Azure Event Hub collector

Purpose

An analyst wants to detect unauthorized changes in Azure or Entra ID.  Using the Azure Event Hub collector to send identity and access logs to Devo, the analyst will find privilege escalation events.  As a result, the analyst will remove malicious accounts, preventing them from disabling or modifying Azure resources.

The Azure Event Hub collector gets data from:

• Azure Monitor, which includes auditing, metrics, and logs of all Azure cloud computing services.

• Entra ID, which includes authentication and role threats.

• Any other kind of JSON data, which can be sent using a simple script.

Example tables

Authorize It

Previous requisites

• Access to Entra ID.

• Entra ID Security Administrator role.

• Subscription containing your Azure resources.

• Resource group containing your Azure resources.

• Name of the region containing Azure resources. Example: East US

If you have more than one set of these items, then authorize an Event Hub for each set.

During authorizing

Items created or used during the authorization process:

• App registration

• Event hub namespace

• Event hub

• Event hub policy

• Monitors

• Connection string

1. In Azure Portal, search for Entra ID.

2. Click App registrations in the left menu and click new registration.

3. Register the application.

4. Search for the Event Hubs service and click on it. 

5. Click Create.

6. Select the subscription and resource group corresponding to the resources that must be monitored.

7. Enter a name.

8. In the Location field, select the region containing the resources that must be monitored.

9. To capture Blob or Data Lake, see How Event Hubs Capture is charged to select a tier. Otherwise, select the cheapest tier and one throughput unit. If you need more resources, they can be added later.

10. Select Review+Create, then Create.

11. Return to Event Hubs and open the namespace created in the previous steps.

12. Select Access control (IAM) in the left menu, click Add, and click Add Access Role Assignment.

13. Search for the Azure Event Hubs Data Receiver role and select it and then click Next.

14. Click Select members and search for the previously created App registration.

15. Select the Application by clicking its name.

16. Once the application is already listed as a selected member, click Select.

17. Click Review + Assign.

18. In the namespace, create a shared access policy for sending data to the event hub.

19. Create a second shared access policy for listening to the event hub.

20. Open the listen policy and copy the primary connection string.

21. Return to the event hub and check the list of consumer groups. The Devo collector must have a dedicated consumer group. Devo recommends using the $Default consumer group for the collector without allowing other entities to use the event hub.

Send Data

• Enable Monitor to get audit, reliability, metrics, and Microsoft recommendation data.

• Enable Entra ID to get authentication data.

• Use an SDK to send JSON data from your custom applications.

• Use HTTPs to send JSON data.

Run It

In the Cloud Collector App, create an Azure Collector instance using this parameters template, replacing the values enclosed in < >. The region name for each event hub will be logged in the region field of cloud.azure. It is not required to be your Azure region.

{
  "inputs": {
    "azure_event_hub": {
      "enabled": true,
      "id": "<UNIQUE VALUE>",
      "services": {
        "event_hubs": {
          "queues": {
            "<REGION>": {
              "consumer_group": "$Default",
              "event_hub_connection_string": "<CONNECTION STRING>",
              "event_hub_name": "<EVENT HUB>",
              "namespace": "<NAMESPACE OF EVENT HUB>"
            }
          }
        }
      }
    }
  }
}

For each event hub, the consumer group should only be used by one collector. If the consumer group is shared with other entities, data will be lost. To check if your collector has been enabled successfully, validate it.

Secure It

Devo Exchange provides different Alerts Packs to help you monitor Azure data:

• Platform alert pack: Azure detects when an attacker is trying to attack Microsoft Azure environments.

• Authentication alert pack works with Entra ID data.

• Collective Defense alert pack works with Azure Application Gateway and Azure Firewall.

• DNS alert pack works with Azure Firewall DNS proxy.

Entra ID

See Entra ID collector.

Azure Storage

IP address 1.1.1.1 has been identified as an indicator of compromise. Identify storage actions taken by this IP to determine how many storage resources have been modified. Use the results to assess if the IP should be blocked.

from cloud.azure.storage.administrative
where eq(callerIpAddress,1.1.1.1)
group by operationName 
select length(collectdistinct(resourceId)) as resources

Azure App Service

Malicious principals have been stopping applications. Before reenabling the applications, identify the principals and revoke their access so they cannot stop the applications again.

from cloud.azure.appservice.administrative
where eq(operationName,"MICROSOFT.WEB/SITES/STOP/ACTION")
group by identity__authorization__evidence__principalId as principal, resultType
select length(collectdistinct(resourceId)) as applications_stopped

Monitor It

Create an inactivity alert to detect interruptions in the data transfer from the source to the event hub using the query.

from cloud.azure
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id

Set the inactivity alert to keep track of the collector_id.

Select values of the product field can also be monitored for inactivity.