Ingest Azure Activity Logs

Overview

This document describes the steps required to ingest your Azure Activity logs into Google Security Operations.

Configure a Storage Account

Complete the following steps to configure a Storage account:

  1. In the Azure console, search for Storage accounts.
  2. Click Create.
  3. Select the Subscription, Resource Group, region, performance (recommend Standard), and Redundancy (recommend GRS or LRS) needed for the account, enter a name for the new Storage Account.
  4. Click Review + create, review the overview of the account and click Create.
  5. On the Storage Account Overview page, select Access keys from the left navigation of the window.
  6. Click Show keys and make a note of the shared key for the storage account.
  7. Select Endpoints from the left navigation of the window.
  8. Make a note of the Blob service endpoint. (https://<storageaccountname>.blob.core.windows.net/)

Configure Azure Activity Logging

Complete the following steps to configure Azure Activity logging:

  1. In the Azure console, search for Monitor.
  2. Click the Activity log link in the left navigation of the page.
  3. Click the Export Activity Logs at the top of the window.
  4. Click Add diagnostic Setting.
  5. Select all the categories you wish to export to Google Security Operations.
  6. Under Destination details select Archive to a storage account.
  7. Select the subscription and storage account you created in the previous step.
  8. Click Save.

Configure a feed in Google Security Operations to ingest the Azure logs

Complete the following steps to configure a feed in Google Security Operations to ingest the Azure logs:

  1. Go to Google Security Operations settings, and click Feeds.
  2. Click Add New.
  3. Select Microsoft Azure Blob Storage for Source Type.
  4. Select Microsoft Azure Activity for Log Type.
  5. Click Next.
  6. Under Azure URI, enter the Blob Service endpoint value you recorded earlier, suffixed with insights-activity-logs (for example, https://acme-azure-chronicle.blob.core.windows.net/insights-activity-logs)
  7. Under URI Source Type select Directories including subdirectories.
  8. Under Shared key, enter the shared key value you captured earlier.
  9. Click Next and Finish.