Collect Azure APP Service logs

This document explains how to export Azure APP Service logs to Google Security Operations using an Azure Storage Account. The parser transforms raw JSON formatted Azure App Service logs into a structured Unified Data Model (UDM). It extracts relevant fields from the raw logs, performs data cleaning and normalization, and maps the extracted information to corresponding UDM fields, ultimately outputting a UDM-compliant JSON object for each log entry.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• An active Azure tenant
• Privileged access to Azure

Configure Azure Storage Account

1. In the Azure console, search for Storage accounts.
2. Click + Create.
3. Specify values for the following input parameters:
   • Subscription: Select the subscription.
   • Resource Group: Select the resource group.
   • Region: Select the region.
   • Performance: Select the performance (Standard recommended).
   • Redundancy: Select the redundancy (GRS or LRS recommended).
   • Storage account name: Enter a name for the new storage account.
4. Click Review + create.
5. Review the overview of the account and click Create.
6. From the Storage Account Overview page, select the Access keys submenu in Security + networking.
7. Click Show next to key1 or key2.
8. Click Copy to clipboard to copy the key.
9. Save the key in a secure location for later use.
10. From the Storage Account Overview page, select the Endpoints submenu in Settings.
11. Click Copy to clipboard to copy the Blob service endpoint URL; for example, https://<storageaccountname>.blob.core.windows.net.
12. Save the endpoint URL in a secure location for later use.

How to configure Log Export for Azure AD Sign-In Logs

1. Sign in to the Azure Portal using your privileged account.
2. Go to App Services and select the required app service in use.
3. Select Monitoring > App Service Logs.
4. Turn ON for Application Logging (blob).
5. Select Storage under Web Service Logging.
6. Select the Subscription and Storage Account.
7. Define the Retention Period and Quota according to your requirements.
8. Turn ON for Detailed error messages.
9. Turn ON for Failed request tracing.
10. Click Save.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds
• Content Hub > Content Packs

Set up feeds from SIEM Settings > Feeds

To configure multiple feeds for different log types within this product family, see Configure feeds by product.

To configure a single feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed; for example, Azure APP Service Logs.
5. Select Microsoft Azure Blob Storage as the Source type.
6. Select Azure APP Service as the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Azure URI: The blob endpoint URL.
     • ENDPOINT_URL/BLOB_NAME
       • Replace the following:
         • ENDPOINT_URL: The blob endpoint URL (https://<storageaccountname>.blob.core.windows.net)
         • BLOB_NAME: The name of the blob (such as, <logname>-logs)
   • URI is a: Select the URI TYPE according to log stream configuration (Single file | Directory | Directory which includes subdirectories).

   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Shared key: The access key to the Azure Blob Storage.

   • Asset namespace: The asset namespace.

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalize screen, and then click Submit.

Set up feeds from the Content Hub

Specify values for the following fields:

• Azure URI: The blob endpoint URL.
  • ENDPOINT_URL/BLOB_NAME
    • Replace the following:
      • ENDPOINT_URL: The blob endpoint URL (https://<storageaccountname>.blob.core.windows.net)
      • BLOB_NAME: The name of the blob (such as, insights-logs-<logname>)
• URI is a: Select the URI TYPE according to log stream configuration (Single file | Directory | Directory which includes subdirectories).
• Source deletion options: Select the deletion option according to your ingestion preferences.
• Shared key: The access key to the Azure Blob Storage.

Advanced options

• Feed Name: A prepopulated value that identifies the feed.
• Source Type: Method used to collect logs into Google SecOps.
• Asset Namespace: Namespace associated with the feed.
• Ingestion Labels: Labels applied to all events from this feed.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.