Content Comparison

...

The Azure Event Hub collector brings gets data to Devofrom:

• Azure Monitor, which includes auditing, metrics, and logs of all Azure cloud computing services.

• Entra ID, which includes authentication and role threats.

• Any other kind of string data, which can be sent using a simple script.

...

1. In Azure Portal, search for Entra ID.

   

2. Click App registrations in the left menu and click new registration

   

3. Register the application

4. Search for the Event Hubs service and click on it. 

   

5. Click Create.

   

6. Select the subscription and resource group corresponding to the resources that must be monitored.

7. Enter a name.

8. In the Location field, select the region containing the resources that must be monitored.

9. To capture Blob or Data Lake, see How Event Hubs Capture is charged to select a tier. Otherwise, select the cheapest tier and one throughput unit. If you need more resources, they can be added later.

   

10. Select “Review+Create,” then “Create.”

11. Return to Event Hubs and open the namespace created in the previous steps.

    

12. Select Access control (IAM) in the left menu, click Add, and click Add Access Role Assignment.

    

13. Search for the Azure Event Hubs Data Receiver role and select it and then click Next.

    

14. Click Select members and search for the previously created App registration.

15. Select the Application by clicking its name.

16. Once the application is already listed as a selected member, click Select.

    

17. Click Review + Assign.

18. In the namespace, Create a shared access policy for sending data to the event hub.

    

19. Create a second shared access policy for listening to the event hub.

    

20. Open the listen policy and copy the primary connection string.

    

21. Return to the event hub and check the list of consumer groups. The Devo collector must have a dedicated consumer group. Devo recommends using the $Default consumer group for the collector without allowing other entities to use the event hub. If the consumer group is shared with other entities, data will be lost.

    Image Added

Send Data

• Enable Monitor to get audit, reliability, metrics, and Microsoft recommendation data.

• Enable Entra ID to get authentication data.

• Use an SDK to send data from your custom applications.

• Use HTTPs.

...

{
  "inputs": {
    "azure_event_hub": {
      "enabled": true,
      "id": "<UNIQUE VALUE>",
      "services": {
        "event_hubs": {
          "queues": {
            "<REGION>": {
              "consumer_group": "$Default",
              "event_hub_connection_string": "<CONNECTION STRING>",
              "event_hub_name": "<EVENT HUB>",
              "namespace": "<NAMESPACE OF EVENT HUB>"
            }
          }
        }
      }
    }
  }
}

For each event hub, the consumer group should only be used by one collector. If the consumer group is shared with other entities, data will be lost. To check if your collector has been enabled successfully, validate it.

...

Create an inactivity alert to detect interruptions of transfer of data from the source to the SQS queue event hub using the query

from cloud.azure
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id

...