Azure Logs
Connecting Azure logs to your Panther Console
Last updated
Was this helpful?
Connecting Azure logs to your Panther Console
Last updated
Was this helpful?
Panther supports ingesting Azure audit and sign-in logs via common Data Transport options, like Azure Blob storage.
You'll first create an Azure Blob Storage source in Panther, then configure Azure to export logs to that location.
In the lefthand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for “Azure,” then click its tile.
In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the Azure Blob Storage option.
Click Start Setup.
Follow Panther's instructions for configuring an Azure Blob Storage Source.
If during you choose to create your Azure resources manually (instead of using Terraform), skip , as one will automatically be created in your storage account in Step 2, below.
To export Azure audit and sign-in logs to a Blob storage container:
Sign in to your Azure dashboard.
In the left-hand panel of the Azure Active Directory, click Audit logs.
Near the top of the page, click Export Data Settings.
Click Add Diagnostic Setting.
On the Diagnostic setting page, set the following values:
Diagnostic setting name: Enter a descriptive name.
Categories (under Logs): Select the following checkboxes:
AuditLogs
SignInLogs
NonInteractiveUserSignInLogs
ServicePrincipalSignInLogs
ManagedIdentitySignInLogs
Destination details: Select the Archive to a storage account checkbox, then select your destination Storage account.
In the upper left corner, click Save.
Audit and sign-in logs will now be saved to a Blob container in your storage account.
Click on your newly created container, then in the left-hand navigation bar, click Access Control (IAM).
Click +Add.
Click Add Role Assignment.
Search for "Storage Blob Data Reader" and select the matching role that populates.
Click on the Members tab.
Click +Select Members.
Click Review+Assign.
See Panther-managed rules for Azure in the panther-analysis GitHub repository.
Panther supports Azure audit and signin logs which are handled by the Azure.Audit schema.
These are audit logs in the Azure Active Directory. For more information, see Microsoft's documentation on audit logs.
The Azure.SignIn schema is deprecated. Please use Azure.Audit.
Search for the name of the registered app you created during the , and click Select.