Microsoft Azure Audit

• What is Discovered and Monitored
• Configuration
• Sample Events for Microsoft Azure Audit

What is Discovered and Monitored

Protocol	Information Discovered	Information Collected	Used For
Azure CLI	None	Audit Logs	Security Monitoring

Event Types

In ADMIN > Device Support > Event, search for "Microsoft Azure Audit" in the Search column to see the event types associated with this device.

Configuration

You must define a user account in Azure for use by FortiSIEM to pull Audit logs. Use any of the following roles:

• Owner
• Reader
• Monitoring Reader
• Monitoring Contributor
• Contributor

FortiSIEM recommends using the 'Monitoring Reader' role, which is the least privileged to do the job.

Create Microsoft Azure Audit Credential in FortiSIEM

1. Log in to FortiSIEM Supervisor node.
2. Go to ADMIN > Setup > Credentials.
3. In Step 1, click Add to create a new credential.
4. For Device Type, select Microsoft Azure Audit.
5. For Access Protocol, select Azure CLI.
6. For Password Configuration, select Manual or CyberArk.
   1. For Manual credential method, enter the username and credentials for an Azure account.
      FortiSIEM recommends using 'Monitoring Reader' role for this account.
   2. For CyberArk, see Password Configuration.
7. Click Save.

Test Connectivity in FortiSIEM

1. Log in to FortiSIEM Supervisor node.
2. Go to ADMIN > Setup > Credentials.
3. In Step 2, click Add to create a new association.
4. For Name/IP/IP Range, enter any IP Address.
5. For Credentials, enter the name of the credential created in the "Microsoft Azure Audit Credential" step.
6. Click Save.
7. Select the entry just created and click Test Connectivity without Ping.
   A pop-up appears with the Test Connectivity results.
8. Go to ADMIN > Setup > Pull Events and make sure an entry is created for Microsoft Audit Log Collection.
   

Sample Events for Microsoft Azure Audit

2016-02-26 15:19:10 FortiSIEM-Azure,[action]=Microsoft.ClassicCompute/virtualmachines/shutdown/action,[caller]=Cuiping.Wang@shashiaccelops.onmicrosoft.com,[level]=Error,[resourceId]=/subscriptions/3ed4ee1c-1a83-4e02-a928-7ff5e0008e8a/resourcegroups/china/providers/Microsoft.ClassicCompute/virtualmachines/china,[resourceGroupName]=china,[eventTimestamp]=2016-02-14T06:12:18.5539709Z,[status]=Failed,[subStatus]=Conflict,[resourceType]=Microsoft.ClassicCompute/virtualmachines,[category]=Administrative