Ingest Azure audit logs

ledenko

Hi, what's the suggested way of getting Azure audit logs into ELS? I have created an app registration in Azure already and can get logs via MS Graph API, but due to ever changing modules in different elastic/logstash/filebeat version, how would I go about it here?

SzymonC

Hi,
There are two-three main way how we do it, depending on what you're looking for:

We can use logstash plugin to pull data from Azur, using Azure Event Hub.
https://www.elastic.co/guide/en/logstash/7.17/plugins-inputs-azure_event_hubs.html
https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-create
If you are looking for metrics, there are more info about it in our Knowledge Base.
https://kb.energylogserver.com/en/latest/11-Integration/11-Integration.html?#integration-with-azure-o365
If you are looking mainly for anomalies/security or audit monitoring, you can use Wazuh function and Azure principle portal. This approach is easy to configure cost-wise on Azure, because interval how often data is pulled can be easily configured.
Azure principle portal: https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal
Audit O365: https://documentation.wazuh.com/current/cloud-security/office365/index.html
Monitoring Azure with Wazuh: https://documentation.wazuh.com/current/cloud-security/azure/index.html (here's a big, structured chapter about monitoring Azure)

Cloud monitoring is a huge area of Big Data and monitoring, so it's common to feel overwhelmed with all the options and ways. Take it easy, one step at the time. It's good to realize it's not as simple as installing an agent on endpoint, but on the other hand there's a lot to gain by monitoring cloud environment.

If you need dedicated support to go through this with Energy Logserver professional engineers, please reach out to your local ELS distributor and we'll be happy to help you go through this. 💪

ledenko

I'm trying option 3 as I already got Wazuh working on a separate server for this exact purpose. I added configuration for office365 module in ossec.conf but I'm not seeing any data coming into a wazuh* index and Wazuh configuration in ELS tells me I have no access (You have no permissions - This section requires administrator role) .
Szymon, we actually installed ELS together and later on did an upgrade to a newer version, but I'm not sure we did what had to be done to enable Wazuh integration. Looking at documentation, the only thing after an upgrade I can see is moving usr/share/kibana/plugins/wazuh/*.rpmsave but there's nothing there.

SzymonC

Tell me what version of ELS you have, I'll check if it's not past bug with those permission errors.
If anything, we'll schedule session and look deeper into your environment. 🙂

ledenko

ELS version is 7.4.1 updated from 7.3 (I think). I also contacted our local distributer to set up a meeting 🙂

SzymonC

Great, thanks!
We'll update the environment and make sure all components are integrated properly. With that working fine, it'll be easier to follow option 3 for cloud monitoring.