Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

An analyst wants to detect abusive resource consumption in Azure Virtual Machines.  Using the VM Metrics Azure collector to send CPU and disk usage to Devo, the analyst will find machines with too much resource usage.  As a result, the analyst will remove the malicious mining programs, preventing them from degrading service and stealing compute.

...

Microsoft credentials are confusing. Before beginning, be aware of the different credential fields.

  1. In Azure, search for Entra ID.

    image-20250217-211507.png
  2. Click App registrations in the left menu and click the app (or Service Principal) that you are going to use.

    image-20250217-211531.pngImage Modified

    Register the application

    image-20250206-190600.pngImage Modified

  3. In the Overview area, find the Application (client) ID and the Directory (tenant) ID.

    image-20250206-183036.pngImage Modified
  4. Click Certificates & Secrets on the menu and create a new client secret by clicking the New client secret button.

    image-20250206-183225.pngImage Modified
  5. Add the secret.

Warning

Data loss warning: At the secret expiration time, the collector will stop working until the secret is replaced.

...

  1. Copy the secret value.

Note

Save the client secret value. It will only be shown once.

The value contains a tilde ~ character.

...

  1. Open Subscriptions.

    image-20250206-184445.pngImage Modified
  2. Select the correct subscription and note the subscription ID.

    image-20250206-184643.pngImage Modified

...

  1. Select Access control (IAM) in the left menu and click Add and Add role assignment.

    image-20250206-191214.pngImage Modified
  2. Select the Reader role.

    image-20250206-184900.pngImage Modified
  3. Click “Select members” and add the VM Metrics application.

    image-20250206-191511.pngImage Modified

9. Confirm the changes with Review + Assign.

Run It

In the Cloud Collector App, create an Azure Collector instance using this parameters template, replacing the values enclosed in < >.

...