IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« AWS module CEF module »

› ›

azure module

edit

azure module

edit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

This is the azure module.

The azure module will concentrate on retrieving different types of log data from Azure. There are several requirements before using the module since the logs will actually be read from azure event hubs.

the event hubs the azure module will read logs from must have the kafka option enabled .
the logs have to be exported first to the event hubs https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-create-kafka-enabled
to export activity logs to event hubs users can follow the steps here https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-export
to export audit and sign-in logs to event hubs users can follow the steps here https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub

The module will contain the following filesets:

activitylogs: Will retrieve azure activity logs. Control-plane events on Azure Resource Manager resources. Activity logs provide insight into the operations that were performed on resources in your subscription.
signinlogs: Will retrieve azure Active Directory sign-in logs. The sign-ins report provides information about the usage of managed applications and user sign-in activities.
auditlogs: Will retrieve azure Active Directory audit logs. The audit logs provide traceability through logs for all changes done by various features within Azure AD. Examples of audit logs include changes made to any resources within Azure AD like adding or removing users, apps, groups, roles and policies.

Dashboards

edit

The azure module comes with several predefined dashboards for general cloud overview, user activity and alerts. For example:

Module configuration

edit

- module: azure
  activitylogs:
    enabled: true
    var:
      namespace: "obseventhubs.servicebus.windows.net:9093"
      eventhub: ["insights-operational-logs"]
      consumer_group: "$Default"
      connection_string: ""
   auditlogs:
     enabled: true
     var:
       namespace: ""
       eventhub: ["insights-logs-auditlogs"]
       consumer_group: "$Default"
       connection_string: ""

   signinlogs:
     enabled: true
     var:
       namespace: ""
       eventhub: ["insights-logs-signinlogs"]
       consumer_group: "$Default"
       connection_string: ""

A side by side kafka/event hubs notation, we will follow Azure notations in this case.

namespace: string An Event Hubs namespace provides a unique scoping container, referenced by its fully qualified domain name, in which users can create one or more event hubs or Kafka topics.
eventhub: []string Or kafka topic, is a fully managed, real-time data ingestion service. Default value insights-operational-logs
consumer_group: string The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. Default value: $Default
connection_string: string The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string.

When you run the module, it performs a few tasks under the hood:

Sets the default paths to the log files (but don’t worry, you can override the defaults)
Makes sure each multiline log event gets sent as a single event
Uses ingest node to parse and process the log lines, shaping the data into a structure suitable for visualizing in Kibana

Compatibility

edit

TODO: document with what versions of the software is this tested

Fields

edit

For a description of each field in the module, see the exported fields section.

« AWS module CEF module »