☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Azure Resource Logs:
  • Overview of Resource Logs
  • Key Characteristics of Resource Logs
  • Types of Resource Logs
  • Common Use Cases for Resource Logs
  • Collection and Storage of Resource Logs
  • Configuring Resource Logs
  • Best Practices for Using Resource Logs
  1. Azure Logging References
  2. Logging
  3. Azure Monitor

Resource Logs

Azure Resource Logs:

Azure Resource Logs (formerly known as Diagnostic Logs) provide detailed, granular insights into the operations and activities occurring within or on Azure resources. They are crucial for auditing, monitoring, troubleshooting, and ensuring compliance within an Azure environment. These resource logs are pushed into tables that can be reviewed in multiple ways. These include log analytics workspace, EventHub, and Storage blob.

Overview of Resource Logs

Resource Logs capture operational data and events for specific Azure resources. Unlike metrics, which provide quantitative data on resource performance, resource logs offer detailed, event-specific information about the actions and operations performed on or by an Azure resource.

Key Characteristics of Resource Logs

  1. Event-Driven:

    • Resource Logs are generated by events and actions that occur within or on a resource. These events could be user-driven (e.g., a user modifying a resource) or system-driven (e.g., an automatic update or a process execution).

  2. Granularity:

    • Resource Logs provide a high level of detail, capturing specific actions and their outcomes. For example, they can log individual API calls, access attempts, configuration changes, or transactions within a resource.

  3. Resource-Specific:

    • Resource Logs are tailored to the specific type of Azure resource. Different types of resources (e.g., virtual machines, databases, storage accounts, etc.) generate different kinds of logs based on the operations relevant to them.

Types of Resource Logs

  1. Azure Activity Logs (formerly Operational Logs):

    • Track the control-plane operations (i.e., management operations) performed on Azure resources. This includes actions like resource creation, modification, and deletion.

    • These logs are essential for auditing who did what and when across the Azure environment.

  2. Diagnostics Logs:

    • Capture data-plane operations and more detailed resource-specific activities. This includes logs of data access operations, errors, warnings, and informational messages generated by the resource itself.

    • For example, a storage account might generate logs that detail every read or write operation performed on the blobs within that account.

  3. Audit Logs:

    • Capture security-related events, such as access control changes, policy enforcement, and access attempts. These logs are crucial for compliance and security monitoring.

    • Often used in conjunction with Azure Policy and Azure Security Center to ensure resources are compliant with organizational standards.

Common Use Cases for Resource Logs

  1. Auditing:

    • Resource Logs are often used to audit actions taken within an Azure environment. For instance, you can audit who accessed a particular storage account or who modified a virtual machine's configuration.

    • Audit logs are particularly important for meeting regulatory compliance requirements.

  2. Monitoring and Troubleshooting:

    • Resource Logs provide insights into the operational health of resources. For example, if a web application is experiencing errors, you can inspect the resource logs to identify the root cause, such as failed requests or exceptions.

    • They also help in detecting and diagnosing issues related to performance, security, and configuration.

  3. Security Monitoring:

    • Security teams use Resource Logs to monitor for suspicious activities or potential security breaches. Logs can show unauthorized access attempts, changes to security settings, or unusual patterns of resource access.

    • Integration with Azure Sentinel (Microsoft’s SIEM solution) allows for advanced threat detection and automated responses.

  4. Compliance Reporting:

    • Resource Logs can be used to generate reports for compliance with industry standards such as GDPR, HIPAA, or SOC 2. They provide a detailed record of access and changes to sensitive resources.

Collection and Storage of Resource Logs

  • Azure Monitor: Resource Logs can be collected and analyzed using Azure Monitor, which provides tools for querying, visualizing, and alerting based on log data.

  • Log Analytics: Resource Logs can be ingested into an Azure Log Analytics workspace, where they can be queried using Kusto Query Language (KQL). This is useful for in-depth analysis and correlation of log data across multiple resources.

  • Event Hub: For real-time streaming and integration with third-party systems, Resource Logs can be streamed to an Azure Event Hub.

  • Storage Account: Logs can be archived to an Azure Storage Account for long-term retention and compliance purposes.

Configuring Resource Logs

  • Diagnostic Settings: To start collecting Resource Logs, you need to configure Diagnostic Settings for the resource. This involves specifying what type of logs to collect and where to send them (e.g., Log Analytics, Event Hub, Storage Account).

  • Retention Policies: You can configure retention policies based on your needs, ensuring logs are kept for the required duration to meet compliance or auditing requirements.

Best Practices for Using Resource Logs

  1. Enable Logs for Critical Resources: Ensure that Resource Logs are enabled for all critical resources, such as those storing sensitive data or supporting key business functions.

  2. Monitor and Alert: Set up alerts on specific log events, such as failed access attempts or unauthorized changes, to quickly respond to potential security incidents.

  3. Regularly Review Logs: Implement a regular log review process to identify anomalies, performance issues, or compliance violations.

  4. Integrate with SIEM: Integrate Resource Logs with a Security Information and Event Management (SIEM) solution like Azure Sentinel for advanced threat detection and response.

Last updated 9 months ago