Skip to main content
Sumo Logic

Collect Logs for the Azure Active Directory App

This section has instructions for setting up the ingestion pipeline from Azure Active Directory to Sumo Logic.

Solution Overview

  • Azure Monitor collects logs for Azure Active Directory and streams the data to an Azure Event Hub. 
  • Event Hub streams the logs collected by Azure Monitor to an Azure function. 
  • The Azure function is a small piece of code that is triggered by Event Hub to send Azure Active Directory logs to the Sumo HTTP Source. The function also logs to one Storage Account and logs failover data to another.

CollectLogsforAzureAD.png

 

Prerequisites

Configure an HTTP Source

In this step, you configure an HTTP Source to receive logs from the Azure function.

  1. Select a Hosted Collector where you want to configure the HTTP Source. If desired, create a new Hosted Collector, as described on Configure a Hosted Collector.
  2. Configure an HTTP source, as described on HTTP Logs and Metrics Source

Configure Azure resources using ARM template

To deploy a Sumo provided ARM template, follow the instructions in Step 2 for Collecting logs from Azure monitor.

Push Azure Active Directory logs to Event Hub via Azure Monitor

To push Azure Active Directory logs to Event Hub, follow the below steps:  

  1. Login into Azure Portal.
  2. Go to Azure Active Directory.
    AzureActiveDirectory.png
  3. Go to Monitoring > Audit Logs.
    AuditLogs.png
  4. Click Export Data Settings.
    ExportDataSettings.png
  5. Diagnostic Settings blade will show all your existing settings if any already exist. Click Edit Setting if you want to change your existing settings, or click Add diagnostic setting to add a new one. Check the Stream to an event hub box Select an Azure subscription.
  6. Select the Event Hubs namespace you created in Step 2. It should start with “SumoAzureLogsNamespace<UniqueSuffix>”. 
  7. Select insights-operational-logs from the Select event hub name dropdown.
  8. Select RootManageSharedAccessKey from Select event hub policy name dropdown.
  9. Check the box for log types under Category Details which you want to ingest. 
  10. Click Save.
    DiagonosticSettingBlade.png

Troubleshooting log collection

If logs are not flowing into Sumo Logic, follow the steps in Troubleshooting log collection in the following document.