Azure Logs

Connecting Azure logs to your Panther Console

Overview

Panther supports ingesting Azure audit and sign-in logs via common Data Transport options, like Azure Blob storage.

How to onboard Azure logs to Panther

You'll first create an Azure Blob Storage source in Panther, then configure Azure to export logs to that location.

Step 1: Create the Azure source in Panther

1. In the lefthand navigation bar of your Panther Console, click Configure > Log Sources.

2. Click Create New.

3. Search for “Azure,” then click its tile.

   • In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the Azure Blob Storage option.

4. Click Start Setup.

5. Follow Panther's instructions for configuring an Azure Blob Storage Source.

   • If during Step 2: Create required Azure infrastructure you choose to create your Azure resources manually (instead of using Terraform), skip the step to create an Azure container, as one will automatically be created in your storage account in Step 2, below.

Step 2: Export Azure logs to Azure Blob storage

To export Azure audit and sign-in logs to a Blob storage container:

1. Sign in to your Azure dashboard.

2. In the left-hand panel of the Azure Active Directory, click Audit logs.

3. Near the top of the page, click Export Data Settings.

   
4. Click Add Diagnostic Setting.

5. On the Diagnostic setting page, set the following values:

   • Diagnostic setting name: Enter a descriptive name.

   • Categories (under Logs): Select the following checkboxes:

     • AuditLogs

     • SignInLogs

     • NonInteractiveUserSignInLogs

     • ServicePrincipalSignInLogs

     • ManagedIdentitySignInLogs

   • Destination details: Select the Archive to a storage account checkbox, then select your destination Storage account.

     
6. In the upper left corner, click Save.

   • Audit and sign-in logs will now be saved to a Blob container in your storage account.

Panther-managed detections

See Panther-managed rules for Azure in the panther-analysis GitHub repository.

Supported log types

Panther supports Azure.Audit and Azure.SignIn logs.

Azure.Audit

These are audit logs in the Azure Active Directory. For more information, see Microsoft's documentation on audit logs.

schema: Azure.Audit
description: Audit logs from Azure Active Directory
referenceURL: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs
fields:
  - name: Level
    required: true
    type: bigint
  - name: callerIpAddress
    required: true
    type: string
    indicators:
      - ip
  - name: category
    required: true
    type: string
  - name: correlationId
    required: true
    type: string
  - name: durationMs
    required: true
    type: bigint
  - name: identity
    required: true
    type: string
  - name: operationName
    required: true
    type: string
  - name: operationVersion
    required: true
    type: float
  - name: properties
    required: true
    type: object
    fields:
      - name: activityDateTime
        required: true
        type: timestamp
        timeFormats:
          - rfc3339
      - name: activityDisplayName
        required: true
        type: string
      - name: additionalDetails
        required: true
        type: array
        element:
          type: object
          fields:
            - name: key
              required: true
              type: string
            - name: value
              required: true
              type: string
      - name: category
        required: true
        type: string
      - name: correlationId
        required: true
        type: string
      - name: id
        required: true
        type: string
      - name: initiatedBy
        required: true
        type: object
        fields:
          - name: app
            required: true
            type: object
            fields:
              - name: displayName
                required: true
                type: string
              - name: servicePrincipalId
                required: true
                type: string
      - name: loggedByService
        required: true
        type: string
      - name: operationType
        required: true
        type: string
      - name: result
        required: true
        type: string
      - name: resultReason
        required: true
        type: string
      - name: targetResources
        required: true
        type: array
        element:
          type: object
          fields:
            - name: displayName
              required: true
              type: string
            - name: id
              required: true
              type: string
            - name: modifiedProperties
              required: true
              type: array
              element:
                type: object
                fields:
                  - name: oldValue
                    type: string
                  - name: displayName
                    required: true
                    type: string
                  - name: newValue
                    required: true
                    type: string
            - name: type
              required: true
              type: string
  - name: resourceId
    required: true
    type: string
  - name: resultSignature
    required: true
    type: string
  - name: tenantId
    required: true
    type: string
  - name: time
    required: true
    type: timestamp
    timeFormats:
      - rfc3339

Azure.SignIn

This schema represents SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and ManagedIdentitySignInLogs from the Azure Active Directory.

