Configure the Tenable Identity Exposure Syslog Collector App

Required User Role: Basic User
Note: The Tenable integration with Microsoft Azure Sentinel works with a Basic User if that user is assigned Can View permissions on the assets they are to export, along with Can Use permissions on tags the assets are assigned. Without the Can Use tag permissions, the assets return undefined or the integration fails to export vulnerabilities if a tag filter is used. For more information on Tenable Vulnerability Management permissions and user roles, refer to Permissions in the Tenable Developer Portal.

The TIE syslog collector allows you to send TIE syslog messages to Microsoft Azure Sentinel for centralized alerting and reporting. Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM), and security orchestration automated response (SOAR) solution. For more information about Microsoft Sentinel, refer to the Microsoft documentation. To complete this setup, follow these configuration processes:

  1. Configure the Syslog server

  2. Install and onboard the Microsoft agent for Linux
  3. Check agent logs on the Syslog server
  4. Configure TenableIE to send logs to your Syslog server
  5. Configure the agent to collect the custom logs

Note: This data connector depends on afad_parser based on a Kusto function to work as expected. This is deployed with the Microsoft Sentinel solution.

Before you begin:

Note: Tenable Identity Exposure currently does not support the Azure Monitor Agent (AMA).

Configure the Syslog Server

Configure rsyslog to accept logs from your TenableIE IP address. Choose one of the following options:

Option 1: Using AllowedSender directive

This configuration restricts which hosts can send logs to your syslog server at the network level. This is more secure as it rejects unauthorized connections before processing them.

  1. Set TenableIE source IP address by running the following command:

    Copy 
    sudo -i
    export TENABLE_IE_IP={Enter your IP address}

  2. Download the configuration file located at 80-tenable-allowedsender.conf by running the following command:

    Copy 
    cat > /etc/rsyslog.d/80-tenable.conf << EOF
    \$ModLoad imudp
    \$UDPServerRun 514
    \$ModLoad imtcp
    \$InputTCPServerRun 514
    \$AllowedSender TCP, 127.0.0.1, $TENABLE_IE_IP
    \$AllowedSender UDP, 127.0.0.1, $TENABLE_IE_IP
    \$template MsgTemplate,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\n"
    \$template remote-incoming-logs, "/var/log/%PROGRAMNAME%.log"
    *.* ?remote-incoming-logs;MsgTemplate
    EOF

  3. Execute the commands from the downloaded configuration file.

  4. Restart rsyslog by running the following command:

    Copy 
    systemctl restart rsyslog

Option 2: Filter logs by source IP (For environments with multiple syslog sources)

This configuration accepts all incoming logs but only processes those from the specified TenableIE IP address. This is useful when you have multiple syslog servers or applications sending logs to the same syslog server, and you want to selectively process only TenableIE logs.

  1. Set TenableIE source IP address by running the following command:

    Copy 
    sudo -i
    export TENABLE_IE_IP={Enter your IP address}

  2. Download the configuration file located at 80-tenable-allowedsender.conf by running the following command:

    Copy 
    cat > /etc/rsyslog.d/80-tenable.conf << EOF
    \$ModLoad imudp
    \$UDPServerRun 514
    \$ModLoad imtcp
    \$InputTCPServerRun 514
    \$template MsgTemplate,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\n"
    \$template remote-incoming-logs, "/var/log/%PROGRAMNAME%.log"
    :fromhost-ip, isequal, "$TENABLE_IE_IP" ?remote-incoming-logs;MsgTemplate
    & stop
    EOF

  3. Execute the commands from the downloaded configuration file.

  4. Restart rsyslog by running the following command:

    Copy 
    systemctl restart rsyslog

Note: The OMS agent receives the TenableIE syslog events and publish them in Microsoft Sentinel instructions.

  1. Choose where to install the agent:

    1. Install agent on Azure Linux Virtual Machine

      1. Select the machine to install the agent on and then click Connect.

      2. Find this URL: InstallAgentOnLinuxVirtualMachine

    2. Install agent on a non-Azure Linux Machine

      1. Download the agent on the relevant machine and follow the instructions

      2. Find this URL: InstallAgentOnLinuxNonAzure

Copy 
```shell
tail -f /var/opt/microsoft/omsagent/log/omsagent.log        
```

  1. In your TenableIE portal, go to System > Configuration > Syslog.

  2. Create a new Syslog alert toward your Syslog server.

  3. Check that the logs are correctly gathered on your server in a separate file (you can use the Test the configuration button in the Syslog alert configuration in TenableIE).

    Note: If you used the Quickstart template, the Syslog server listens by default on port 514 in UDP and 1514 in TCP, without TLS.

  1. In Microsoft Sentinel, go to Configuration > Settings > Workspace settings > Custom logs.

  2. Click Add custom log.

  3. Upload a sample Tenable.ad.log Syslog file from the Linux machine running the Syslog server.

  4. Click Next.

  5. Set the record delimiter to New Line (if not already set).

  6. Click Next.

  7. Select Linux and enter the file path to the Syslog file and click the + icon.

  8. Click Next.

    Note: The default location of the file is /var/log/Tenable.ad.log if you have a Tenable version <3.1.0, you must also add this Linux file location /var/log/AlsidForAD.log.

  9. Set the Name to Tenable_IE_CL.

    Note: Azure automatically adds "_CL" at the end of the name. There must be only one addition, so make sure the name is not Tenable_IE_CL_CL.

  10. Click Next.

  11. Click Create.