Diagnostic setting

As explained in Azure Security

A diagnostic setting is an Azure configuration that selects resource telemetry and routes it to a specified monitoring or storage destination.

A diagnostic setting configures Azure resource logs and metrics for collection and routes them to a selected monitoring, storage, event, or partner destination. Resource and activity logs are not collected automatically, so enabling the setting supports investigation of suspicious activity and potential compromise. section 9.10 section 9.2

Choose the destination according to how the telemetry will be used:

• Send it to a Log Analytics workspace (LAW) for queries, alerts, and visualizations alongside other data. section 9.3
• Send it to an Azure Storage account for cost-effective log and metric archiving. section 9.3
• Send it to an Azure Event Hub when data must leave Azure, such as for an external SIEM. section 9.3
• Use an Azure Monitor partner integration when a specialized non-Microsoft monitoring platform is already in use. section 9.3

Configure Key Vault logging

In Azure Monitor, open Diagnostic Settings, filter by the Key Vault subscription and resource group, select the vault, and choose Add Diagnostic Setting. Name it, such as Audit; select platform logs and metrics such as allLogs; choose a destination such as a LAW; select its subscription and workspace; then save. Data should appear in the destination within 90 minutes. Each setting supports one destination, so sending data to multiple destinations requires multiple settings, with a maximum of five per resource. section 9.3.1 section 9.3

Figure 9.5 Configuring diagnostic settings in Azure Monitor

Use the configuration view to identify the resource, selected telemetry, and destination settings. section 9.3.1

How Azure Security covers it

How deep it goes

Details telemetry selection, four destination types, portal configuration, propagation timing, and per-resource limits.

Examples

Uses an Azure Key Vault, the allLogs selection, a Log Analytics workspace, and the Azure Monitor portal workflow.

What it assumes

Assumes Azure resources and Azure Monitor terminology, while distinguishing automatically collected platform metrics from configurable platform logs.

What you can do after

Configure diagnostic settings in Azure Monitor and route selected resource telemetry to an appropriate destination.

How it connects

Connects Azure Monitor with resource logs, activity logs, metrics, Log Analytics workspaces, Azure Event Hubs, and Azure Storage accounts.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• loguses · A log is a record of events, activity, or diagnostic information produced during the operation of a system or process, often ordered by time.
• Azure Storageuses · Azure Storage is Microsoft’s cloud storage platform, providing services for storing and accessing data such as blobs, files, queues, tables, and disks.
• Log Analyticsuses · Log Analytics is an Azure Monitor service and data store for collecting, retaining, querying, and analyzing logs, telemetry, and related operational data.
• metricuses · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
• resource logconfigures · A resource log is a record generated by an Azure service that describes operations performed within a specific Azure resource.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.