Azure Logs
Connecting Azure logs to your Panther Console
Overview
Panther supports ingesting Azure audit and sign-in logs via common Data Transport options, like Azure Blob storage.
How to onboard Azure logs to Panther
You'll first create an Azure Blob Storage source in Panther, then configure Azure to export logs to that location.
Step 1: Create the Azure source in Panther
In the lefthand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for “Azure,” then click its tile.
In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the Azure Blob Storage option.
Click Start Setup.
Follow Panther's instructions for configuring an Azure Blob Storage Source.
If during Step 2: Create required Azure infrastructure you choose to create your Azure resources manually (instead of using Terraform), skip the step to create an Azure container, as one will automatically be created in your storage account in Step 2, below.
Step 2: Export Azure logs to Azure Blob storage
To export Azure audit and sign-in logs to a Blob storage container:
Sign in to your Azure dashboard.
In the left-hand panel of the Azure Active Directory, click Audit logs.
Near the top of the page, click Export Data Settings.
Click Add Diagnostic Setting.
On the Diagnostic setting page, set the following values:
Diagnostic setting name: Enter a descriptive name.
Categories (under Logs): Select the following checkboxes:
AuditLogs
SignInLogs
NonInteractiveUserSignInLogs
ServicePrincipalSignInLogs
ManagedIdentitySignInLogs
Destination details: Select the Archive to a storage account checkbox, then select your destination Storage account.
In the upper left corner, click Save.
Audit and sign-in logs will now be saved to a Blob container in your storage account.
Panther-managed detections
See Panther-managed rules for Azure in the panther-analysis GitHub repository.
Supported log types
Panther supports Azure.Audit and Azure.SignIn logs.
Azure.Audit
These are audit logs in the Azure Active Directory. For more information, see Microsoft's documentation on audit logs.
schema: Azure.Audit
description: Audit logs from Azure Active Directory
referenceURL: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs
fields:
- name: Level
required: true
type: bigint
- name: callerIpAddress
required: true
type: string
indicators:
- ip
- name: category
required: true
type: string
- name: correlationId
required: true
type: string
- name: durationMs
required: true
type: bigint
- name: identity
required: true
type: string
- name: operationName
required: true
type: string
- name: operationVersion
required: true
type: float
- name: properties
required: true
type: object
fields:
- name: activityDateTime
required: true
type: timestamp
timeFormats:
- rfc3339
- name: activityDisplayName
required: true
type: string
- name: additionalDetails
required: true
type: array
element:
type: object
fields:
- name: key
required: true
type: string
- name: value
required: true
type: string
- name: category
required: true
type: string
- name: correlationId
required: true
type: string
- name: id
required: true
type: string
- name: initiatedBy
required: true
type: object
fields:
- name: app
required: true
type: object
fields:
- name: displayName
required: true
type: string
- name: servicePrincipalId
required: true
type: string
- name: loggedByService
required: true
type: string
- name: operationType
required: true
type: string
- name: result
required: true
type: string
- name: resultReason
required: true
type: string
- name: targetResources
required: true
type: array
element:
type: object
fields:
- name: displayName
required: true
type: string
- name: id
required: true
type: string
- name: modifiedProperties
required: true
type: array
element:
type: object
fields:
- name: oldValue
type: string
- name: displayName
required: true
type: string
- name: newValue
required: true
type: string
- name: type
required: true
type: string
- name: resourceId
required: true
type: string
- name: resultSignature
required: true
type: string
- name: tenantId
required: true
type: string
- name: time
required: true
type: timestamp
timeFormats:
- rfc3339
Azure.SignIn
This schema represents SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and ManagedIdentitySignInLogs from the Azure Active Directory.
