Custom logs via AMA
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CustomlogsviaAMA |
| Publisher | Microsoft |
| Used in Solutions | CustomLogsAma |
| Collection Method | AMA |
| Connector Definition Files | mainTemplate.json |
| Custom Log V1 Tables | Yes 🔶 — ingests into tables with type-suffixed columns |
| Microsoft Learn | View on Learn |
Many applications log information to text or JSON files instead of standard logging services, such as Windows Event logs, Syslog or CEF. The Custom Logs data connector allows you to collect events from files on both Windows and Linux computers and stream them to custom logs tables you created. While streaming the data you can parse and transform the contents using the DCR. After collecting the data, you can apply analytic rules, hunting, searching, threat intelligence, enrichments and more.
NOTE: Use this connector for the following devices: Cisco Meraki, Zscaler Private Access (ZPA), VMware vCenter, Apache HTTP server, Apache Tomcat, Jboss Enterprise application platform, Juniper IDP, MarkLogic Audit, MongoDB Audit, Nginx HTTP server, Oracle Weblogic server, PostgreSQL Events, Squid Proxy, Ubiquiti UniFi, SecurityBridge Threat detection SAP and AI vectra stream.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
ApacheHTTPServer_CL |
✓ | ✓ | ✓ |
JBossEvent_CL |
✗ | ✓ | ✗ |
JuniperIDP_CL |
✓ | ✓ | ✓ |
MarkLogicAudit_CL |
✗ | ✓ | ✗ |
MongoDBAudit_CL |
✓ | ✓ | ✓ |
NGINX_CL |
✓ | ✓ | ✓ |
OracleWebLogicServer_CL |
✓ | ✓ | ✓ |
PostgreSQL_CL |
✓ | ✓ | ✓ |
SecurityBridgeLogs_CL |
✓ | ✓ | ✓ |
SquidProxy_CL 🔶 |
✓ | ✓ | ✓ |
Tomcat_CL |
✓ | ✓ | ✓ |
Ubiquiti_CL |
✓ | ✓ | ✓ |
VectraStream_CL 🔶 |
✗ | ✓ | ✗ |
ZPA_CL |
✓ | ✓ | ✓ |
meraki_CL |
✓ | ✓ | ✓ |
vcenter_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace data sources (Workspace): read and write permissions.
Custom Permissions:
- Permissions: To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. Learn more
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Enable data collection rule
- Create data collection rule
Custom logs are collected from both Windows and Linux agents. 📋 Additional Configuration Step: This connector includes a configuration step of type
CustomLogsAMA. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