Azure AD Sign-in Logs not pulling into SPLUNK from GitHub

[JoshuaL1]

*Have configured Azure AD Sign-in Logs to be sent to an EventHub and then for Splunk to pull them.
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-integrate-activity-logs-with-splunk
*EventHub is properly pulling the logs, however in Splunk I only see data for Azure

[sebastus]

Hi @JoshuaL1. This is new functionality. It's in the securitygraph branch. It'll be merge with master shortly.

[darksteen]

This is a major issue for us too. We're moving en bloc to o365 and AZ.
Need security and auditing in place before we can put that into production.
Or auditors won't let us. :(

[sebastus]

Hi @darksteen what can you tell me about the symptoms? A few things to look at: what hub is the telemetry going into? Do you see telemetry going into and out of it? Is it possible that more than one consumer is draining that hub? Are you getting messages in Splunk about the initialization of the add-on data inputs? Does your hubs.json contain the hub that is receiving the telemetry? Where is the Splunk box? (On prem/Azure/other?) Is the internet reachable from that box?

[nbheu1]

Hi, in summary after hours of troubleshooting.

1. Yes we get data into the eventhub as event hub namespace, with event hub instance names: insights-logs-auditlogs and insights-logs-signinlogs

2. SPLUNK TA addon for Azure is configured correctly, and we have verified connectivity is reaching azure ad to get token, it collects secret from Key Vault (diagnostic verifications in storageaccount json file log)

3. Enabling diagostic on our Linux SPLUNK Heavy Forwarder, we see it connects to the evnt hub name space, but with only request to a none existing instance name:
   String: 'sb://spleh636707020781289480.servicebus.windows.net/insights-operational-logs/consumergroups/$default/partitions/0'

What strings we should expect to see the SPLUNK TA send request for should look like these to reach the name instances in namespace:

'sb://spleh636707020781289480.servicebus.windows.net/insights-logs-auditlogs/consumergroups/$default/partitions/0'

'sb://spleh636707020781289480.servicebus.windows.net/insights-logs-signinlogs/consumergroups/$default/partitions/0'

Instance hub names are not possible to se in the splunk ta addon for azure in web GUI.
Only the Event HUB Namespace is a setting we set there.

Microsoft Event HUB support engineer told us it is not possible to collect Azure AD Activity logs: audits and signin's, yet.
If someone can confirm if we indeed can collect the Azure AD audit and signin logs that we have in the event hub namespace/instance hub names, then confirm. To me it seems Microsoft do confirm in this document that we are able to get the logs into the SPLUNK SIEM:

https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-integrate-activity-logs-with-splunk

[IvarNy]

I also see the same issue with our Azure setup. Would really appreciate a fix so the valuable AD logs could be collected.

[nbheu1]

Hi, Ivar.

I resolved this issue by removing the event hub, rerun the PS script to setup the needful.
https://github.com/Microsoft/AzureMonitorAddonForSplunk/blob/master/scripts/azure-setup.sh

I observed the last part of the script, did not complete, and I paid more attention to what the failure was and why it was not able to complete:

SERVICE_BUS_RULE_ID="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.EventHub/namespaces/$EVENTHUB_NAMESPACE_NAME/authorizationrules/RootManageSharedAccessKey"
az monitor log-profiles delete --name $LOG_PROFILE_NAME
az monitor log-profiles create
--name $LOG_PROFILE_NAME
--location null
--locations $LOCATIONS
--categories $LOG_PROFILE_CATEGORIES
--enabled false
--days 0
--service-bus-rule-id $SERVICE_BUS_RULE_ID
--query null

For my issue, it was already a default profile there from the azlog.msi tool, that blocked that final part to complete, and that really blocked the Azure AD events to be pulled using the event hub api for some reason. We used azlog tool to collect events earlier. I removed the deprecated default profile using powershell.

I removed this default profile, deleted the key vault, Azure app id and key vault, and the reran the PS script. This time with no issues. In the evnt hub name space the event hub instance names are created when you configure sources. I then configured the Azure AD Signin export settings to use the new event hub name space, and the it were created in the EH Name space.

