{"id":1150,"date":"2023-04-02T20:28:11","date_gmt":"2023-04-02T19:28:11","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=1150"},"modified":"2023-04-10T11:13:42","modified_gmt":"2023-04-10T10:13:42","slug":"clientinspector-a-cool-showcase-to-demonstrate-log-ingestion-api-azure-log-ingestion-pipeline-azure-data-collection-rules-and-my-new-powershell-module-azlogdcringestps","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=1150","title":{"rendered":"ClientInspector – a cool showcase to demonstrate Log ingestion API, Azure Log Ingestion Pipeline, Azure Data Collection Rules and my new Powershell module AzLogDcrIngestPS"},"content":{"rendered":"\n

Are you in control?<\/strong> – or are some of your core infrastructure processes like patching, antivirus, bitlocker enablement<\/strong> drifting? Or would you like to do advanced inventory<\/strong>, where you can lookup your warranty state<\/strong> against Lenovo or Dell warranty, then keep reading.<\/p>\n\n\n\n

Check out ClientInspector<\/strong> (github)<\/a>, which can help you get great insight<\/strong> to your complete client environment<\/strong>.<\/p>\n\n\n\n

ClientInspector is free<\/strong> to the community – built to be a cool showcase<\/strong> of how you can bring back data<\/strong> from your clients using Azure Log Ingestion Pipeline<\/strong>, Azure Data Collection Rules<\/strong>, Azure LogAnalytics<\/strong>; view them with Azure Monitor & Azure Dashboards<\/strong> – and get “drift-alerts” using Microsoft Sentinel<\/strong>.<\/p>\n\n\n\n

The little “helper” that makes the magic is my new Powershell module, AzLogDcrIngestPS<\/strong> (github)<\/a>. I have also written a blog-post about this module<\/a><\/p>\n\n\n\n

You can get the whole infrastructure for ClientInspector up and running within 10 min using the DeploymentKit for ClientInspector (github).<\/a><\/p>\n\n\n\n

Video 3m 01s – Dashboards<\/a><\/p>\n\n\n\n

<\/p>\n\n\n\n

Quick Links<\/h1>\n\n\n\n

What data is being collected ?<\/a>
Desired State Dashboards – How to get insight of my environment from the data ?<\/a>
How do I query the data? – Kusto (KQL) is the answer<\/a>
Architecture, Schema & Networking<\/a>
Implementation<\/a>
Dependencies<\/a>
Running ClientInspector.ps1 – 3 modes<\/a>
Sample output of ClientInspector<\/a>
Security<\/a>
Layout of ClientInspector data-set<\/a>
Verbose-mode & More help<\/a>
Cost – How much does it cost to store these data ?<\/a>
Contact<\/a><\/p>\n\n\n\n

<\/p>\n\n\n\n

Videos of solution<\/h1>\n\n\n\n

Video 3m 19s – Running ClientInspector using commandline (normal mode)<\/a>
Video 1m 40s – Automatic creation of 2 tables & DCRs (verbose mode)<\/a>
Video 1m 37s – Automatic creation of 2 tables & DCRs (normal mode)<\/a>
Video 1m 34s – See schema of DCR and table)<\/a>
Video 2m 19s – Data manipulation<\/a>
Video 1m 58s – Kusto queries against data<\/a>
Video 3m 01s – Dashboards<\/a>
Video 0m 48s – Sample usage of data – lookup against Lenovo warranty db<\/a>
Video 7m 25s – Deployment via ClientInspector DeploymentKit<\/a><\/p>\n\n\n\n

<\/a><\/h3>\n\n\n\n

Archicture & flow of ClientInspector<\/h1>\n\n\n\n

ClientInspector (v2) is uploading the collected data into custom logs<\/strong> in Azure LogAnalytics workspace<\/strong> – using Log ingestion API<\/strong>, Azure Data Collection Rules (DCR)<\/strong> and Azure Data Collection Endpoints (DCE)<\/strong>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/a>Sample Dashboards<\/h1>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"Antivirus\"\/<\/a><\/figure>\n\n\n\n
\"Bluescreens\"\/<\/a><\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/a>Disclaimer<\/h1>\n\n\n\n

It is important for me to state that I’m not trying to build a separate management tool, which will compete with Microsoft security and management stack.<\/p>\n\n\n\n

Nothing beats Microsoft Azure\/M365 management and security stack. They are rock star solutions.<\/p>\n\n\n\n

But I’m really passioned<\/strong> about the logging capabilities<\/strong> and the power to bring data back from clients, servers, cloud and 3rd party systems<\/strong> – and getting cool valueable information out of the data<\/strong>.<\/p>\n\n\n\n

I have a similar solution for servers<\/strong> – ServerInspector<\/strong>. Unfortunately, it is not public.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Happy hunting \ud83d\ude04<\/p>\n\n\n\n

<\/p>\n\n\n\n

Big thanks – you are rock stars \ud83d\ude42<\/h1>\n\n\n\n

Lastly, I would like to give big credits<\/strong> to a few people, who I have worked together with on building AzLogDcrIngestPS Powershell module<\/strong> and my daily work with the Azure log & viewing capabilities<\/strong>:<\/p>\n\n\n\n

Name<\/th>Role<\/th><\/tr><\/thead>
Ivan Varnitski<\/td>Program Manager – Azure Pipeline<\/td><\/tr>
Evgeny Ternovsky<\/td>Program Manager – Azure Pipeline<\/td><\/tr>
Nick Kiest<\/td>Program Manager – Azure Data Collection Rules<\/td><\/tr>
Oren Salzberg<\/td>Program Manager – Azure LogAnalytics<\/td><\/tr>
Guy Wild<\/td>Technical Writer – Azure LogAnalytics<\/td><\/tr>
John Gardner<\/td>Program Manager – Azure Workbooks<\/td><\/tr>
Shikha Jain<\/td>Program Manager – Azure Workbooks<\/td><\/tr>
Ingo Bringemeier<\/td>Principal Program Manager – Azure Monitor<\/td><\/tr>
Shayoni Seth<\/td>Program Manager – Azure Monitor Agent<\/td><\/tr>
Jeff Wolford<\/td>Program Manager – Azure Monitor Agent<\/td><\/tr>
Xema Pathak<\/td>Program Manager – Azure VMInsight (integration to Azure Monitor Agent)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

Are you in control? – or are some of your core infrastructure processes like patching, antivirus, bitlocker enablement drifting? Or would you like … <\/p>\n

Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":1370,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[140,55,59,129,131,61,128,54,143,141,57,130,28,139,136,138,137,142,56,133,134,146,60,132,58,145,135,144],"tags":[],"class_list":["post-1150","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ama","category-azure","category-azure-arc","category-azure-data-collection-rules","category-azure-data-ingestion-pipeline","category-azure-extensions","category-azure-log-ingestion-api","category-azure-loganalytics","category-azure-logging","category-azure-monitor-agent","category-azure-security","category-clientinspector","category-community","category-data-collection-endpoint","category-data-transformation","category-dce","category-dcr","category-logging","category-m365-security","category-microsoft-security","category-mvpbuzz","category-performance-collection","category-scripting","category-security","category-sentinel","category-servicemap","category-transformation","category-vminsight","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/ClientInspector_300.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/03\/ClientInspector_300.png","_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1150","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1150"}],"version-history":[{"count":19,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1150\/revisions"}],"predecessor-version":[{"id":2255,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1150\/revisions\/2255"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/1370"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1150"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1150"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1150"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}