README.md

Goal

Configuring Key Vault Analytics solution and creating KeyVault alerts.

Installing the solution

1. Go to the ResourceGroup gab2018-dev, select the KeyVault gab2018-dev-kv.

2. In the menu, select Log analytics (OMS).

3. Select + Add and type Key Vault Analytics in the search box.

4. In the results select Key Vault Analytics.

5. Select Create

6. Select the OMS workspace named gab2018-dev-oms-all

7. To deploy the solution, select Create

8. The Key Vault Analytics solution should now be available in the ResourceGroup gab2018-dev.

Enabling Key Vault diagnostics to be sent to Log Analytics

1. Go to the ResourceGroup gab2018-dev, select the KeyVault gab2018-dev-kv.

2. In the menu, select Diagnostics logs.

3. Select + Add diagnostic setting.

4. In the Name textbox type Log Analytics.

5. Select Send to Log Analytics.

6. Select Configure and choose the OMS workspace named gab2018-dev-oms-all

7. In Log, check the checkbox AuditEvent

8. Select Save

Access the KeyVault Secrets

1. Go to the ResourceGroup gab2018-dev, select the KeyVault gab2018-dev-kv.

2. In the menu, select Secrets.

3. Select a secret in the list, select the current version and select the Show secret value.

The goal here is to create access logs to the KeyVault, so we will be able to use it later. It should take up to 15-20 minutes to be able to use those logs.

Creating an alert with Log Analytics for when KeyVault secrets are accessed

1. Go to the ResourceGroup gab2018-dev, select the Key Vault Analytics resource KeyVaultAnalytics(gab2018-dev-oms-all).

2. In the overview summary, select the Key Vault Analytics.

3. In ALL OPERATIONS, select the SecretGet operation.

4. Select + New Alert Rule

5. In 1.Define alert condition select Alert Criteria

6. In the Alert Logic, set the Threshold value to 1 and select Done

7. In 2.Define alert details, enter the following values:

• Alert rule name: KeyVault Secret Accessed
• Description: Triggered when Key Vault secrets are accessed more than two times in 5 minutes.
• Severity: Informational(Sev 2)

8. In 3.Define action group, select + New action group.

Enter the following values:

• Action group name: Email Alert group
• Short name: EmailGroup.

9. In the actions, create an action with the following values:

• Action name: SendEmail
• Action Type: Email/SMS/Push/Voice

10. Select Edit details, enter your Email and select OK.

11. Finalize the creation of the by selecting OK

12. Wait for the action group to be created, and select Select action group.

13. Choose the created action group in the list and select Add.

14. Now select Create alert rule to finalize the creation of the alert and wait for it to be created.

15. Go to the ResourceGroup gab2018-dev, select the Log Analytics resource gab2018-dev-oms-all.

16. Select Alerts and ensure the alert was properly created.

Test and receive an alert

1. Go to the ResourceGroup gab2018-dev, select the KeyVault gab2018-dev-kv.

2. Then in the menu, select Secrets.

3. Select the first secret in the list and select the current version.

4. Go back to the list, select the second secret and select the current version.

It should take up a few minutes to receive the KeyVault secrets accessed alert.

Reference

• Log Analytics
• Key Vault Analytics Solution

End

Previous Step Next Step