Skip to end of metadata
Go to start of metadata

You are viewing an old version of this content. View the current version.

Compare with Current View Version History

« Previous Version 16 Next »

Purpose

An analyst wants to detect abusive resource consumption in Azure Virtual Machines.  Using the VM Metrics Azure collector to send CPU and disk usage to Devo, the analyst will find machines with too much resource usage.  As a result, the analyst will remove the malicious mining programs, preventing them from degrading service and stealing compute.

Example tables

Table

Description

cloud.azure.vm.metrics_simple

Virtual machine performance data in Azure

Authorize It

Microsoft credentials are confusing. Before beginning, be aware of the different credential fields.

  1. In Azure, search for Entra ID.

    image-20250217-211507.png

  2. Click App registrations in the left menu and click the app (or Service Principal) that you are going to use.

    image-20250217-211531.png

    Register the application

    image-20250206-190600.png

  3. In the Overview area, find the Application (client) ID and the Directory (tenant) ID.

    image-20250206-183036.png

  4. Click Certificates & Secrets on the menu and create a new client secret by clicking the New client secret button.

    image-20250206-183225.png

  5. Add the secret.

Data loss warning: At the secret expiration time, the collector will stop working until the secret is replaced.

image-20250206-183438.png

  1. Copy the secret value.

Save the client secret value. It will only be shown once.

The value contains a tilde ~ character.

image-20250206-184154.png

  1. Open Subscriptions.

    image-20250206-184445.png

  2. Select the correct subscription and note the subscription ID.

    image-20250206-184643.png

  3. Select Access control (IAM) in the left menu and click Add and Add role assignment.

    image-20250206-191214.png

  4. Select the Reader role.

    image-20250206-184900.png

  5. Click “Select members” and add the VM Metrics application.

    image-20250206-191511.png

9. Confirm the changes with Review + Assign.

Run It

In the Cloud Collector App, create an Azure Collector instance using this parameters template, replacing the values enclosed in < >.

Secure It

Monitor It

Create an inactivity alert to detect interruptions of transfer of data from the source to the SQS queue using the query

from TABLE 
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id

Set the inactivity alert to keep track of the collector_id.

  • No labels