Welcome to pfsense-azure-sentinel Discussions!

[noodlemctwoodle]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[obsjmartin]

First off, thanks so much for setting this up! This is invaluable information and I'm sure this project will get more respect once Azure Sentinel is mainstream.

I have a question about the end of the tutorial, specifically the log_type. Where do you find that in the workspace? Do you have to create a log_type for "pfsense_logstash" in the workspace?
zure_loganalytics {
customer_id => ""
shared_key => ""
log_type => ""

[noodlemctwoodle]

Hello @obsjmartin

You do not need to configure a custom log source in Azure Sentinel "Advanced settings"

The new custom log will be created automatically by the Azure Log Analytics plugin for Logstash. You should find the pfSense/opnSense table in Azure Sentinel > Logs > Custom Logs, as shown below

I've updated the guide to reflect this location 👍

[noodlemctwoodle]

I have also given a better example of how to configure these settings in the guide

 output {
     azure_loganalytics {
         customer_id => "<WORKSPACE ID>"
         shared_key => "<Primary Key>"
         log_type => "<Name of Log>"
     }
 }