Collect Azure API Management logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This document explains how to export Azure API Management logs to Google Security Operations using an Azure Storage Account.

Before you begin

• Ensure that you have A Google SecOps instance.
• Ensure that you have an active Azure tenant.
• Ensure that you have privileged access to Azure.

Configure Azure Storage Account

1. In the Azure console, search for Storage accounts.
2. Click + Create.
3. Specify values for the following input parameters:
   • Subscription: select the subscription.
   • Resource Group: select the resource group.
   • Region: select the region.
   • Performance: select the performance (Standard recommended).
   • Redundancy: select the redundancy (GRS or LRS recommended).
   • Storage account name: enter a name for the new storage account.
4. Click Review + create.
5. Review the overview of the account and click Create.
6. From the Storage Account Overview page, select the Access keys submenu in Security + networking.
7. Click Show next to key1 or key2
8. Click Copy to clipboard to copy the key.
9. Save the key in a secure location for later use.
10. From the Storage Account Overview page, select the Endpoints submenu in Settings.
11. Click Copy to clipboard to copy the Blob service endpoint URL (for example, https://<storageaccountname>.blob.core.windows.net)
12. Save the endpoint URL in a secure location for later use.

Configure Log Export for Azure API Management Logs

1. Sign in to the Azure Portal using your privileged account.
2. In the Azure portal, find and select the API Management service instance.
3. Select Monitoring > Diagnostic settings.
4. Click + Add diagnostic setting.
   • Enter a descriptive name for the diagnostic setting.
5. Select Logs related to ApiManagement Gateway.
6. Select the Archive to a storage account checkbox as the destination.
   • Specify the Subscription and Storage Account.
7. Click Save.

Configure a feed in Google SecOps to ingest the Azure API Management logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, Azure API Management Logs).
4. Select Microsoft Azure Blob Storage as the Source type.
5. Select Azure API Management as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • Azure URI: the blob endpoint URL.
     • ENDPOINT_URL/BLOB_NAME
       • Replace the following:
       • ENDPOINT_URL: the blob endpoint URL (https://<storageaccountname>.blob.core.windows.net)
       • BLOB_NAME: the name of the blob (such as, insights-logs-<logname>)
   • URI is a: select the URI TYPE according to log stream configuration (Single file | Directory | Directory which includes subdirectories).

   • Source deletion options: select the deletion option according to your preference.

     Note: If you select the Delete transferred files or Delete transferred files and empty directories option, make sure that you granted appropriate permissions to the service account.

   • Shared key: the access key to the Azure Blob Storage.

   • Asset namespace: the asset namespace.

   • Ingestion labels: the label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

Changes

2024-10-30

• Newly created parser.

Need more help? Get answers from Community members and Google SecOps professionals.