This document describes the steps required to ingest your Azure logs into Chronicle
Configure a Storage Account
- In the Azure console, search for "Storage accounts".
2. Click Create.
3. Select the Subscription, Resource Group, region, performance (recommend Standard), and Redundancy (recommend GRS or LRS) needed for the account, enter a name for the new Storage Account.
4. Click Review + create, review the overview of the account and click Create.
5. On the Storage Account Overview page, select Access keys from the left navigation of the window.
6. Click Show keys and make a note of the shared key for the storage account.
6. Select Endpoints from the left navigation of the window.
7. Make a note of the Blob service endpoint.
Configure Azure Activity Logging
- In the Azure console, search for "Monitor."
2. Click the Activity log link in the left navigation of the page.
3. Click the Export Activity Logs at the top of the window.
4. Click Add diagnostic Setting.
5. Select all the categories you wish to export to Chronicle.
6. Under Destination details, select Archive to a storage account.
7. Select the subscription and storage account you created in the previous step.
8. Click Save.
Configure a feed in Chronicle to ingest the Azure logs:
- Go to Chronicle settings and click Feeds.
- Click Add New.
3. Select Microsoft Azure Blob Storage for Source Type.
4. Select Microsoft Azure Activity for Log Type.
5. Click Next.
6. Under Azure URI, enter the Blob Service endpoint value you recorded earlier, suffixed with insights-activity-log
(For example, https://acme-azure-chronicle.blob.core.windows.net/insights-activity-log)
7. Under URI Source Type, select Directories including subdirectories.
8. Under Shared key, enter the shared key value you captured earlier.
9. Click Next and Finish.