For more information, see Microsoft's documentation on sign-in logs.

schema: Azure.SignIn
description: Sign-in logs from Azure Active Directory
referenceURL: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins
fields:
  - name: Level
    required: true
    type: bigint
  - name: callerIpAddress
    required: true
    type: string
    indicators:
      - ip
  - name: category
    required: true
    type: string
  - name: correlationId
    required: true
    type: string
  - name: durationMs
    required: true
    type: bigint
  - name: identity
    type: string
  - name: location
    required: true
    type: string
  - name: operationName
    required: true
    type: string
  - name: operationVersion
    required: true
    type: float
  - name: properties
    required: true
    type: object
    fields:
      - name: alternateSignInName
        type: string
        indicators:
          - email
      - name: signInIdentifier
        type: string
        indicators:
          - email
      - name: appDisplayName
        type: string
      - name: appId
        required: true
        type: string
      - name: appliedConditionalAccessPolicies
        required: true
        type: array
        element:
          type: object
          fields:
            - name: conditionsNotSatisfied
              required: true
              type: bigint
            - name: conditionsSatisfied
              required: true
              type: bigint
            - name: displayName
              required: true
              type: string
            - name: id
              required: true
              type: string
            - name: result
              required: true
              type: string
            - name: enforcedGrantControls
              type: json
            - name: enforcedSessionControls
              type: json
      - name: authenticationContextClassReferences
        type: json
      - name: authenticationDetails
        type: json
      - name: authenticationProcessingDetails
        required: true
        type: array
        element:
          type: object
          fields:
            - name: key
              required: true
              type: string
            - name: value
              required: true
              type: json
      - name: authenticationProtocol
        required: true
        type: string
      - name: authenticationStrengths
        type: json
      - name: authenticationRequirement
        type: string
      - name: authenticationRequirementPolicies
        type: json
      - name: autonomousSystemNumber
        type: bigint
      - name: mfaDetail
        type: json
      - name: networkLocationDetails
        type: json
      - name: privateLinkDetails
        type: json
      - name: riskEventTypes
        type: json
      - name: riskEventTypes_v2
        type: json
      - name: sessionLifetimePolicies
        type: json
      - name: clientAppUsed
        type: string
      - name: clientCredentialType
        required: true
        type: string
      - name: conditionalAccessStatus
        required: true
        type: string
      - name: correlationId
        required: true
        type: string
      - name: createdDateTime
        required: true
        type: timestamp
        timeFormats:
          - rfc3339
      - name: crossTenantAccessType
        required: true
        type: string
      - name: deviceDetail
        type: object
        fields:
          - name: browser
            required: true
            type: string
          - name: deviceId
            required: true
            type: string
          - name: displayName
            required: true
            type: string
          - name: operatingSystem
            required: true
            type: string
      - name: flaggedForReview
        required: true
        type: boolean
      - name: homeTenantId
        type: string
      - name: id
        required: true
        type: string
      - name: incomingTokenType
        required: true
        type: string
      - name: ipAddress
        required: true
        type: string
        indicators:
          - ip
      - name: isInteractive
        required: true
        type: boolean
      - name: isTenantRestricted
        required: true
        type: boolean
      - name: location
        required: true
        type: object
        fields:
          - name: city
            required: true
            type: string
          - name: countryOrRegion
            required: true
            type: string
          - name: geoCoordinates
            required: true
            type: object
            fields:
              - name: latitude
                required: true
                type: float
              - name: longitude
                required: true
                type: float
          - name: state
            required: true
            type: string
      - name: managedIdentityType
        required: true
        type: string
      - name: originalRequestId
        type: string
      - name: processingTimeInMilliseconds
        required: true
        type: bigint
      - name: resourceDisplayName
        required: true
        type: string
      - name: resourceId
        required: true
        type: string
      - name: resourceServicePrincipalId
        type: string
      - name: servicePrincipalName
        type: string
      - name: servicePrincipalCredentialKeyId
        type: string
      - name: resourceTenantId
        type: string
      - name: riskDetail
        required: true
        type: string
      - name: riskLevelAggregated
        required: true
        type: string
      - name: riskLevelDuringSignIn
        required: true
        type: string
      - name: riskState
        required: true
        type: string
      - name: rngcStatus
        type: bigint
      - name: servicePrincipalId
        required: true
        type: string
      - name: ssoExtensionVersion
        type: string
      - name: status
        required: true
        type: object
        fields:
          - name: additionalDetails
            type: string
          - name: errorCode
            required: true
            type: bigint
      - name: tenantId
        type: string
      - name: tokenIssuerName
        type: string
      - name: tokenIssuerType
        required: true
        type: string
      - name: uniqueTokenIdentifier
        required: true
        type: string
      - name: userAgent
        type: string
      - name: userDisplayName
        indicators:
          - username
        type: string
      - name: userId
        type: string
      - name: userPrincipalName
        type: string
        indicators:
          - email
      - name: userType
        type: string
  - name: resourceId
    required: true
    type: string
  - name: resultSignature
    required: true
    type: string
  - name: resultType
    required: true
    type: bigint
  - name: tenantId
    required: true
    type: string
  - name: time
    required: true
    type: timestamp
    isEventTime: true
    timeFormats:
      - rfc3339