Collect Azure API Management logs

This document explains how to export Azure API Management logs to Google Security Operations using an Azure Storage Account.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• An active Azure tenant
• Privileged access to Azure

Configure Azure Storage Account

1. In the Azure console, search for Storage accounts .
2. Click + Create.
3. Specify values for the following input parameters:
   • Subscription: Select the subscription.
   • Resource Group: Select the resource group.
   • Region: Select the region.
   • Performance: Select the performance (Standard recommended).
   • Redundancy: Select the redundancy (GRS or LRS recommended).
   • Storage account name: Enter a name for the new storage account.
4. Click Review + create.
5. Review the overview of the account and click Create.
6. From the Storage Account Overviewpage, select the Access keyssubmenu in Security + networking.
7. Click Shownext to key1or key2.
8. Click Copy to clipboardto copy the key.
9. Save the key in a secure location for later use.
10. From the Storage Account Overviewpage, select the Endpointssubmenu in Settings.
11. Click Copy to clipboardto copy the Blob serviceendpoint URL; for example, https://<storageaccountname>.blob.core.windows.net .
12. Save the endpoint URL in a secure location for later use.

How to configure Log Export for Azure API Management Logs

1. Sign in to the Azure Portalusing your privileged account.
2. In the Azure portal, find and select the API Management serviceinstance.
3. Select Monitoring > Diagnostic settings.
4. Click + Add diagnostic setting.
   • Enter a descriptive name for the diagnostic setting.
5. Select Logs related to ApiManagement Gateway.
6. Select the Archive to a storage accountcheckbox as the destination.
   • Specify the Subscriptionand Storage Account.
7. Click Save.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New
• Content Hub > Content Packs > Get Started

How to set up the Azure API Management feed

1. Click the Azure Platformpack.
2. Locate the Azure API Managementlog type and click Add new feed.

3. Specify values for the following fields:

   • Source Type: Microsoft Azure Blob Storage V2.
   • Azure URI: The blob endpoint URL.
     • ENDPOINT_URL/BLOB_NAME
       • Replace the following:
         • ENDPOINT_URL : The blob endpoint URL ( https://<storageaccountname>.blob.core.windows.net )
         • BLOB_NAME : The name of the blob (such as, insights-logs-<logname> )

   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Maximum File Age: Includes files modified in the last number of days. Default is 180 days.

   • Shared key: The access key to the Azure Blob Storage.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed .
   • Ingestion Labels: Labels applied to all events from this feed.

4. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product .

Need more help? Get answers from Community members and Google SecOps professionals.