README.md

Microsoft Azure

Azure Logging and Monitoring

• Data Collection Best Practices

Azure Cloud Adoption Framework

• Monitoring - Service Level Objectives
• Cloud Models - Monitoring Overview
• Monitoring Strategy

Azure Monitor

• Azure Monitor - Security Controls using Azure Policy

Azure Monitor Logs

• Azure Monitor Logs - Workspace Design
• Azure Monitor Logs - Data Retention and Archive

ARM Schemas

• Github - Azure/azure-resource-manager-schemas

---

Azure Platform Logs

• Activity Logs

  • Subscription-Level Events
  • Default Retention: 90 Days
  • Automatically Collected/Generated
    • Forward to a Destination for Longer Retention
  • Log Analytics Table: AzureActivity

• Resource Logs

  • Resource-Level Events
  • Provide detailed diagnostic and auditing information for Azure resources and the Azure platform they depend on.
  • Are not collected until they're routed to a destination

• Azure Active Directory Logs

  • Tenant-Level Events
  • Automatically Collected/Generated: Yes
  • Cost
    • Sending to Log Analytics: No
    • Log Analytics Data Ingestion: Yes
    • Log Analytics Data Retention: Yes
  • How-To Integrate Activity Logs with Log Analytics
  • Azure Sentinel - Connect Azure AD Logs

• Log Destinations

  • Log Analytics
    • Retention Mechanism: Archive Policy
    • Pricing
  • Storage Account
    • Retention Mechanism: Lifecycle Management Policy
  • Event Hub
  • Partner Integrations

References

• Log Management Fundamentals for Cybersecurity Engineers

• Highly Effective Azure Monitoring with Azure Log Analytics

• Microsoft Cybersecurity Reference Architectures

• Understanding Azure Logs from a security perspective — Part 1 — Activity Logs

• Understanding Azure Logs from a security perspective — Part 2 — NSG Flow Logs

• Log Management Fundamentals for Cybersecurity Engineers

• Security Log Management Lifecycle with Microsoft Sentinel

• Incident Case Management on Sentinel — Syncing status between different solutions