Collect Microsoft Azure Resource logs

This document explains how to collect Microsoft Azure Resource logs by setting up a Google Security Operations feed using Microsoft Azure Blob Storage V2.

Azure resource logs provide insight into operations performed within Azure resources. These logs capture detailed information about resource operations, status, and performance metrics. The content varies by resource type and includes data such as authentication events, configuration changes, access attempts, and operational metrics.

Before you begin

Ensure that you have the following prerequisites:

• A Google SecOps instance

• Privileged access to Microsoft Azureportal with permissions to:

  • Create Storage Accounts
  • Configure Diagnostic Settings for Azure resources
  • Manage access keys

Configure Azure Storage Account

Create Storage Account

1. In the Azure portal, search for Storage accounts.
2. Click + Create.

3. Provide the following configuration details:

   Setting	Value
   Subscription	Select your Azure subscription
   Resource group	Select existing or create new
   Storage account name	Enter a unique name (for example, azureresourcelogs )
   Region	Select the region (for example, East US )
   Performance	Standard (recommended)
   Redundancy	GRS (Geo-redundant storage) or LRS (Locally redundant storage)

4. Click Review + create.

5. Review the overview of the account and click Create.

6. Wait for the deployment to complete.

Get Storage Account credentials

1. Go to the Storage Accountyou just created.
2. In the left navigation, select Access keysunder Security + networking.
3. Click Show keys.

4. Copy and save the following for later use:

   • Storage account name: azureresourcelogs
   • Key 1or Key 2: The shared access key (a 512-bit random string in base-64 encoding)

Get Blob Service endpoint

1. In the same Storage Account, select Endpointsfrom the left navigation.
2. Copy and save the Blob serviceendpoint URL.
   • Example: https://azureresourcelogs.blob.core.windows.net/

Configure Azure Resource Diagnostic Settings

Azure resource logs are not collected by default. You must create a diagnostic setting for each Azure resource to route logs to the storage account.

1. In the Azure portal, navigate to the Azure resource you want to monitor.
2. In the left navigation, select Diagnostic settingsunder Monitoring.
3. Click + Add diagnostic setting.
4. Provide the following configuration details:
   • Diagnostic setting name: Enter a descriptive name (for example, export-to-secops ).
   • In the Logssection, select the log categories you want to collect. The available categories vary by resource type. Common categories include:
     • Administrative(for Activity Logs)
     • Security(for Activity Logs)
     • AuditEvent(for Key Vault)
     • ApplicationGatewayAccessLog(for Application Gateway)
     • ApplicationGatewayFirewallLog(for Application Gateway)
     • NetworkSecurityGroupEvent(for Network Security Groups)
   • In the Metricssection (optional), select AllMetricsto send platform metrics to the storage account.
   • In the Destination detailssection, select Archive to a storage accountcheckbox.
   • Subscription: Select the subscription containing your storage account.
   • Storage account: Select the storage account you created (for example, azureresourcelogs ).
5. Click Save.

After configuration, logs are automatically exported to containers in the storage account. Azure creates containers using the naming pattern insights-logs-<log-category-name> . For example:

• Key Vault audit logs: insights-logs-auditevent
• Application Gateway access logs: insights-logs-applicationgatewayaccesslog
• Application Gateway firewall logs: insights-logs-applicationgatewayfirewalllog

• Network Security Group events: insights-logs-networksecuritygroupevent

Configure a feed in Google SecOps to ingest Azure Resource logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, Azure Resource Logs - Key Vault ).
5. Select Microsoft Azure Blob Storage V2as the Source type.
6. Select Microsoft Azure Resourceas the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Azure URI: Enter the Blob Service endpoint URL with the container path:

    https://azureresourcelogs.blob.core.windows.net/insights-logs-auditevent/ 
   

   • Replace the following:
     • azureresourcelogs : Your Azure storage account name.
     • insights-logs-auditevent : The blob container name where logs are stored (varies by resource type and log category).

   • Source deletion option: Select the deletion option according to your preference:

     • Never: Never deletes any files after transfers.
     • Delete transferred files: Deletes files after successful transfer.
     • Delete transferred files and empty directories: Deletes files and empty directories after successful transfer.

   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.

   • Shared key: Enter the shared key value (access key) you captured from the Storage Account in step 3.

   • Asset namespace: The asset namespace .

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalizescreen, and then click Submit.

Configure Azure Storage firewall (if enabled)

If your Azure Storage Account uses a firewall, you must add Google SecOps IP ranges.

1. In the Azure portal, go to your Storage Account(for example, azureresourcelogs ).
2. Select Networkingunder Security + networking.
3. Under Firewalls and virtual networks, select Enabled from selected virtual networks and IP addresses.
4. In the Firewallsection, under Address range, click + Add IP range.

5. Add each Google SecOps IP range in CIDR notation.

   • To get the current IP ranges, choose one of the following options:
     • See IP Allowlisting documentation
     • Retrieve them programmatically using the Feed Management API

6. Click Save.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.