wodle name="azure-logs"

Configuration options of the Azure-Logs wodle.

Options

Options	Allowed values
disabled	yes, no
interval	A positive number + suffix
run_on_start	yes, no
day	A day of the month
wday	A day of the week
time	A time of the day [hh:mm]
timeout	A positive number (seconds)
log_analytics	N/A
log_analytics\application_id	Any string
log_analytics\application_key	Any string
log_analytics\auth_path	File path
log_analytics\tenantdomain	Any string
log_analytics\request	N/A
log_analytics\request\tag	Any string
log_analytics\request\query	Any string without double quotes
log_analytics\request\workspace	Any string
log_analytics\request\timeout	A positive number (seconds)
log_analytics\request\time_offset	A positive number + suffix
graph	N/A
graph\application_id	Any string
graph\application_key	Any string
graph\auth_path	File path
graph\tenantdomain	Any string
graph\request	N/A
graph\request\tag	Any string
graph\request\query	Any string
graph\request\timeout	A positive number (seconds)
graph\request\time_offset	A positive number + suffix
storage	N/A
storage\account_name	Any string
storage\account_key	Any string
storage\auth_path	File path
storage\tag	Any string
storage\container	N/A
storage\container name	Any string
storage\container\blobs	Extension
storage\container\content_type	text, json_file or json_inline
storage\container\timeout	A positive number (seconds)
storage\container\time_offset	A positive number + suffix
storage\container\path	Any string

disabled

Disables the Azure-Logs wodle.

Default value	no
Allowed values	yes, no

interval

The interval between Azure-Logs executions.

Default value	1d
Allowed values	A positive number that should contain a suffix character indicating a time unit, such as, s (seconds), m (minutes), h (hours), d (days), w (weeks), M (months)

The interval option is conditioned by the following described options day, wday and time. If none of these options are set, the interval can take any allowed value.

run_on_start

Run evaluation immediately when the service is started.

Default value	yes
Allowed values	yes, no

day

Day of the month to run the Azure-Logs.

Default value	n/a
Allowed values	Day of the month [1..31]

Note

When the day option is set, the interval value must be a multiple of months. By default, the interval is set to a month.

wday

Day of the week to run the Azure-Logs. This option is not compatible with the day option.

Default value	n/a
Allowed values	Day of the week: sunday/sun monday/mon tuesday/tue wednesday/wed thursday/thu friday/fri saturday/sat

Note

When the wday option is set, the interval value must be a multiple of weeks. By default, the interval is set to a week.

time

Time of the day to run the Azure-Logs. It has to be represented in the format hh:mm.

Default value	n/a
Allowed values	Time of day [hh:mm]

Note

When only the time option is set, the interval value must be a multiple of days or weeks. By default, the interval is set to a day.

timeout

Timeout for each evaluation. In case the execution takes longer than the specified timeout, it stops.

Default value	0
Allowed values	A positive number (seconds)

log_analytics

Defines the use of the Azure Log Analytics REST API to get the desired logs.

This block configures the integration with Azure Log Analytics REST API.

log_analytics\application_id
log_analytics\application_key
log_analytics\auth_path
log_analytics\tenantdomain
log_analytics\request

Options	Allowed values
log_analytics\application_id	Any string
log_analytics\application_key	Any string
log_analytics\auth_path	File path
log_analytics\tenantdomain	Any string
log_analytics\request	N/A

log_analytics\application_id

Identifier of the application that we will use for the authentication and to be able to use the Azure Log Analytics API. It must be used next to the application_key option obligatorily. Incompatible with auth_path option.

Default value	N/A
Allowed values	Any string

log_analytics\application_key

Key to the application we will use for authentication and to be able to use the Azure Log Analytics API. It must be used next to the application_id option obligatorily. Incompatible with auth_path option.

Default value	N/A
Allowed values	Any string

log_analytics\auth_path

Path of the file that contains the application identifier and the application key for authentication in order to use the Azure Log Analytics API. Incompatible with application_id and application_key options.

Default value	N/A
Allowed values	File path

File example:

application_id = 8b7...c14
application_key = w22...91x

log_analytics\tenantdomain

A tenant is simply a dedicated instance of Microsoft Entra ID (ME-ID). The Azure Log Analytics API uses the Microsoft Entra ID authentication scheme.

Default value	N/A
Allowed values	Any String

log_analytics\request

This option includes all the other options needed to make a query. We can have more than one request entry.

request options

Options	Allowed values
log_analytics\request\tag	Any string
log_analytics\request\query	Any string without double quotes
log_analytics\request\workspace	Any string
log_analytics\request\timeout	A positive number (seconds)
log_analytics\request\time_offset	A positive number + suffix

log_analytics\request\tag

Defines a tag that we will add to the query. This entry is optional and can be used to facilitate searches for events that are tagged or to create custom rules.

