Az - Monitoring

Reading time: 6 minutes

Entra ID - Logs

Kuna aina 3 za logi zinazopatikana katika Entra ID:

• Sign-in Logs: Logi za kuingia zinarekodi kila jaribio la uthibitishaji, iwe ni la mafanikio au la kushindwa. Zinatoa maelezo kama anwani za IP, maeneo, taarifa za kifaa na sera za ufikiaji zilizotumika, ambazo ni muhimu kwa kufuatilia shughuli za mtumiaji na kugundua tabia za kuingia zisizo za kawaida au vitisho vya usalama vinavyoweza kutokea.
• Audit Logs: Logi za ukaguzi zinatoa rekodi ya mabadiliko yote yaliyofanywa ndani ya mazingira yako ya Entra ID. Zinakamata masasisho kwa watumiaji, vikundi, majukumu, au sera kwa mfano. Logi hizi ni muhimu kwa ufuatiliaji wa kufuata sheria na uchunguzi wa usalama, kwani zinakuwezesha kupitia nani alifanya mabadiliko gani na lini.
• Provisioning Logs: Logi za usambazaji zinatoa taarifa kuhusu watumiaji waliotolewa katika mpangilio wako kupitia huduma ya mtu wa tatu (kama vile directories za ndani au programu za SaaS). Logi hizi zinakusaidia kuelewa jinsi taarifa za utambulisho zinavyosawazishwa.

Entra ID - Log Systems

• Diagnostic Settings: Kuweka uchunguzi kunabainisha orodha ya makundi ya logi za jukwaa na/au vipimo ambavyo unataka kukusanya kutoka kwa rasilimali, na mahali pa moja au zaidi ambapo ungeweza kuyapeleka. Ada za matumizi za kawaida kwa mahali hapo zitatokea. Jifunze zaidi kuhusu makundi tofauti ya logi na maudhui ya logi hizo.
• Destinations:
• Analytics Workspace: Uchunguzi kupitia Azure Log Analytics na kuunda arifa.
• Storage account: Uchambuzi wa statiki na nakala.
• Event hub: Pitia data kwa mifumo ya nje kama SIEMs za mtu wa tatu.
• Monitor partner solutions: Mchanganyiko maalum kati ya Azure Monitor na majukwaa mengine ya ufuatiliaji yasiyo ya Microsoft.
• Workbooks: Workbooks zinachanganya maandiko, maswali ya logi, vipimo, na vigezo katika ripoti zenye mwingiliano mzuri.
• Usage & Insights: Inasaidia kuona shughuli za kawaida zaidi katika Entra ID.

Azure Monitor

Hizi ni sifa kuu za Azure Monitor:

• Activity Logs: Azure Activity Logs zinakamata matukio ya kiwango cha usajili na operesheni za usimamizi, zikikupa muonekano wa mabadiliko na hatua zilizochukuliwa kwenye rasilimali zako.
• Activily logs cannot be modified or deleted.
• Change Analysis: Change Analysis inagundua kiotomatiki na kuonyesha mabadiliko ya usanidi na hali katika rasilimali zako za Azure ili kusaidia kutambua matatizo na kufuatilia mabadiliko kwa muda.
• Alerts: Arifa kutoka Azure Monitor ni taarifa za kiotomatiki zinazozinduliwa wakati hali au viwango vilivyowekwa vinapotimizwa katika mazingira yako ya Azure.
• Workbooks: Workbooks ni dashibodi zenye mwingiliano, zinazoweza kubadilishwa ndani ya Azure Monitor ambazo zinakuwezesha kuchanganya na kuonyesha data kutoka vyanzo mbalimbali kwa uchambuzi wa kina.
• Investigator: Investigator inakusaidia kuchambua data za logi na arifa ili kufanya uchambuzi wa kina na kutambua sababu za matukio.
• Insights: Insights zinatoa uchambuzi, vipimo vya utendaji, na mapendekezo yanayoweza kutekelezwa (kama vile yale katika Application Insights au VM Insights) ili kukusaidia kufuatilia na kuboresha afya na ufanisi wa programu zako na miundombinu.

