---
title: "Azure Event Hub collector"
canonical: "https://docs.devo.com/space/latest/1198522408/Azure%20Event%20Hub%20collector"
format: markdown
---
> Macro (toc)

## Purpose

An analyst wants to detect unauthorized changes in [Azure](https://learn.microsoft.com/en-us/azure/?product=popular) or [Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/whatis).  Using the Azure Event Hub collector to send identity and access logs to Devo, the analyst will find privilege escalation events.  As a result, the analyst will remove malicious accounts, preventing them from disabling or modifying Azure resources.

The Azure Event Hub collector gets data from:

- Azure [Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview), which includes [auditing, metrics, and logs](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198686237) of all Azure [cloud computing services](https://azure.microsoft.com/en-us/products).
- [Entra ID](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198063647), which includes authentication and role threats.
- Any other kind of JSON data, which can be sent using a [simple script](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-python-get-started-send?tabs=connection-string%2Croles-azure-portal#send-events).

## Example tables

| **Table** | **Description** |
| --- | --- |
| [cloud.azure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/322764842) | Data from Event Hubs, VM Metrics, Entra ID, and other sources. |
| cloud.azure.*service*.*type* | For most Azure [services](https://azure.microsoft.com/en-us/products), there is a separate table for each type of log associated with that service. |
| [cloud.azure.ad](http://cloud.azure.ad).* | Entra ID identity and access management logs. |
| cloud.azure.ad.signin_all | This union table combines all the different Entra ID authentication logs. |
| cloud.azure.ah.alert_info | [Alerts](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-alertinfo-table) for threats impacting Microsoft services with intelligence from [Advanced Hunting](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem). |
| [auth.all](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126107) | Authentication logs, including Entra ID and Azure SQL authentication. |
| [web.all.access](https://devodocs.atlassian.net/wiki/spaces/latest/pages/180879467) | Web activity, including Azure [Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/overview). |
| [firewall.all.traffic](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126157) | Firewall activity, including [Azure Firewall](https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall). |
| [network.dns](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126195) | DNS activity, including [Azure Firewall DNS Proxy](https://learn.microsoft.com/en-us/azure/firewall/dns-details). |

## Authorize It

It will take several hours to configure Azure.

To perform the authorization, the Entra Security Administrator role is required.

Items required before authorizing an Event Hub:

- [Subscription](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/cloud-subscription) containing your Azure resources.
- [Resource group](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal) containing your Azure resources.
- Name of the [region](https://datacenters.microsoft.com/globe/explore/) containing Azure resources.  Example: East US
- Entra directory.

If you have more than one set of these items, then authorize an Event Hub for each set.


Items created or used during the authorization process:

- Event hub [namespace](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-features)
- [Event hub](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-about)
- Event hub policy
- [Monitors](https://learn.microsoft.com/en-us/azure/azure-monitor/overview)
- [Connection string](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string)


1. In [Azure Portal](https://portal.azure.com/), search for the **Event Hubs** service and click on it.
2. Click **Create** to add a namespace.
3. Select the subscription and resource group corresponding to the resources that must be monitored.
4. Enter a name.
5. In the Location field, select the region containing the resources that must be monitored.
6. To capture Blob or Data Lake, see [How Event Hubs Capture is charged](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-capture-overview?WT.mc_id=Portal-Microsoft_Azure_EventHub#how-event-hubs-capture-is-charged) to select a tier.  Otherwise, select the cheapest tier and one throughput unit.  If you need more resources, they can be added later.
7. Select “Review+Create,” then “Create.”
8. Return to Event Hubs and open the namespace created in the previous steps.
9. In the namespace, create a shared access policy for sending data to the event hub.
10. Create a second shared access policy for listening to the event hub.
11. Open the listen policy and copy the primary connection string.
12. Go to Overview and add an event hub.
13. Name the event hub.
14. Select 32 partitions.
15. Set the retention time to the maximum.
16. Review + Create and then Create.
17. **Return** to the event hub and check the list of consumer groups.  The Devo collector must have a dedicated consumer group.  Devo recommends using the `$Default` consumer group for the collector without allowing other entities to use the event hub.  If the consumer group is shared with other entities, data will be lost.

## Send Data

- Enable [Monitor](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198686237) to get audit, reliability, metrics, and Microsoft recommendation data.
- Enable [Entra ID](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198063647) to get authentication data.
- Query your Defender endpoint data with Advanced Hunting and [send the results](https://learn.microsoft.com/en-us/defender-endpoint/api/raw-data-export-event-hub).
- Use an [SDK](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-python-get-started-send?tabs=connection-string%2Croles-azure-portal#send-events) to send JSON data from your custom applications.
- Use [HTTPs](https://learn.microsoft.com/en-us/rest/api/eventhub/send-event) to send JSON data.

## Run It

In the Cloud Collector App, [create an Azure Collector instance](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131).  **Remove **the default collector parameters and insert this parameters template, replacing the values enclosed in `< >`.  The `<REGION>` for each event hub will be logged in the *region* field of cloud.azure.  It is not required to be your Azure region.  Only alphanumeric regions are supported.  The  `id` must be five digits.

```
{
  "inputs": {
    "azure_event_hub": {
      "enabled": true,
      "id": "<5 UNIQUE DIGITS>",
      "services": {
        "event_hubs": {
          "queues": {
            "<REGION>": {
              "consumer_group": "$Default",
              "event_hub_connection_string": "<CONNECTION STRING>",
              "event_hub_name": "<EVENT HUB>"
            }
          }
        }
      }
    }
  }
}
```


![1011_Azure Event Hub collector.png](media://7900df75-c3c6-4dfa-9b67-a7997822d55b)

For each event hub, the consumer group should only be used by one collector.  If the consumer group is shared with other entities, data will be lost.  To check if your collector has been enabled successfully, [validate it](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1197998088).

## Secure It

The library provides an [Azure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#CLOUD%2FAZURE) queries.  The [AUTH](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#AUTH) queries work with Entra ID data.  The [DNS](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#NETWORK%2FDNS) queries work with Azure Firewall DNS proxy.

### Entra ID

See [Entra ID collector](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198063647).

### Azure Storage

IP address 1.1.1.1 has been identified as an indicator of compromise.  Identify storage actions taken by this IP to determine how many storage resources have been modified.  Use the results to assess if the IP should be blocked.

```
from cloud.azure.storage.administrative
where eq(callerIpAddress,1.1.1.1)
group by operationName 
select length(collectdistinct(resourceId)) as resources
```

### Azure App Service

Malicious principals have been stopping applications.  Before reenabling the applications, identify the principals and revoke their access so they cannot stop the applications again.

```
from cloud.azure.appservice.administrative
where eq(operationName,"MICROSOFT.WEB/SITES/STOP/ACTION")
group by identity__authorization__evidence__principalId as principal, resultType
select length(collectdistinct(resourceId)) as applications_stopped
```

## Monitor It

Create an [inactivity alert](https://docs.devo.com/space/latest/95126785/Inactivity+alert) to detect interruptions of transfer of data from the source to the event hub using the query

```
from cloud.azure
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
```

Set the inactivity alert to keep track of the `collector_id`.  

Select values of the `product` field can also be monitored for inactivity.