[MUSIC]
Dhanyah Krishnamoorthy: Hi. I’m Dhanyah Krishnamoorthy,
Program Manager in Azure Active Directory team. Today, I’m
going to be talking about an exciting feature that we just
public previewed. It’s called Azure AD logs an Azure
Monitor Diagnostics.
Our customers have been asking us to provide long-term
retention and ability to integrate with your SIEM tools
or custom applications for a while. This is our way of
providing that feature as to you. This particular feature
provides three awesome capabilities that you can leverage
today.
The first one is archiving the data to a storage account,
which means basically you can route these logs to your own
storage account with a simple configuration. Secondly,
you can send these logs to Event Hub for integration, where
many SIEM tools have third party connectors that connect
to them. You could also route these logs to Event Hub
and hook it up with your own custom applications. Thirdly,
we can send these logs to log analytics, where you can
actually use Kusto queries to write advanced queries as
well as create your own custom alerts and manage them.
The work to do for log analytics is not going to be available
for the next few months, but the archiving to the storage
account and sending it to the Event Hub is available as
part of public preview.
Now, let’s jump into a demo.
Here in the Azure AD extension blade, in order to get to
this particular feature, you can either go into the sign-in
logs or the audit logs. In this example, I’m going into
the audit logs. There’s an export data setting button,
which is available for exporting this configuration.
This button will be available for global admins and security
admins. So, as you can see here, you’re taken to a blade
called diagnostic settings. In order to get to this blade, you
need to have an Azure subscription. The reason for this
reason for this is you need to either have a storage account
or an Azure Event Hub in order to route these logs. You
need a destination, so you need to have that setup before
you come and perform this configuration. So, in my case,
I have these particular settings where I’m routing these
logs to both a storage account and an Event Hub, as you
can see here. I’m selecting the two types of logs—audit
and sign-ins. I can select the retention days. What this
means is I can either say, hey, send me all the data up to
180 days or I can say, keep it forever. And in this instance,
I’m just setting it to zero, which means from the time the
data gets routed, I’ll just keep routing until I go and stop
it. I can also go in here and change my storage account
if I want to change it to something else. I can also go
and change my Event Hub settings depending on how
I want to do them. Or if you’re setting it up for the first
time, you’ll go and select the Event Hub from where you
want to stream these logs to your SIEM tool.
So, once you’ve done this, you save it. Within 2-10
minutes, this data will be available in your storage account
and Event Hub. So, let’s go to the storage account that I
have here. So, when you go into the blob, you will see
that there are two containers—audit and sign-ins. The
sign-ins stream is stored here and the audit stream is
stored in the audit container. So, I’m going to the sign-in
stream here.
You will see the tenant ID for which you’ve done the
configuration. You will see year, month, and date format
where that’s how the blob is stored. So, you go into one
specific day, pick a specific hour where it’s stored, and
then just open the JSON to see the format of it.
So, this is the JSON format in which the logs are stored.
As you can see here, we have a properties tag
under which most of the attributes are stored. We have
entered the same schema as the MS Graph schema for
easier reference, so you can look at the MS Graph API
reference doc to understand what are all the properties
that we image for sign-ins.
You can also route this information to a Splunk tool. So.,
in this example, we have used Splunk as our SIEM
integration, and what we have done there is gone and
provided a Splunk integration for the logs.
We have an Azure Monitor add-on for Splunk, which we
have used and we have updated that to include two set
of streams. When you go to the source types, once
you have set it up, you will see that there’s audit and
sign-ins available here. All you need to do is download
the add-on for Splunk, set up the configuration to point
to the Event Hub where you have routed these logs.
And then when you open Splunk, you will see these two
streams available. So, you click on the sign-in stream
here, for example, and you will see all the logs available
in the JSON format that I just showed you previously.
You click on the properties, you will see all the additional
information that I showed you through the UX through the
API, which is also available here. And using Splunk, you
can build visualizations and dashboards on top of this data
and use it for your operational needs.
This is how easy it is to set this up and it will just take a
few minutes for you to set up the whole thing once you have
the Event Hub and storage account set up.
The other SIEM tools that we have integration with are
Curator and Suma Logic. You can find documentation
available online to see how you can integrate them.