Microsoft Azure Platform

The JSA DSM for Microsoft Azure Platform parses events from the Microsoft Azure Activity log.

The Microsoft Azure Platform DSM collects events that occur at the platform level; such as resource creation, modification, or deletion. For a list of supported event types, see Microsoft Azure Platform DSM specifications.

To integrate Microsoft Azure Platform with JSA, complete the following steps:

If automatic updates are not enabled, download and install the most recent version of the following RPMs from the https://support.juniper.net/support/downloads/ onto your JSA console
- Protocol Common RPM
- Protocol Event Hubs RPM
- DSM Common RPM
- DSM Activity Logs RPM
Configure the Microsoft Azure Activity Logs to send events to a Microsoft Azure Event Hub.
Configure JSA to collect events from Microsoft Azure Event Hubs by using the Microsoft Azure Event Hubs protocol. For more information about the protocol, see Microsoft Azure Log Source Parameters for Microsoft Azure Event Hubs.
Note
Microsoft Azure Log Integration service is no longer used to send events to JSA. Microsoft Azure Log Integration service is deprecated and no longer supported by Microsoft.

Microsoft Azure Platform DSM Specifications

When you configure the Microsoft Azure Platform DSM, understading the specifications for the Microsoft Azure Platform DSM can help ensure a successful integration. For example, knowing what event format is supported before you begin can help reduce frustration during the configuration process.:

Table 1: Microsoft Azure Platform DSM Specifications

Specification	Value
Manufacturer	Microsoft
DSM name	Microsoft Azure Platform
RPM file name	`DSM-MicrosoftAzurePlatform- JSA_version-build_number .noarch.rpm`
Supported versions	N/A
Protocol	Microsoft Azure Event Hubs
Event format	JSON
Recorded event types	Platform level activity logs.
Automatically discovered?	Yes Note: This DSM automatically discovers only Activity Log Events that are forwarded directly from the Activity Log to the Event Hub.
Includes identity?	No
Includes custom properties?	No
More information	Microsoft Azure website (https://azure.microsoft.com)

Configuring Microsoft Azure Event Hubs to Communicate with JSA

The Microsoft Azure Event Hubs protocol collects Azure Activity logs, Diagnostic logs, and Syslog events from the Microsoft Azure Event Hubs cloud storage.

To collect events from Microsoft Azure Event Hubs, you need to create a Microsoft Azure Storage Account and an Event Hub entity under the Azure Event Hub Namespace. For every Namespace, port 5671 and port 5672 must be open. For every Storage Account, port 443 must be open. The Namespace host name is usually [Namespace Name].windows.net and the Storage Account host name is usually [Storage_Account_Name].blob.core.windows.net. The Event Hub must have at least one Shared Access Signature that is created with Listen Policy and at least one Consumer Group.

Note

The Microsoft Azure Event Hubs protocol can't connect by using a proxy server.

Event Hub names must start with a letter or number and contain only letters, numbers, and the dash (-) character. Every dash (-) character must be immediately preceded and followed by a letter or number. Do not use consecutive dashes. All letters must be lowercase. The name must be from 3 - 63 characters.

