Currently working on a cloud transformation project where all infrastructure is being placed into Azure.

We currently use a SIEM solution to monitor and assess events across the environment. The adoption of Azure has added an additional level of administrative actions that we would need to keep an eye on.

Our design uses AD groups that are assigned to RBAC roles and so we can monitor changes to these groups in order to understand who has had access granted/revoked by collecting our DC logs. We cannot however see if someone has granted/revoked RBAC roles to Azure subscriptions, resource groups or resources. I have put together some Powershell scripts that would return the required data so it's good to know the data is there and available, however it seems that there is no native way to get this data into a SIEM solution.

Has anyone managed to get this type of data into their SIEM? I envisage it being achieved by having a Powershell script running every minute or so to retrieve the data and either writing it to a file which the SIEM collects or streaming it directly to the SIEM to then be parsed.

Essentially, I aim to get something in place so that I can view this data within our SIEM dashboard as I feel it's a significant risk to have no visibility of such administrative actions.

Thanks in advance for any guidance.

  • There is a detailed blog entry (linked) about the different issues surrounding: "Logging" within Azure. The tl;dr version is: "You will need to use their API" blogs.msdn.microsoft.com/azuresecurity/2015/09/03/…
    – munkeyoto
    Jul 1 '16 at 15:44
  • @munkeyoto many thanks for sending this over. This is ultimately the case and I think I'll need to think of a way whereby our SIEM solution itself could use the API and parse the returned data.
    – JLPH
    Jul 4 '16 at 8:28

As part of the Security Center GA announcement MS introduced the preview of a log integration connector for SIEM integration. I haven't tried it out myself yet, but I imagine this will be the new recommended solution for your request.

  • thanks for sending this over. You're right, this looks to be like a good fit for getting Azure event sinto an on-premise SIEM solution.
    – JLPH
    Aug 2 '16 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.