Log Collection: Azure Parameters

Document created by RSA Information Design and Development on Sep 11, 2017Last modified by RSA Information Design and Development on Oct 12, 2017
Version 7Show Document
  • View in full screen mode
  

Microsoft Azure is a cloud computing platform and infrastructure for building, deploying, and managing applications and services through a global network of Microsoft-managed data centers.

Workflow

This workflow illustrates the basic tasks needed to start collecting events through Log Collection.

Log Collection workflow shows the basic tasks for collecting events.

What do you want to do?

                  
RoleI want to...Documentation
AdministratorConfigure Azure event source parameters.Configure Azure Event Sources in NetWitness Suite

Related Topics

Azure Event Source Configuration Parameters

This topic describes the Azure event source configuration parameters.

Note: Items that are followed by an asterisk (*) are required.

Basic Parameters

                                                       
NameDescription

Name *

Enter an alpha-numeric, descriptive name for the source. This value is only used for displaying the name on this screen.

Enabled

Select the checkbox to enable the event source configuration to start collection. The checkbox is selected by default.

Client ID *

The Client ID is found the Azure Application Configure tab. Scroll down until you see it.

Client Secret *

When you are configuring the event source, the client secret is displayed when you are creating a key, and you select a duration of validation.

Make sure to save this, because you will only be able to see it once, and it cannot be retrieved later.

API Resource Base URL *

Enter https://management.azure.com/. Be sure to include the trailing slash (/).

Federation Metadata Endpoint *

In your Azure application, click the View Endpoints button (near the bottom of the pane).

There are a lot of links that all begin with the same string. Compare the URLs and find the common string that begins most of them. This common string is the endpoint that you need to enter here.

Subscription ID *

You can find this in the Microsoft Azure dashboard: click on Subscriptions at the bottom of the list on the left.

Tenant Domain *

Go to the active directory and click on the directory. In the URL, the tenant domain is the string directly following manage.windowsazure.com/. The tenant domain is the string up to and including the .com.

Resource Group Names *

In Azure, select Resource groups from the left navigation pane, then select your group.

Start Date *

Choose the date from which to start collecting. Default's to the current date.

Test Connection

Checks the configuration parameters specified in this dialog to make sure they are correct.

Advanced Parameters

Click next to Advanced to view and edit the advanced parameters, if necessary.

                                   
NameDescription

Polling Interval

Interval (amount of time in seconds) between each poll. The default value is 180.
For example, if you specify 180, the collector schedules a polling of the event source every 180 seconds. If the previous polling cycle is still underway, the collector waits for that cycle to finish. If you have a large number of event sources that you are polling, it may take longer than 180 seconds for the polling to start because the threads are busy.

Max Duration Poll

Maximum duration, in seconds, of a polling cycle. A zero value indicates no limit.

Max Events Poll

The maximum number of events per polling cycle (how many events collected per polling cycle).

Max Idle Time Poll

Maximum duration, in seconds, of a polling cycle. A zero value indicates no limit.

Command Args

Optional arguments to be added to the script invocation.

Debug

Caution: Only enable debugging (set this parameter to On or Verbose) if you have a problem with an event source and you need to investigate this problem. Enabling debugging will adversely affect the performance of the Log Collector.

Caution: Enables or disables debug logging for the event source. Valid values are:

  • Off = (default) disabled
  • On = enabled
  • Verbose = enabled in verbose mode ‐ adds thread information and source context information to the messages.

This parameter is designed to debug and monitor isolated event source collection issues. If you change this value, the change takes effect immediately (no restart required). The debug logging is verbose, so limit the number of event sources to minimize performance impact.

Previous Topic:AWS Parameters
You are here
Table of Contents > Reference > Azure Parameters

Attachments

    Outcomes