Default value	N/A
Allowed values	Any String

log_analytics\request\query

This is the query made to the Azure Log Analytics API. This option is compatible with any valid query accepted by the Log Analytics portal, as long as it does not contains double quotes ("). If you need to use double quotes, you must replace them with single ones (') or escape them by using the backslash character (\").

Here are some examples of valid queries:

AuditLogs | where OperationVersion contains '1'
AuditLogs | where OperationVersion contains \"1\"

For more information on Log Analytics query's language, check the Azure documentation.

Default value	N/A
Allowed values	Any String without double quotes

log_analytics\request\workspace

Defines the workspace where we will perform the queries.

Default value	N/A
Allowed values	Any String

log_analytics\request\timeout

Timeout for each request evaluation. This option overwrites the general timeout option. In case the execution takes longer than the specified timeout, it stops.

Default value	0
Allowed values	A positive number (seconds)

log_analytics\request\time_offset

This option sets the time delay in which we will perform the query. For example, if we establish this option with the value "1d", the integration will perform the query on the events that have been generated in the interval of time defined between the current date of the system minus one day (1d) and the current date of the system.

Default value	Date of execution at `00:00:00`
Allowed values	A positive number that should contain a suffix character indicating a time unit, such as, m (minutes), h (hours), d (days)

Example of log_analytics configuration

<wodle name="azure-logs">

    <disabled>no</disabled>
    <day>15</day>
    <time>02:00</time>
    <run_on_start>yes</run_on_start>

    <log_analytics>

        <auth_path>/var/ossec/wodles/credentials/log_analytics_credentials</auth_path>
        <tenantdomain>wazuh.onmicrosoft.com</tenantdomain>

        <request>
            <tag>azure-activity</tag>
            <query>AzureActivity | where SubscriptionId == 2d7...61d </query>
            <workspace>d6b...efa</workspace>
            <time_offset>36h</time_offset>
        </request>

    </log_analytics>

</wodle>

graph

This block configures the integration with Azure Active Directory Graph REST API.

graph\application_id
graph\application_key
graph\auth_path
graph\tenantdomain
graph\request

Options	Allowed values
graph\application_id	Any string
graph\application_key	Any string
graph\auth_path	File path
graph\tenantdomain	Any string
graph\request	N/A

graph\application_id

Identifier of the application that we will use for the authentication and to be able to use the Azure Active Directory Graph API. It must be used next to the application_key option obligatorily. Incompatible with auth_path option.

Default value	N/A
Allowed values	Any string

graph\application_key

Key to the application we will use for authentication and to be able to use the Azure Active Directory Graph API. It must be used next to the application_id option obligatorily. Incompatible with auth_path option.

Default value	N/A
Allowed values	Any string

graph\auth_path

Path of the file that contains the application identifier and the application key for authentication in order to use the Azure Active Directory Graph API. Incompatible with the application_id and application_key options. Check the credentials reference for more information about this topic.

Default value	N/A
Allowed values	File path

graph\tenantdomain

A tenant is simply a dedicated instance of Microsoft Entra ID (ME-ID) because it uses the Microsoft Entra ID authentication scheme.

Default value	N/A
Allowed values	Any String

graph\request

This option includes all the other options needed to make a query. We can have more than one request entry.

request options

Options	Allowed values
graph\request\tag	Any string
graph\request\query	Any string containing `auditLogs/directoryaudits`, `auditLogs/signIns` or `auditLogs/provisioning` plus any optional query parameter
graph\request\timeout	A positive number (seconds)
graph\request\time_offset	A positive number + suffix

graph\request\tag

Defines a tag that we will add to the query. This entry is optional and can be used to facilitate searches for events that are tagged or to create custom rules.

Default value	N/A
Allowed values	Any String

graph\request\query

The query used to obtain the logs from the Microsoft Graph API. The query value must be auditLogs/directoryaudits, auditLogs/signIns, or auditLogs/provisioning in conjunction with the desired optional parameters and filters available for these report types. Check this Microsoft Activity reports reference page to learn more about how the activity reports work and the available query parameters for each one.

Default value	N/A
Allowed values	Any string containing `auditLogs/directoryaudits`, `auditLogs/signIns` or `auditLogs/provisioning` plus any optional query parameter

graph\request\timeout

Timeout for each request evaluation. This option overwrites the general timeout option. In case the execution takes longer than the specified timeout, it stops.

Default value	0
Allowed values	A positive number (seconds)

graph\request\time_offset

This option sets the time-lapse that the query will request. For example, if this option is set to the value "1d", the integration will request the events generated in the interval of time defined between the current system's date minus one day (1d) and the current system's date.

