Skip to main content

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Azure Event Hub Cloud Collector

Before you configure the Azure Event Hub Cloud Collector you must complete the following prerequisites:

  • Obtain the consumer group name to be entered while configuring the Cloud Collector.

  • Obtain the connection string to be entered while configuring the Cloud Collector.

  • (Optional) Configure your Event Hub setup for enabling sufficient egress. Consider referring to the tip in this section.

Before configuring the Azure Event Hub Cloud Collector, use the following steps to obtain the Consumer Group Name and Connection String for your EventHub endpoint.

  1. To obtain the name of the consumer group of the Event Hub, perform the following steps.

    1. On the Azure portal, navigate to the Event Hubs namespace in which the Event Hub with the data you want to retrieve resides.

      EventHub_1_1.png
      EventHub_1_2.png

    2. Select the EventHub where your data to be retrieved resides.

      Eventhub_5.png

      Note

      If connection errors occur after the Cloud Collector configuration, enable local authentication for a given Event Hubs namespace.

      Event_hub_5_local_authentication.png

    3. Navigate to Consumer groups to note the name of the consumer group.

      If only Exabeam is going to read data from the Event Hub, use the default consumer group. Otherwise, create a dedicated consumer group for Exabeam.

      consumer_group1.png

      Note

      Ensure that you create and use a unique consumer group. If you use the same consumer group for two cloud collector instances, it may result in event loss and ingestion issues.

  2. Create a SAS policy with listen-only permissions for Exabeam:

    1. In Event Hub, navigate to Shared access policies.

    2. Click + Add to add a new Policy on the Add SAS Policy page and enable the Listen permission.

    3. Provide a descriptive name for the token which is listen-only, then click Create.

    4. After you see the confirmation message (for example Creating SAS Policy successful), access the policy you just created and note the following.

      • SAS policy name

      • Primary key value

        Note

        The Connection string primary key acts as a connection string for the Azure Event Hub Cloud Collector.

      Event_Hub_4_2.png

      Proceed to configure the Azure Event Hub Cloud Collector.

Tip

To configure your Event Hub setup for enabling sufficient egress, refer to the following tips.

  • Examine the incoming number of bytes per second, by navigating to the Event Hub page on the Azure portal.

  • Set up the Event Hub with a good throughput capacity. The egress and ingress capacity of Event Hubs is measured by throughput units (TU). Ensure that your Event Hub provides 1 Throughput Unit (TU) per 2MB/sec egress and 1MB/sec ingress capacity.

  • Ensure that your Event Hub has 32 partitions and at least 1 TU per partition.

    If you notice that your workload requirement exceeds the maximum value recommended for Event Hub Premium which is 32 partitions and 40 TU, you need to migrate to a Dedicated Event Hub Cluster.

  • Consider using the Auto-inflate throughput feature. You can enable Auto-inflate on the Event Hub namespace to automatically increase the number of TUs based on the load. For more information about throughput units, limits, and associated billing, see Event Hubs FAQs and Azure Event Hubs quotas and limits.