Exam SC-100 topic 3 question 36 discussion

To ingest events from the firewalls into Microsoft Sentinel, you should include the following recommendation: B. An on-premises Syslog server Setting up an on-premises Syslog server is a common approach for collecting and forwarding logs from various devices, including firewalls, to a central location for further processing and analysis. You can configure the Syslog server to receive logs in the Common Event Format (CEF) from your firewalls and then forward those logs to your Microsoft Sentinel workspace. Microsoft Sentinel has built-in support for Syslog, making it a suitable choice for this scenario.

https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-options https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format

https://learn.microsoft.com/en-us/azure/sentinel/connect-syslog

Correct answer

This server can receive the CEF logs from the firewalls and forward them to Microsoft Sentinel using the Syslog connector. This solution allows you to collect and analyze firewall logs in Microsoft Sentinel, even if there is no built-in connector for the firewalls. https://www.microsoft.com/insidetrack/blog/moving-to-next-generation-siem-at-microsoft-with-microsoft-azure-sentinel/