Skip to main content

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Azure Activity Logs Cloud Collector

Before you configure the Azure Activity Logs Cloud Collector you must complete the following prerequisites:

  • Create an Event Hub and obtain the consumer group name to be entered while configuring the Cloud Collector.

  • Obtain the connection string to be entered while configuring the Cloud Collector.

  • (Optional) Configure your Event Hub setup for enabling sufficient egress. Consider referring to the tip in this section.

  • Configure Azure Activity Logs to enable the cloud collector to collect data related to the activities performed by users or services in the subscription.

Obtain the Consumer Group Name and Connection String

Before configuring the Azure Activity Logs Cloud Collector, use the following steps to obtain the Consumer Group Name and Connection String for your EventHub endpoint. Ensure that you create an Event Hub if you do not have one.

Tip

To configure your Event Hub setup for enabling sufficient egress, refer to the following tips.

  • Examine the incoming number of bytes per second, by navigating to the Event Hub page on the Azure portal.

  • Set up the Event Hub with a good throughput capacity. The egress and ingress capacity of Event Hubs is measured by throughput units (TU). Ensure that your Event Hub provides 1 Throughput Unit (TU) per 2MB/sec egress and 1MB/sec ingress capacity.

  • Ensure that your Event Hub has 32 partitions and at least 1 TU per partition.

    If you notice that your workload requirement exceeds the maximum value recommended for Event Hub Premium which is 32 partitions and 40 TU, you need to migrate to a Dedicated Event Hub Cluster.

  • Consider using the Auto-inflate throughput feature. You can enable Auto-inflate on the Event Hub namespace to automatically increase the number of TUs based on the load. For more information about throughput units, limits, and associated billing, see Event Hubs FAQs and Azure Event Hubs quotas and limits.

  1. To obtain the name of the consumer group of the Event Hub, perform the following steps. Ensure that you have the Event Hubs namespace. If you do not have one, create an Event Hubs namespace.

    1. On the Azure portal, navigate to the Event Hubs namespace in which the Event Hub with the data you want to retrieve resides.

      EventHub_1_1.png
      EventHub_1_2.png

    2. Select the EventHub where your data to be retrieved resides.

      Eventhub_5.png

      Note

      If connection errors occur after the Cloud Collector configuration, enable local authentication for a given Event Hubs namespace.

      Event_hub_5_local_authentication.png

    3. Navigate to Consumer groups to note the name of the consumer group.

      If only Exabeam is going to read data from the Event Hub, use the default consumer group. Otherwise, create a dedicated consumer group for Exabeam.

      consumer_group1.png

      Note

      Ensure that you create and use a unique consumer group. If you use the same consumer group for two cloud collector instances, it may result in event loss and ingestion issues.

  2. Create a SAS policy with listen-only permissions for Exabeam:

    1. In Event Hub, navigate to Shared access policies.

    2. Click + Add to add a new Policy on the Add SAS Policy page and enable the Listen permission.

    3. Provide a descriptive name for the token which is listen-only, then click Create.

    4. After you see the confirmation message (for example Creating SAS Policy successful), access the policy you just created and note the following.

      • SAS policy name

      • Primary key value

        Note

        The Connection string primary key acts as a connection string for the Azure Activity Logs Cloud Collector.

      Event_Hub_4_2.png

      Proceed to configure the Azure Activity Logs Cloud Collector.

Configure Azure Activity Logs to Forward Events to your Event Hub

To enable the cloud collector to fetch data about users or services that performed activities in the subscription and the status of the activities, perform the following steps. For more information see send the activity log to a Log Analytics workspace in Microsoft documentation.

  1. On the Azure portal, navigate to Azure Services > Monitor > Activity Log.

    Azure_portal_activity_logs_1.png

  2. Click Export Activity Logs.

    Azure_portal_activity_logs_2.png

  3. Click Add diagnostic setting.

  4. In the Diagnostic setting section, specify a name in the Diagnostic setting name field, to save your settings.

  5. Select the log categories.

  6. In the Destination details section, select Stream to an event hub, then select the relevant Event hub namespace and retain the default Event hub policy name.

    Azure_portal_activity_logs_5.png

  7. Click Save.

    The Diagnostic settings section displays the setting that you saved. The activity logs are forwarded to the selected Event hub to enable the cloud collector to collect the activity data.