Monitoring Microsoft Azure platform and services

Get access credentials for Microsoft Graph and Azure Log Analytics

You need valid application_id and application_key values to authenticate the connection from the Wazuh module for Azure.

Follow the steps below to obtain an application_id and application_key:

1. Go to Microsoft Entra ID and navigate to the registered application.

   

2. Go to the Certificates & secrets section of the chosen application, then generate a secret key by selecting New client secret.

   

3. Give the key a descriptive name and specify the duration for which the key remains active, then select Add.

   

4. Copy the Value and the Secret ID. Store these values securely, as you can view them only once. The Value is the application_key.

   

5. Copy the application_id value for your registered application from the Overview section.

   

Get access credentials for Microsoft Azure Storage

Microsoft Azure Storage requires valid account_name and account_key values. You can obtain them in the Access keys section of Storage accounts in your Azure environment. Follow the Microsoft guide to create a storage account.

The section below shows the steps to retrieve the Microsoft Azure Storage account key.

1. Go to the Storage accounts section of your Microsoft Azure environment and select the account of interest.

   

2. Navigate to Access keys located on the left pane to access the account_name and account_key values.

   

Configure the Wazuh agent for Microsoft Azure

To authenticate your Microsoft Azure environment to Wazuh, store your credentials in a file in the format field = value.

1. Create the credentials directory if it doesn't already exist:

   # mkdir -p /var/ossec/wodles/credentials
   

2. Create the credentials file for your service inside that directory, using the field = value format:

   The fields expected in the credentials file depend on the type of service or activity you are monitoring.

   • Microsoft Azure Log Analytics and Graph

     The file must contain only two lines, one for the application_id and another for the application_key obtained previously:

     application_id = <YOUR_APPLICATION_ID>
     application_key = <YOUR_APPLICATION_KEY>
     

   • Microsoft Azure Storage

     The file must contain only two lines, one for the account_name and the other one for the account_key obtained previously:

     account_name = <YOUR_ACCOUNT_NAME>
     account_key = <YOUR_ACCOUNT_KEY>
     

3. Restrict the file so that only the root user can write it and the wazuh group can read it:

   # chown root:wazuh /var/ossec/wodles/credentials/<SERVICE_NAME_CREDENTIALS>
   # chmod 640 /var/ossec/wodles/credentials/<SERVICE_NAME_CREDENTIALS>
   

4. Specify the authentication file in the /var/ossec/etc/ossec.conf configuration file using the <auth_path> option, regardless of the service or activity you monitor. For example:

   <wodle name="azure-logs">
      <disabled>no</disabled>
      <run_on_start>yes</run_on_start>
   
      <log_analytics>
         <auth_path>/var/ossec/wodles/credentials/<LOG_ANALYTICS_CREDENTIALS></auth_path>
         <tenantdomain><YOUR_TENANT_DOMAIN></tenantdomain>
         <request>
            <query>AzureActivity</query>
            <workspace><WORKSPACE_ID></workspace>
            <time_offset>1d</time_offset>
         </request>
      </log_analytics>
   
      <graph>
         <auth_path>/var/ossec/wodles/credentials/<GRAPH_CREDENTIALS></auth_path>
         <tenantdomain><YOUR_TENANT_DOMAIN></tenantdomain>
         <request>
            <tag>microsoft-entra_id</tag>
            <query>auditLogs/directoryAudits</query>
            <time_offset>1d</time_offset>
         </request>
      </graph>
   
      <storage>
         <auth_path>/var/ossec/wodles/credentials/<STORAGE_CREDENTIALS></auth_path>
         <container name="insights-logs-auditlogs">
            <blobs>.json</blobs>
            <content_type>json_inline</content_type>
            <time_offset>24h</time_offset>
         </container>
      </storage>
   </wodle>
   

You can add more than one request block simultaneously in the same configuration. The Wazuh module for Azure processes each request sequentially. The above configuration is an example. It includes Microsoft Azure Log Analytics, Graph, and Storage configuration blocks.

For more information on <auth_path>, look at the Wazuh module for Azure reference page.