Add all your Exchange Servers to the DCR" } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Data Collection Rules - When the legacy Azure Log Analytics Agent is used", "description": "**Configure the logs to be collected**\n\n1. Under workspace **Settings** part, select **Tables**, click **+ Create** and click on **New custom log (MMA-Based)**.\n2. Select Sample file **[MessageTracking Sample](https://aka.ms/Sentinel-Sample-ESI-HttpProxySampleCSV)** and click Next\n3. Select type **Windows** and enter all the following paths **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Autodiscover\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Eas\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Ecp\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Ews\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Mapi\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Oab\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\Owa\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\OwaCalendar\\*.log**, **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\PowerShell\\*.log** and **C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\RpcHttp\\*.log** . Click Next.\n4. Enter **ExchangeHttpProxy** as Table name and click Next.\n5. Click **Save**.", "instructions": [ { "parameters": { "linkType": "OpenSyslogSettings" }, "type": "InstallAgent" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "", "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected. Parsers are automatically deployed with the solution. Follow the steps to create the Kusto Functions alias : [**ExchangeAdminAuditLogs**](https://aka.ms/sentinel-ESI-ExchangeCollector-ExchangeAdminAuditLogs-parser)", "instructions": [ { "parameters": { "title": "Parsers are automatically deployed during Solution deployment. If you want to deploy manually, follow the steps below", "instructionSteps": [ { "title": "Manual Parser Deployment", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "1. Download the Parser file", "description": "The latest version of the file [**ExchangeAdminAuditLogs**](https://aka.ms/sentinel-ESI-ExchangeCollector-ExchangeAdminAuditLogs-parser)" }, { "title": "2. Create Parser **ExchangeAdminAuditLogs** function", "description": "In 'Logs' explorer of your Microsoft Sentinel's log analytics, copy the content of the file to Log explorer" }, { "title": "3. Save Parser **ExchangeAdminAuditLogs** function", "description": "Click on save button.\n No parameter is needed for this parser.\nClick save again." } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" } ] } ], "metadata": { "id": "5738bef7-b6c0-4fec-ba0b-ac728bef83a9", "version": "2.2.2", "kind": "dataConnector", "source": { "kind": "solution", "name": "Microsoft Exchange Security - Exchange On-Premises" }, "support": { "name": "Community", "tier": "Community", "link": "https://github.com/Azure/Azure-Sentinel/issues" }, "author": { "name": "Microsoft" } } }