InTrust 11.4.2 - Auditing Microsoft Azure

Collecting Events from Azure Virtual Machines

Working with Azure virtual machine collections is similar to working with regular Windows collections, except that an Azure collection has additional settings for communication between Azure and the on-premises InTrust server.

In InTrust Deployment Manager, go to the Collections tab, click New and select Azure Collection.

On the Azure Virtual Machine Settings step, supply the Azure-specific configuration options:

• Resource group name
• Tenant ID
• Application ID
• Application key
• Subscription ID
• Connection string used by the storage account
  If you are collecting events both from virtual machines and from event hubs, it is recommended that you have separate storage accounts for each purpose. For virtual machine auditing, use a storage account that supports file storage.

If you don't know where to get any of these items, see Providing Access to Your Azure Environment.

The remaining steps are the same as for regular Windows collections.

Azure Collection Specifics

• Only one Azure collection is allowed per InTrust organization.
• You cannot manually edit the membership of an Azure collection. It is populated automatically based on the contents of the Azure resource group that it is associated with. To collect from the right virtual machines, make sure you select the right resource group.

Collecting Events from Azure Event Hubs

Azure log (Event Hub) collections let you gather events that Azure objects direct to event hubs, including diagnostic events, activity logs and metrics.

To stream Activity log events to an event hub

1. In the Azure portal, navigate to Monitor| Activity log.
2. Select Diagnostic Settings and click Add diagnostic setting.
3. Under Category details, select the kinds of events that you want to export.
4. Under Destination details, select Stream to an event hub.
5. Select your subscription and namespace for the event hub.
6. Specify the Event hub name or leave it blank. If you omit it, Azure will use the predefined name "insights-activity-logs".
7. Select RootManagedSharedAccessKey as the policy.
8. Save the changes.

To create an Azure log (Event Hub) collection

In InTrust Deployment Manager, go to the Collections tab, click New and select Azure log (Event Hub) Collection.

On the Specify Azure Subscriptions step, click Add and specify the event hub that you need. Supply the following options:

• Event hub name
  This is either the name of the particular event hub, which you can look up in the Azure portal. Some event hub names are predefined. For example, if you need the event hub with Azure Activity log events, supply the name of an event hub to which the Activity log is streamed. However, you should first make sure that the event hub really exists in the correct event hubs namespace.
  For details about setting up redirection of events to event hubs, see Stream Azure monitoring data to an event hub. For details about Activity log events, see To stream Activity log events to an event hub above.
• Consumer group name
  You should create a separate consumer group specifically for event hub auditing in advance.
• Event hub connection strings
• Storage connection strings
  If you are collecting events both from virtual machines and from event hubs, it is recommended that you have separate storage accounts for each purpose. For event hub auditing, it is sufficient to use a storage account that supports only blob storage.

If you don't know where to get any of these items, see Providing Access to Your Azure Environment above.

The remaining steps are the same as for regular Windows collections.

Azure Log (Event Hub) Collection Specifics

• The members of an Azure log (Event Hub) collection are Azure event hubs not computers. You can have multiple Events Hubs in a single collection.
• Only one preselected non-editable "Azure Log" data source can be associated with this type of collection.
• If you collect Activity log events from an event hub, the scope of those events is the entire Azure subscription. If you are interested in just the resource group you are auditing with your Azure collection, be prepared to get Activity log events for a lot more than that.
• Due to the way these collections work, InTrust Deployment Manager may temporarily show valid errors about network connectivity that may have already been resolved. If such an error doesn't go away after a few minutes, you should investigate the situation, but you don't necessarily have to take immediate action as soon as you see the error.

Analyzing Azure Events

After you have made sure that InTrust collects data from Azure, use InTrust Repository Viewer to connect to the repository that stores the events and view them.

Events from Windows virtual machines in Azure are no different from on-premises Windows events, and all of your familiar Repository Viewer searches are compatible with them.

For events that originate in Azure rather than on Azure-hosted virtual machines, the Azure Knowledge Pack provides the following predefined Repository Viewer searches:

• All activity and diagnostic events
• All administrative events (RBAC changes) by who, what
• Key vault activity
• Resource-level events by subscription ID, resource group, provider
• Resource-level events by who, what, where
• SQL activity
• Tenant-level events by tenant ID, provider
• Tenant-level events by who, what, where

Use these searches directly or make customized copies of them to suit your needs.

Known Issues

The following issues are known at the time of the Azure Knowledge Pack technical preview for InTrust 11.4.1.

Table 1: Azure Knowledge Pack installation known issues

Table 2: Azure Knowledge Pack general known issues