Purpose
An analyst wants to detect abusive resource consumption in Azure Virtual Machines. Using the VM Metrics Azure collector to send CPU and disk usage to Devo, the analyst will find machines with too much resource usage. As a result, the analyst will remove the malicious mining programs, preventing them from degrading service and stealing compute.
Example tables
Table | Description |
|---|---|
cloud.azure.vm.metrics_simple | Virtual machine performance data in Azure |
Authorize It
Microsoft credentials are confusing. Consult Microsoft collector OAuth authentication before you begin.
In Azure, search for Azure Active Directory.
Click App registrations in the left menu and click the app (or Service Principal) that you are going to use.
In the Overview area, find the Application (client) ID and the Directory (tenant) ID.
Click Certificates & Secrets on the menu and create a new client secret by clicking the New client secret button.
Save the client secret value. It will only be shown once.
The value contains a tilde ~ character.
Get the subscription ID by searching for Subscriptions on the home page.
Find the correct subscription and note the subscription ID.
Go to the desired Resource Group or Subscription.
Select Access control (IAM) in the left menu and click Add.
Select the Reader role and choose the previously created App registration.
Confirm the changes.
Run It
In the Cloud Collector App, create an Azure Collector instance using this parameters template, replacing the values enclosed in < >.
Secure It
Monitor It
Create an inactivity alert to detect interruptions of transfer of data from the source to the SQS queue using the query
from TABLE where toktains(hostchain,"collector-") select split(hostchain,"-",1) as collector_id
Set the inactivity alert to keep track of the collector_id.