Log Analytics Workspaces

Log Analytics workspaces ni hazina kuu katika Azure Monitor ambapo unaweza kukusanya, kuchambua, na kuonyesha data za logi na utendaji kutoka kwa rasilimali zako za Azure na mazingira ya ndani. Hapa kuna pointi muhimu:

• Centralized Data Storage: Zinatumika kama mahali pa kati kuhifadhi logi za uchunguzi, vipimo vya utendaji, na logi za kawaida zinazozalishwa na programu na huduma zako.
• Powerful Query Capabilities: Unaweza kufanya maswali kwa kutumia Kusto Query Language (KQL) ili kuchambua data, kuzalisha maarifa, na kutatua matatizo.
• Integration with Monitoring Tools: Log Analytics workspaces zinajumuisha huduma mbalimbali za Azure (kama vile Azure Monitor, Azure Sentinel, na Application Insights) zikikuruhusu kuunda dashibodi, kuweka arifa, na kupata muonekano wa kina wa mazingira yako.

Kwa muhtasari, Log Analytics workspace ni muhimu kwa ufuatiliaji wa hali ya juu, kutatua matatizo, na uchambuzi wa usalama katika Azure.

Unaweza kuunda rasilimali kutuma data kwa analytics workspace kutoka kwa diagnostic settings za rasilimali hiyo.

Enumeration

Entra ID

# Get last 10 sign-ins
az rest --method get --uri 'https://graph.microsoft.com/v1.0/auditLogs/signIns?$top=10'

# Get last 10 audit logs
az rest --method get --uri 'https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$top=10'

# Get last 10 provisioning logs
az rest --method get --uri ‘https://graph.microsoft.com/v1.0/auditLogs/provisioning?$top=10’

# Get EntraID Diagnostic Settings
az rest --method get --uri "https://management.azure.com/providers/microsoft.aadiam/diagnosticSettings?api-version=2017-04-01-preview"

# Get Entra ID Workbooks
az rest \
--method POST \
--url "https://management.azure.com/providers/microsoft.resourcegraph/resources?api-version=2021-03-01" \
--headers '{"commandName": "AppInsightsExtension.GetWorkbooksListArg"}' \
--body '{
"subscriptions": ["9291ff6e-6afb-430e-82a4-6f04b2d05c7f"],
"query": "where type =~ \"microsoft.insights/workbooks\" \n| extend sourceId = tostring(properties.sourceId) \n| where sourceId =~ \"Azure Active Directory\" \n| extend DisplayName = tostring(properties.displayName) \n| extend WorkbookType = tostring(properties.category), LastUpdate = todatetime(properties.timeModified) \n| where WorkbookType == \"workbook\"\n| project DisplayName, name, resourceGroup, kind, location, id, type, subscriptionId, tags, WorkbookType, LastUpdate, identity, properties",
"options": {"resultFormat": "table"},
"name": "e4774363-5160-4c09-9d71-2da6c8e3b00a"
}' | jq '.data.rows'

Azure Monitor

# Get last 10 activity logs
az monitor activity-log list --max-events 10

# Get Resource Diagnostic Settings
az rest --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.DocumentDb/databaseAccounts/<db-name>/providers/microsoft.insights/diagnosticSettings?api-version=2021-05-01-preview"

# Get Entra ID Workbooks
az rest \
--method POST \
--url "https://management.azure.com/providers/microsoft.resourcegraph/resources?api-version=2021-03-01" \
--headers '{"commandName": "AppInsightsExtension.GetWorkbooksListArg"}' \
--body '{
"content": {},
"commandName": "AppInsightsExtension.GetWorkbooksListArg"
}'

# List Log Analytic groups
az monitor log-analytics workspace list --output table

# List alerts
az monitor metrics alert list --output table
az monitor activity-log alert list --output table