Fortinet black logo

External Systems Configuration Guide

Microsoft Azure Audit

Microsoft Azure Audit

What is Discovered and Monitored

Protocol Information Discovered Information Collected Used For
Azure CLI None Audit Logs Security Monitoring

Event Types

In ADMIN > Device Support > Event, search for "Microsoft Azure Audit" in the Search column to see the event types associated with this device.

Configuration

You must define a user account in Azure for use by FortiSIEM to pull Audit logs. Use any of the following roles:

  • Owner
  • Reader
  • Monitoring Reader
  • Monitoring Contributor
  • Contributor

FortiSIEM recommends using the 'Monitoring Reader' role, which is the least privileged to do the job.

Create Microsoft Azure Audit Credential in FortiSIEM
  1. Log in to FortiSIEM Supervisor node.
  2. Go to ADMIN > Setup > Credentials.
  3. In Step 1, click Add to create a new credential.
  4. For Device Type, select Microsoft Azure Audit.
  5. For Access Protocol, select Azure CLI.
  6. For Password Configuration, select Manual or CyberArk.
    1. For Manual credential method, enter the username and credentials for an Azure account.
      FortiSIEM recommends using 'Monitoring Reader' role for this account.
    2. For CyberArk, see Password Configuration.
  7. Click Save.
Test Connectivity in FortiSIEM
  1. Log in to FortiSIEM Supervisor node.
  2. Go to ADMIN > Setup > Credentials.
  3. In Step 2, click Add to create a new association.
  4. For Name/IP/IP Range, enter any IP Address.
  5. For Credentials, enter the name of the credential created in the "Microsoft Azure Audit Credential" step.
  6. Click Save.
  7. Select the entry just created and click Test Connectivity without Ping.
    A pop-up appears with the Test Connectivity results.
  8. Go to ADMIN > Setup > Pull Events and make sure an entry is created for Microsoft Audit Log Collection.

Sample Events for Microsoft Azure Audit

2016-02-26 15:19:10 FortiSIEM-Azure,[action]=Microsoft.ClassicCompute/virtualmachines/shutdown/action,[caller]=Cuiping.Wang@shashiaccelops.onmicrosoft.com,[level]=Error,[resourceId]=/subscriptions/3ed4ee1c-1a83-4e02-a928-7ff5e0008e8a/resourcegroups/china/providers/Microsoft.ClassicCompute/virtualmachines/china,[resourceGroupName]=china,[eventTimestamp]=2016-02-14T06:12:18.5539709Z,[status]=Failed,[subStatus]=Conflict,[resourceType]=Microsoft.ClassicCompute/virtualmachines,[category]=Administrative

Microsoft Azure Audit

What is Discovered and Monitored

Protocol Information Discovered Information Collected Used For
Azure CLI None Audit Logs Security Monitoring

Event Types

In ADMIN > Device Support > Event, search for "Microsoft Azure Audit" in the Search column to see the event types associated with this device.

Configuration

You must define a user account in Azure for use by FortiSIEM to pull Audit logs. Use any of the following roles:

  • Owner
  • Reader
  • Monitoring Reader
  • Monitoring Contributor
  • Contributor

FortiSIEM recommends using the 'Monitoring Reader' role, which is the least privileged to do the job.

Create Microsoft Azure Audit Credential in FortiSIEM
  1. Log in to FortiSIEM Supervisor node.
  2. Go to ADMIN > Setup > Credentials.
  3. In Step 1, click Add to create a new credential.
  4. For Device Type, select Microsoft Azure Audit.
  5. For Access Protocol, select Azure CLI.
  6. For Password Configuration, select Manual or CyberArk.
    1. For Manual credential method, enter the username and credentials for an Azure account.
      FortiSIEM recommends using 'Monitoring Reader' role for this account.
    2. For CyberArk, see Password Configuration.
  7. Click Save.
Test Connectivity in FortiSIEM
  1. Log in to FortiSIEM Supervisor node.
  2. Go to ADMIN > Setup > Credentials.
  3. In Step 2, click Add to create a new association.
  4. For Name/IP/IP Range, enter any IP Address.
  5. For Credentials, enter the name of the credential created in the "Microsoft Azure Audit Credential" step.
  6. Click Save.
  7. Select the entry just created and click Test Connectivity without Ping.
    A pop-up appears with the Test Connectivity results.
  8. Go to ADMIN > Setup > Pull Events and make sure an entry is created for Microsoft Audit Log Collection.

Sample Events for Microsoft Azure Audit

2016-02-26 15:19:10 FortiSIEM-Azure,[action]=Microsoft.ClassicCompute/virtualmachines/shutdown/action,[caller]=Cuiping.Wang@shashiaccelops.onmicrosoft.com,[level]=Error,[resourceId]=/subscriptions/3ed4ee1c-1a83-4e02-a928-7ff5e0008e8a/resourcegroups/china/providers/Microsoft.ClassicCompute/virtualmachines/china,[resourceGroupName]=china,[eventTimestamp]=2016-02-14T06:12:18.5539709Z,[status]=Failed,[subStatus]=Conflict,[resourceType]=Microsoft.ClassicCompute/virtualmachines,[category]=Administrative