search

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.6k stars 3.02k forks source link

Auth0 Function App logs not posting into Sentinel #11403

Open duckngooser opened 6 days ago

duckngooser commented 6 days ago

We have multiple Auth0 function apps that used to successfully load logs into Azure sentinel. The function apps appear to be working as they're successfully authenticating to Auth0 and pulling down the logs based on the Auth0 audit logs and Function App logs. The Function App is logging that it successfully sends "x" number of logs to Sentinel. Upon checking sentinel, we're not finding any logs. We've tried deleting the Auth0 Function App from content hub and re-installing. We've deleted the Auth0AM_CL table on the log analytics workspace to see if it'll re-created. We've tried deleting and recreating one of the function apps, but we end up in the same position. We've verified the Workspace ID/KEY saved in the function app are correct.

Any ideas what we're missing or how to troubleshoot where these logs/events are going?

v-rusraut commented 3 days ago

Hi @duckngooser , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

v-sudkharat commented 2 days ago

@duckngooser, you can verify the below settings :

  1. Please update the existing solution to latest one, which is currently - 3.0.0

  2. In initial deployment of the connector, check the Workspace ID and Key has been entered: Image

  3. You can also confirm the same in function app settings as well: Image

The both the values should be same.

As the table has been deleted from the workspace, So we would suggest please do the fresh installation and deployment of connector in a new workspace.

v-sudkharat commented 3 hours ago

@duckngooser, Did you get a change to check on above comment. waiting for your response. Thanks!