Obtain a Microsoft Azure Storage Account Connection String.
The Storage Account Connection String contains authentication for the Storage Account Name and the Storage Account Key that is used to access the data in the Azure Storage account.
1. Log in to the (https://portal.azure.com).
2. From the dashboard, in the All resources section, select a Storage account.
3. From the Storage account menu, select Access keys.
4. Record the value for the Storage account name. Use this value for the Storage Account Name parameter value when you configure a log source in JSA.
5. From the Key 1 or Key 1 section, record the following values.
  1. KEY - Use this value for the Storage Account Key parameter value when you configure a log source in JSA.
  2. CONNECTION STRING - Use this value for the Storage Account Connection String parameter value when you configure a log source in JSA.
    Most storage accounts use core.window.net for the end point suffix, but this value can change depending on it's location. For example, a government related storage account might have a different endpoint suffix value.
    Note
    You can use the Storage Account Name and Storage Account Key values or you can use the Storage Account Connection String value to connect to the Storage Account.
Obtain a Microsoft Azure Event Hub Connection String.
The Event Hub Connection String contains the Namespace Name, the path to the Event Hub within the namespace and the Shared Access Signature (SAS) authentication information.
1. Log in to the (https://portal.azure.com).
2. From the dashboard, in the All resources section, select an Event Hubs Namespace. Record this value to use as the Namespace Name parameter value when you configure a log source in JSA.
3. In the Entities section, select Event Hubs. Record this value to use for the Event Hub Name parameter value when you configure a log source in JSA.
4. In the Event Hub section, select an Event Hub from the list.
5. In the Settings section, select Shared access policies.
  1. Select a POLICY that contains a Listen CLAIMS. Record this value to use for the SAS Key Name parameter value when you configure a log source in JSA.
  2. Record the values for the following parameters:
    - Primary key or Secondary key - Use the value for the SAS Key parameter value when you configure a log source in JSA.
    - Connection string-primary key or Connection string-secondary key - Use this value for the Event Hub Connection String parameter value when you configure a log source in JSA.
    Note
    You can use the Namespace Name, Event Hub Name, SAS Key Name and SAS Key values, or you can use the Event Hub Connection String value to connect to the Event Hub.
In the Entities section, select Consumer groups. Record the value to use for the Consumer Group parameter value when you configure a log source in JSA.

Microsoft Azure Log Source Parameters for Microsoft Azure Event Hubs

If JSA does not automatically detect the log source, add a Microsoft Azure Event Hubs log source on the JSA Console by using the Microsoft Azure protocol.

When using the Microsoft Azure protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Microsoft Azure events from Microsoft Azure Event Hubs:

Table 2: Microsoft Azure Log Source Parameters for the Microsoft Azure Event Hubs DSM

Parameter	Value
Log Source type	Microsoft Azure
Protocol Configuration	Microsoft Azure Event Hubs
Log Source Identifier	An identifiable name or IP address for the log source. When the Use as Gateway Log Source field is selected, the Log Source Identifier value is not used.

Sample Event Messages

Use these sample event messages as a way of verifying a successful integration with JSA.

The following tables provide sample event messages for the Microsoft Azure DSM:

Note

Due to formatting, paste the message formats into a text editor and then remove any carriage return or line feed characters.

