Ingest Data from Azure Event Hubs

Security Requirements and Controls

Available:Azure Ingest v1.189.0

Azure Ingest is available in v1.189.0.

Falcon LogScale can ingest logs from Azure Event Hubs, which can then be managed in Falcon LogScale and leveraged using queries, alerts and alarms.

In the following we will run through the configuration process of ingesting this data.

Falcon LogScale will consume from the Azure Event Hub and scale ingest based on the number of partitions configured in the event hub. There will typically be some latency between the events occurring to them being available, both from the side producing the events (for example, Azure Monitor) and from the Falcon LogScale consumer.

Azure log data is an extremely valuable data source that comes in a variety of flavors depending on the services you are looking to learn more about. Some of the most common data sources include Microsoft Defender™, Azure Monitor™ and Microsoft Entra ID™.

These logs can be directed to an Azure Event Hub where they can be ingested by Falcon LogScale. Falcon LogScale continuously polls the Azure Event Hub in batches and process and ingests the data.

Important

Using event hubs is charged based on Azure Event Hub pricing, see https://azure.microsoft.com/en-us/pricing/details/event-hubs/.

Prerequisites for Ingesting Azure Data

To successfully configure a Azure ingest feed, you will need:

  • An Event Hub with data, see Microsoft Documentation.

  • A Storage Account with Blob storage container (new or existing), see Microsoft Documentation.

  • Falcon LogScale

  • These permissions on Azure:

    • Assign read access to Event Hub for App Service Principal

    • Assign read and write access to Storage Blob for App Service Principal

Configuration

Register an app on the Microsoft Identity Platform as described here.

  • Create new App Registration.

  • Get the Client ID and Tenant ID for your application

  • Generate a secret (save immediately, only shown once)

  • Note the Secret ID for reference.