Default value	Date of execution at `00:00:00`
Allowed values	A positive number that should contain a suffix character indicating a time unit, such as, m (minutes), h (hours), d (days)

Example of graph configuration

<wodle name="azure-logs">

    <disabled>no</disabled>
    <wday>Friday</wday>
    <time>12:00</time>
    <run_on_start>no</run_on_start>
    <timeout>1800</timeout>

    <graph>

        <auth_path>/var/ossec/wodles/credentials/graph_credentials</auth_path>
        <tenantdomain>wazuh.onmicrosoft.com</tenantdomain>

        <request>
            <tag>microsoft-entra_id</tag>
            <query>activities/audit?api-version=beta</query>
            <time_offset>1d</time_offset>
        </request>

    </graph>

</wodle>

storage

This block configures the integration with Azure Storage.

storage\account_name
storage\account_key
storage\auth_path
storage\tag
storage\container

Options	Allowed values
storage\account_name	Any string
storage\account_key	Any string
storage\auth_path	File path
storage\tag	Any string
storage\container	N/A

storage\account_name

Identifier of the account name that we will use for the authentication- It must be used next to the account_key option obligatorily. Incompatible with auth_path option.

Default value	N/A
Allowed values	Any string

storage\account_key

Identifier of the account key that we will use for the authentication- It must be used next to the account_name option obligatorily. Incompatible with auth_path option.

Default value	N/A
Allowed values	Any string

storage\auth_path

Path of the file that contains the account name and the account key for authentication. Incompatible with account_name and account_key options.

Default value	N/A
Allowed values	File path

storage\tag

Defines a tag that we will add to the query. This entry is optional and can be used to facilitate searches for events that are tagged or to create custom rules.

Default value	N/A
Allowed values	Any String

storage\container

Options	Allowed values
storage\container name	Any string
storage\container\blobs	Extension
storage\container\content_type	text, json_file or json_inline
storage\container\timeout	A positive number (seconds)
storage\container\time_offset	A positive number + suffix
storage\container\path	Any string

storage\container name

Specifies the name of the container. Enter * to access all account containers.

Default value	N/A
Allowed values	Any String/"*"

storage\container\blobs

Specifies the extension of the blobs like .json. Enter * to access all the containers blobs.

Note

This option is related to option content_type, because if any blob has a different content to the one we have indicated, it will not be read correctly. Therefore, we need to be aware of what content we are trying to obtain and take it into consideration when using this option with "*".

Default value	*
Allowed values	Extension/"*"

storage\container\content_type

This parameter indicates the format of the blobs' content. The available values are:

text. Plain text. Each line is a log.
json_file. The blob contains records of logs in standard json format.
json_inline. Each line is a log in json format.

The format of logs stored in Azure accounts is inline JSON.

Note

When the day option is set, the interval value must be a multiple of months. By default, the interval is set to a month.

Default value	json_inline
Allowed values	text/json_file/json_inline

storage\container\timeout

Timeout for each request evaluation. This option overwrites the general timeout option. In case the execution takes longer than the specified timeout, it stops.

Default value	0
Allowed values	A positive number (seconds)

storage\container\time_offset

Default value	Date of execution at `00:00:00`
Allowed values	A positive number that should contain a suffix character indicating a time unit, such as, m (minutes), h (hours), d (days)

storage\container\path

Defines, for the container, a path to search for logs. If it isn't present, the module retrieves all the blobs starting from the root level.

Default value	N/A
Allowed values	Valid path

Example of storage configuration

<wodle name="azure-logs">

    <disabled>no</disabled>
    <interval>1d</interval>
    <run_on_start>yes</run_on_start>

    <storage>

        <auth_path>/var/ossec/wodles/credentials/storage_credentials</auth_path>
        <tag>azure-activity</tag>

        <container name="insights-operational-logs">
            <blobs>.json</blobs>
            <content_type>json_inline</content_type>
            <time_offset>24h</time_offset>
            <path>info-logs</path>
        </container>

        <container name="audit-logs"/>

    </storage>
</wodle>

Example of all integration

<wodle name="azure-logs">

    <disabled>no</disabled>
    <day>15</day>
    <time>02:00</time>
    <run_on_start>yes</run_on_start>

    <log_analytics>

        <auth_path>/var/ossec/wodles/credentials/log_analytics_credentials</auth_path>
        <tenantdomain>wazuh.onmicrosoft.com</tenantdomain>

        <request>
            <tag>azure-activity</tag>
            <query>AzureActivity | where SubscriptionId == 2d7...61d </query>
            <workspace>d6b...efa</workspace>
            <time_offset>36h</time_offset>
        </request>

    </log_analytics>

    <graph>

        <auth_path>/var/ossec/wodles/credentials/graph_credentials</auth_path>
        <tenantdomain>wazuh.onmicrosoft.com</tenantdomain>

        <request>
            <tag>microsoft-entra_id</tag>
            <query>activities/audit?api-version=beta</query>
            <timeout>7200</timeout>
            <time_offset>1d</time_offset>
        </request>

    </graph>

    <storage>

        <auth_path>/var/ossec/wodles/credentials/storage_credentials</auth_path>
        <tag>azure-activity</tag>

        <container name="insights-operational-logs">
            <blobs>.json</blobs>
            <content_type>json_inline</content_type>
            <time_offset>24h</time_offset>
            <path>info-logs</path>
        </container>

        <container name="audit-logs"/>

    </storage>
</wodle>