Table 3: Microsoft Azure Sample Syslog Message

Event name	Low level category	Sample log message
Restarts virtual machines.	Start Activity Attempted	`LEEF:1.0\|Microsoft\|Azure Resource Manager\|1.0\| MICROSOFT.CLASSICCOMPUTE /VIRTUALMACHINES/RESTART/ ACTION\|devTime=Jun 07 2016 17:04:26 devTimeFormat =MMM dd yyyy HH:mm:ss cat=Compute src= 10.0.0.2 usrName =erica@example.com sev=4 resource= testvm resourceGroup=Test Resource Group description =Restart a Virtual Machine`
Returns the access keys for the specified storage account	Read Activity Attempted	"{"records": [{ "time": "2017-09-14T11:47:36.1987564Z", "res ourceId": "/SUBSCRIPTIONS//RESOURCE GROUPS//PROVIDERS/MICROSOFT.STORAGE /STORAGEACCOUNTS/", "operationName" : "MICROSOFT.STORAGE/STORAGEACCOUNT S/LISTKEYS/ACTION", "category": "Ac tion", "resultType": "Start", "resu ltSignature": "Started.", "duration Ms": 0, "callerIpAddress": “<IP address>”, "correlationId": "", "identity": {"authorization":{"scope":"/subscri ptions//resourceGroups//providers/Mi crosoft.Storage/storageAccounts/","a ction":"Microsoft.Storage/storageAcc ounts/listKeys/action","evidence":{" role":"Insights Management Service Ro le","roleAssignmentScope":"/subscript ions/","roleAssignmentId":"","roleDef initionId":"","principalId":"","princ ipalType":"ServicePrincipal"}},"claim s":{"aud":"https://management.azure.c om/","iss":"https://sts.windows.net// ","iat":"","nbf":"","exp":"","aio":"= =","appid":"","appidacr":"2","e_exp": "262800","http://schemas.microsoft.co m/identity/claims/identityprovider":" https://sts.windows.net//","http://sc hemas.microsoft.com/identity/claims/o bjectidentifier":"","http://schemas.x mlsoap.org/ws/2005/05/identity/claims /nameidentifier":"","http://schemas.m icrosoft.com/identity/claims/tenantid ":"","uti":"xxxxxx__xxxxxxxxxxxxxx", "ver":"1.0"}}, "level": "Information" , "location": "global"},{ "time": "20 17-09-14T11:47:36.3237658Z", "resource Id": "/SUBSCRIPTIONS//RESOURCEGROUPS/ /PROVIDERS/MICROSOFT.STORAGE/STORAGEA CCOUNTS/", "operationName": "MICROSOF T.STORAGE/STORAGEACCOUNTS/LISTKEYS/AC TION", "category": "Action", "resultT ype": "Success", "resultSignature": " Succeeded.OK", "durationMs": 125, "ca llerIpAddress": "<IP address>” "correlati onId": "", "identity": {"authorizatio n":{"scope":"/subscriptions//resource Groups//providers/Microsoft.Storage/ storageAccounts/","action":"Microsoft .Storage/storageAccounts/listKeys/act ion","evidence":{"role":"Insights Man agement Service Role","roleAssignment Scope":"/subscriptions/","roleAssignm entId":"","roleDefinitionId":"","prin cipalId":"","principalType":"ServiceP rincipal"}},"claims":{"aud":"https:/ /management.azure.com/","iss":"https: //sts.windows.net/xxxxxxxx-xxxx-xxxx -xxxx-xxxxxxxxxxxx/","iat":"150538935 6","nbf":"1505389356","exp":"15053932 56","aio":"Y2VgYBBQEA5y0vTd4PVnSpSp9q VwAA==","appid":"","appidacr":"2","e_ exp":"262800","http://schemas.microso ft.com/identity/claims/identityprovid er":"https://sts.windows.net//","http ://schemas.microsoft.com/identity/cla ims/objectidentifier":"","http://sche mas.xmlsoap.org/ws/2005/05/identity/c laims/nameidentifier":"","http://sch mas.microsoft.com/identity/claims/ten antid":"","uti":"xxxxxx__xxxxxxxxxxxx xx","ver":"1.0"}}, "level": "Informat ion", "location": "global", "properti es": {"statusCode":"OK","serviceReque stId":""}}]}"
SecretGet	Read Activity Attempted	"{"records": [{"time": "2016-03-02T 04:31:28.6127743Z","resourceId": "/SUBSCR IPTIONS//RESOURCEGROUPS//PROVIDERS/MICROS OFT.KEYVAULT/VAULTS/AZLOGTEST","operation Name": "SecretGet","operationVersion": "2 015-06-01","category": "AuditEvent","resu ltType": "Success","resultSignature": "OK" ,"resultDescription": "","durationMs": "18 7","callerIpAddress": "","correlationId": "","identity": {"claim": {"http://schemas. microsoft.com/identity/claims/objectidenti fier": "","appid": "","http://schemas.xmls oap.org/ws/2005/05/identity/claims/upn": ""}},"properties": {"clientInfo": "","requ estUri": "","id": "https://.vault.azure.ne t/secrets/testsecret/","httpStatusCode": 200}}]}"
Failed Password	SSH Login Failed	"{"time": "2017-05-11T21:58:37 .0000000Z","resourceId": "/subscriptions// resourceGroups//providers/Microsoft.Comput e/virtualMachines/","properties": {"host" : "","ident": "sshd","pid": "","Ignore": "syslog","Facility": "auth","Severity" : "info","EventTime": "2017-05-11T21:58 :37+0000","SendingHost": "","Msg": "Fai led password for root from <IP address> port 1111 ssh2","hostname": "","Fluent dIngest Timestamp": "2017-05-11T21:58 :37Z"},"category": "auth","level": "info"}"