August 14, 2026
Turning a $50 Raspberry Pi into a Security Log Forwarder for Azure Sentinel
A hands-on look at bridging small hardware with modern cloud security tooling. Not a how-to, but, just a glimpse of what Azure is capable…
By Joseph A. M.
3 min read
Turning a $50 Raspberry Pi into a Security Log Forwarder for Azure Sentinel
A hands-on look at bridging small hardware with modern cloud security tooling. Not a how-to, but, just a glimpse of what Azure is capable of.
Starting with the hardware, not the cloud
It's easy to think of "cloud security" as something that only happens inside Azure, AWS, or GCP. In practice, most organizations still have physical devices, on-premises servers, and edge hardware that need to be watched too. That's where Azure Arc comes in. Arc lets you take a machine that isn't an Azure VM, in this case a Raspberry Pi 4 running Raspberry Pi OS (a debian bookworm port), and register it as a resource inside Azure so it can be managed and monitored the same way a native cloud VM would be.
The first surprise was how much attention the operating system choice needed. Azure's Connected Machine agent has a specific list of supported operating systems, and it's picky about architecture, not just distribution name. A 32 bit build won't work at all. Even within Debian, only certain versions have full ARM64 support. So step one wasn't touching Azure at all, it was making sure the Pi was running the right 64 bit build of its OS before any of the cloud tooling would cooperate.
Getting connected
Once the OS was sorted, onboarding to Azure Arc itself was refreshingly straightforward. A single command line tool, a device code login through a browser, and within a couple of minutes the Pi showed up as a resource in the Azure portal, sitting right alongside virtual machines that had never touched a physical desk in their life.
That moment is worth pausing on. A four year old, credit card sized computer, connected via home Wi-Fi, now had a presence inside an enterprise cloud platform. It could be monitored, tagged, and managed with the same tools used for servers costing thousands of times more.
Making it useful: forwarding real logs
Being visible in Azure is nice, but the actual goal was to make the Pi useful as a log forwarder, specifically to feed Common Event Format (CEF) and syslog data into Microsoft Sentinel, Microsoft's cloud security information and event management platform.
This is where things got more hands on. Raspberry Pi OS, based on Debian's newer releases, doesn't ship with a syslog daemon out of the box the way older Linux distributions did. Both rsyslog and syslog-ng needed to be installed manually before any log forwarding could happen. And it turns out you really only want one of them running at a time. They both want to listen on the same network port, and running both active at once just leads to one silently losing that fight in the background.
After settling on a single syslog daemon and configuring it correctly, the CEF connector could be layered on top, and a custom data collection rule was deployed to tell Azure exactly how to route the incoming log data once it reached the cloud.
Why the hybrid part matters more than the cloud part
Here's the thing I keep coming back to. None of the individual steps in this project were exotic. Installing a syslog daemon is decades old, well documented territory. Registering a resource in Azure is a guided, well supported workflow. But stitching the two together, an old school Linux service running on modest ARM hardware, feeding data into a modern cloud security platform, is where the real skill lives.
A lot of security and IT tooling today assumes everything is already cloud native. Spin up a VM, install an agent, done. But that's not the reality most organizations live in. There are branch offices with aging switches, manufacturing floors with air gapped equipment, and yes, the occasional Raspberry Pi quietly doing a job nobody expected it to do. Understanding how to bridge that gap, how to make older or smaller or non traditional hardware speak the same language as a modern cloud platform, is a genuinely valuable and somewhat underrated skill.
The Pi sitting on my desk now streams alerts into Sentinel the same way a full sized server would. It didn't get there because the cloud is magic. It got there because someone took the time to understand both sides of the bridge, the old fashioned Linux plumbing and the modern cloud service, and made sure they actually talked to each other.
That, more than any single tool, is what hybrid infrastructure work actually looks like.