Knowledge BaseRelease NotesRequest Demo

Microsoft Entra ID Audit Logs

Connecting Microsoft Entra ID Audit logs to your Panther Console

Overview

Panther supports ingesting Microsoft Entra ID (previously "Azure Active Directory") Audit logs via common Data Transport options, like Azure Blob storage.

How to onboard Microsoft Entra ID Audit logs to Panther

You'll first create an Azure Blob Storage source in Panther, then configure Azure to export logs to that location.

Step 1: Create the Microsoft Entra ID source in Panther

  1. In the lefthand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for “Microsoft Entra ID Audit” then click its tile.

    • In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the Azure Blob Storage option.

  4. Click Start Setup.

  5. Follow Panther's instructions for configuring an Azure Blob Storage Source.

Step 2: Export Microsoft Entra ID Audit logs to Azure Blob storage

To export Microsoft Entra ID Audit logs to a Blob storage container:

  1. Sign in to your Azure dashboard.

  2. Navigate to the Microsoft Entra ID service.

  3. In the left-hand panel, click Audit logs.

  4. Near the top of the page, click Export Data Settings. The Microsoft Entra ID console is shown. An arrow is drawn from the "Audit logs" option in the navigation bar to a "Export data settings" button

  5. Click Add Diagnostic Setting.

  6. On the Diagnostic setting page, set the following values:

    • Diagnostic setting name: Enter a descriptive name.

    • Categories (under Logs): Select the following checkboxes:

      • AuditLogs

      • SignInLogs

      • NonInteractiveUserSignInLogs

      • ServicePrincipalSignInLogs

      • ManagedIdentitySignInLogs

    • Destination details: Select the Archive to a storage account checkbox, then select your destination Storage account.

      The Diagnostic setting page of the Azure console has four fields circled: Diagnostic setting name (a textfield), AuditLogs, SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and ManagedIdentitySignInLogs (checkboxes), Archive to a storage account (a checkbox), and Storage account (a dropdown selector).

  7. In the upper left corner, click Save.

    • Audit and sign-in logs will now be saved to a Blob container in your storage account.

Step 3: Add role assignment to container

  1. Click on your newly created container, then in the left-hand navigation bar, click Access Control (IAM).

  2. Click +Add. In the panthertestcontainer3 Access Control (IAM) page, an arrow is drawn to the +Add button

  3. Click Add Role Assignment.

  4. Search for "Storage Blob Data Reader" and select the matching role that populates. In the Add role assignment page of the Azure console, "storage blob" has been searched for in the search box. One of the results, Storage Blob Data Reader, is circled.

  5. Click on the Members tab.

  6. Click +Select Members.

  7. Search for the name of the registered app you created during the Create required Azure infrastructure process on Azure Blob Storage Source, and click Select.

  8. Click Review+Assign.

Panther-managed detections

See Panther-managed rules for Azure in the panther-analysis GitHub repository.

Supported log types

Panther supports Microsoft Entra ID audit and sign-in logs which are handled by the Azure.Audit schema.

Azure.Audit

The Azure.Audit log schema covers Microsoft Entra ID audit logs and sign-in logs. For more information, see the Microsoft documentation:

PreviousMicrosoft 365 LogsNextMicrosoft Graph Logs

Last updated

Was this helpful?