Microsoft Azure Platform

Microsoft Azure Platform DSM Specifications

When you configure the Microsoft Azure Platform DSM, understading the specifications for the Microsoft Azure Platform DSM can help ensure a successful integration. For example, knowing what event format is supported before you begin can help reduce frustration during the configuration process:

Table 1: Microsoft Azure Platform DSM Specifications

Specification	Value
Manufacturer	Microsoft
DSM name	Microsoft Azure Platform
RPM file name	DSM-MicrosoftAzurePlatform- JSA_version-build_number .noarch.rpm
Supported versions	N/A
Protocol	Microsoft Azure Event Hubs
Event format	JSON
Recorded event types	Platform level activity logs.
Automatically discovered?	Yes Note: This DSM automatically discovers only Activity Log Events that are forwarded directly from the Activity Log to the Event Hub.
Includes identity?	No
Includes custom properties?	No
More information	Microsoft Azure website (https://azure.microsoft.com)

Configuring Microsoft Azure Event Hubs to Communicate with JSA

The Microsoft Azure Event Hubs protocol collects Azure Activity logs, Diagnostic logs, and Syslog events from the Microsoft Azure Event Hubs cloud storage.

To collect events from Microsoft Azure Event Hubs, you need to create a Microsoft Azure Storage Account and an Event Hub entity under the Azure Event Hub Namespace. For every Namespace, port 5671 and port 5672 must be open. For every Storage Account, port 443 must be open. The Namespace host name is usually [Namespace Name].servicebus.windows.net and the Storage Account host name is usually [Storage_Account_Name].blob.core.windows.net. The Event Hub must have at least one Shared Access Signature that is created with Listen Policy and at least one Consumer Group.

Note:

The Microsoft Azure Event Hubs protocol can't connect by using a proxy server.

Event Hub names must start with a letter or number and contain only letters, numbers, and the dash (-) character. Every dash (-) character must be immediately preceded and followed by a letter or number. Do not use consecutive dashes. All letters must be lowercase. The name must be from 3 - 63 characters.

1. Obtain a Microsoft Azure Storage Account Connection String.

   The Storage Account Connection String contains authentication for the Storage Account Name and the Storage Account Key that is used to access the data in the Azure Storage account.

   1. Log in to the (https://portal.azure.com).

   2. From the dashboard, in the All resources section, select a Storage account.

   3. From the Storage account menu, select Access keys.

   4. Record the value for the Storage account name. Use this value for the Storage Account Name parameter value when you configure a log source in JSA.

   5. From the Key 1 or Key 1 section, record the following values.

      1. KEY - Use this value for the Storage Account Key parameter value when you configure a log source in JSA.

      2. CONNECTION STRING - Use this value for the Storage Account Connection String parameter value when you configure a log source in JSA.

         Most storage accounts use core.window.net for the end point suffix, but this value can change depending on it's location. For example, a government related storage account might have a different endpoint suffix value.

         Note:

         You can use the Storage Account Name and Storage Account Key values or you can use the Storage Account Connection String value to connect to the Storage Account.

2. Obtain a Microsoft Azure Event Hub Connection String.

   The Event Hub Connection String contains the Namespace Name, the path to the Event Hub within the namespace and the Shared Access Signature (SAS) authentication information.

   1. Log in to the (https://portal.azure.com).

   2. From the dashboard, in the All resources section, select an Event Hubs Namespace. Record this value to use as the Namespace Name parameter value when you configure a log source in JSA.

   3. In the Entities section, select Event Hubs. Record this value to use for the Event Hub Name parameter value when you configure a log source in JSA.

   4. In the Event Hub section, select an Event Hub from the list.

   5. In the Settings section, select Shared access policies.

      1. Select a POLICY that contains a Listen CLAIMS. Record this value to use for the SAS Key Name parameter value when you configure a log source in JSA.

      2. Record the values for the following parameters:

         • Primary key or Secondary key - Use the value for the SAS Key parameter value when you configure a log source in JSA.

         • Connection string-primary key or Connection string-secondary key - Use this value for the Event Hub Connection String parameter value when you configure a log source in JSA.

         Note:

         You can use the Namespace Name, Event Hub Name, SAS Key Name and SAS Key values, or you can use the Event Hub Connection String value to connect to the Event Hub.

3. In the Entities section, select Consumer groups. Record the value to use for the Consumer Group parameter value when you configure a log source in JSA.

Microsoft Azure Log Source Parameters for Microsoft Azure Event Hubs

If JSA does not automatically detect the log source, add a Microsoft Azure Event Hubs log source on the JSA Console by using the Microsoft Azure protocol.

When using the Microsoft Azure protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Microsoft Azure events from Microsoft Azure Event Hubs:

Table 2: Microsoft Azure Log Source Parameters for the Microsoft Azure Event Hubs DSM

Parameter	Value
Log Source type	Microsoft Azure
Protocol Configuration	Microsoft Azure Event Hubs
Log Source Identifier	An identifiable name or IP address for the log source. When the Use as Gateway Log Source field is selected, the Log Source Identifier value is not used.

Microsoft Azure Platform Sample Event Messages

Use these sample event messages as a way of verifying a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Microsoft Azure sample event messages when you use the Microsoft Azure Event Hubs protocol

Sample 1: The following sample event message shows a restart of a virtual machine.

Table 3: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	The LEEF header Event ID field. For example, MICROSOFT.CLASSICCOMPUTE/VIRTUALMACHINES/ RESTART/ ACTION.
Event category	cat
Severity	sev
Source IP	src
Username	usrName
Device Time	devTime

Sample 2: The following sample event message shows the return of the access keys for the specified storage account.

Table 4: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	operationName
Event category	The Event category is located in the resourceId field after the PROVIDERS keyword. For example, MICROSOFT.STORAGE.
Source IP	callerIpAddress
Device Time	time

Sample 3: The following sample event message shows that a specified secret is retrieved from a given key vault.

Table 5: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	operationName
Event category	The Event category is located in the resourceId field after the PROVIDERS keyword. For example, MICROSOFT.KEYVAULT.
Device Time	time
Source IP	callerIpAddress

Sample 4: The following sample event message shows that a user successfully logged in to Microsoft SQL Server.

Table 6: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	The Event ID is comprised from the category and action_name field values. For example, "category":"SQLSecurityAuditEvents" and "action_name":"LOGIN SUCCEEDED" results in an Event ID value of “sqlsecurityauditevents_login succeeded”.
Event category	The Event category is located in the resourceId field after the PROVIDERS keyword. For example, MICROSOFT.SQL.
Device Time	time
Username	server_principal_name
Source IP	client_ip