New issue:
I observed that the names(naming convention) is not always apples for apples that are listed in the AzureMonitor JSON file:
https://github.com/Microsoft/AzureMonitorAddonForSplunk/blob/master/bin/app/hubs.json

After installing Azure Monitor AddOn in Splunk:
Make sure to adjust or add lines in this hubs.json file so your event hub namespace -->instance hub name are equal to what are listed in Azure.

Hope it helps.
Hans

[IvarNy]

Hei Hans og takk for sist!

I did not have your first issues, as I am currently playing with this on a new Azure test setup, and did not use the script, but stepped through this in Azure GUI for learning.
But thanks for the tip on the hubs.json file that hit the nail on the head!
Indeed there was a different spelling of my automatically added eventhub for AD Audit, so after adding the correct spelling / eventhub name in hubs.json I am getting events from AD.
Seems correct the laments I have heard about logging i Azure being a rather fast moving target...

Br
Ivar

[nbheu1]

Takk fo sist ja Ivar.
Great you found the missing PUZZLE :-)

[mpras123]

Hi Hans,
Could you share the a sample copy of the hubs.json file. I am receiving the logs but they are coming in rather very slow, wanted to cross verify the hubs.json that you got it working.
Regards,
Prasad

[mpras123]

i think i figured it out, the logs are coming in now.

[simobe]

@mpras123 , @nbheu1 , @IvarNy Could you please share your hubs.json?

I think I might have the same issue since the symptoms are the same (no Sign-ins logs in Splunk, but I have other event types) and I did not get any error while executing the script.
The events are in the EventHub and Splunk is gathering some of them, but not Sign-ins.

Thanks in advance.

Kindest Regards,

Simone

[sebastus]

Simone, Hubs.json is individual. Copying from someone else will likely cause problems for you. Look in the Azure portal at your event hub namespace page. Then click on the link at left bar to display the list of event hubs within the namespace. Ensure that your hubs.json contains only these hub names. Then we can look further if problems still persist. Thanks, Greg

…

On Fri, Feb 1, 2019 at 6:20 PM Simone Benefico ***@***.***> wrote: @mpras123 <https://github.com/mpras123> , @nbheu1 <https://github.com/nbheu1> , @IvarNy <https://github.com/IvarNy> Could you please share your hubs.json? I think I might have the same issue since the symptoms are the same (no Sign-ins logs in Splunk, but I have other event types) and I did not get any error while executing the script. The events are in the EventHub and Splunk is gathering some of them, but not Sign-ins. Thanks in advance. Kidnest Regards, Simone — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#64 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABOrrDe2skmghovkO5rh2pjJPnK88ieUks5vJIV_gaJpZM4V4Po3> .

[simobe]

I did as you suggested but it does not work yet.

Can you please help me check out what is wrong with my configuration?

I attach a screenshot of the EventHub list from Azure and my hubs.json.

hubs.txt

Regards,

Simone

[sebastus]

I can't see the contents of hubs.txt. Let me assume it contains a json object listing each of the hubs with "resourceId" as the "value" of each key/value pair, like this: { "hubname": "resourceId", "hubname": "resourceId", etc. next thing: insights-operational-logs is for the Activity Logs data input. It should not be in hubs.json. insights-metrics-pt1m should not be in hubs.json. Metrics must be acquired via the metrics data input. The remaining 4 should be in hubs.json. With this list of hubs, you need to be running all 3 data inputs, Activity Logs, Diagnostic Logs and Metrics. Make sense?

…

On Wed, Feb 6, 2019 at 8:42 AM Simone Benefico ***@***.***> wrote: I did as you suggested but it does not work yet. Can you please help me check out what is wrong with my configuration? I attach a screenshot of the EventHub list from Azure and my hubs.json. [image: eventhubs] <https://user-images.githubusercontent.com/1288276/52329539-5583bf00-29f3-11e9-9030-b64e40f4ab6b.png> hubs.txt <https://github.com/Microsoft/AzureMonitorAddonForSplunk/files/2835444/hubs.txt> Regards, Simone — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#64 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABOrrB-YFHayHBGFv8Kq4trmfkzWuyL8ks5vKpVlgaJpZM4V4Po3> .

[simobe]

I need only Sign-ins.
Should I enable all 3 inputs anyway or just Activity Logs is fine?