For more information, see Microsoft's documentation on sign-in logs.
schema: Azure.SignIn
description: Sign-in logs from Azure Active Directory
referenceURL: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins
fields:
- name: Level
required: true
type: bigint
- name: callerIpAddress
required: true
type: string
indicators:
- ip
- name: category
required: true
type: string
- name: correlationId
required: true
type: string
- name: durationMs
required: true
type: bigint
- name: identity
type: string
- name: location
required: true
type: string
- name: operationName
required: true
type: string
- name: operationVersion
required: true
type: float
- name: properties
required: true
type: object
fields:
- name: alternateSignInName
type: string
indicators:
- email
- name: signInIdentifier
type: string
indicators:
- email
- name: appDisplayName
type: string
- name: appId
required: true
type: string
- name: appliedConditionalAccessPolicies
required: true
type: array
element:
type: object
fields:
- name: conditionsNotSatisfied
required: true
type: bigint
- name: conditionsSatisfied
required: true
type: bigint
- name: displayName
required: true
type: string
- name: id
required: true
type: string
- name: result
required: true
type: string
- name: enforcedGrantControls
type: json
- name: enforcedSessionControls
type: json
- name: authenticationContextClassReferences
type: json
- name: authenticationDetails
type: json
- name: authenticationProcessingDetails
required: true
type: array
element:
type: object
fields:
- name: key
required: true
type: string
- name: value
required: true
type: json
- name: authenticationProtocol
required: true
type: string
- name: authenticationStrengths
type: json
- name: authenticationRequirement
type: string
- name: authenticationRequirementPolicies
type: json
- name: autonomousSystemNumber
type: bigint
- name: mfaDetail
type: json
- name: networkLocationDetails
type: json
- name: privateLinkDetails
type: json
- name: riskEventTypes
type: json
- name: riskEventTypes_v2
type: json
- name: sessionLifetimePolicies
type: json
- name: clientAppUsed
type: string
- name: clientCredentialType
required: true
type: string
- name: conditionalAccessStatus
required: true
type: string
- name: correlationId
required: true
type: string
- name: createdDateTime
required: true
type: timestamp
timeFormats:
- rfc3339
- name: crossTenantAccessType
required: true
type: string
- name: deviceDetail
type: object
fields:
- name: browser
required: true
type: string
- name: deviceId
required: true
type: string
- name: displayName
required: true
type: string
- name: operatingSystem
required: true
type: string
- name: flaggedForReview
required: true
type: boolean
- name: homeTenantId
type: string
- name: id
required: true
type: string
- name: incomingTokenType
required: true
type: string
- name: ipAddress
required: true
type: string
indicators:
- ip
- name: isInteractive
required: true
type: boolean
- name: isTenantRestricted
required: true
type: boolean
- name: location
required: true
type: object
fields:
- name: city
required: true
type: string
- name: countryOrRegion
required: true
type: string
- name: geoCoordinates
required: true
type: object
fields:
- name: latitude
required: true
type: float
- name: longitude
required: true
type: float
- name: state
required: true
type: string
- name: managedIdentityType
required: true
type: string
- name: originalRequestId
type: string
- name: processingTimeInMilliseconds
required: true
type: bigint
- name: resourceDisplayName
required: true
type: string
- name: resourceId
required: true
type: string
- name: resourceServicePrincipalId
type: string
- name: servicePrincipalName
type: string
- name: servicePrincipalCredentialKeyId
type: string
- name: resourceTenantId
type: string
- name: riskDetail
required: true
type: string
- name: riskLevelAggregated
required: true
type: string
- name: riskLevelDuringSignIn
required: true
type: string
- name: riskState
required: true
type: string
- name: rngcStatus
type: bigint
- name: servicePrincipalId
required: true
type: string
- name: ssoExtensionVersion
type: string
- name: status
required: true
type: object
fields:
- name: additionalDetails
type: string
- name: errorCode
required: true
type: bigint
- name: tenantId
type: string
- name: tokenIssuerName
type: string
- name: tokenIssuerType
required: true
type: string
- name: uniqueTokenIdentifier
required: true
type: string
- name: userAgent
type: string
- name: userDisplayName
indicators:
- username
type: string
- name: userId
type: string
- name: userPrincipalName
type: string
indicators:
- email
- name: userType
type: string
- name: resourceId
required: true
type: string
- name: resultSignature
required: true
type: string
- name: resultType
required: true
type: bigint
- name: tenantId
required: true
type: string
- name: time
required: true
type: timestamp
isEventTime: true
timeFormats:
- rfc3339
Last updated
Was this helpful?