Microsoft Azure Key Vault

About the Device

Azure Key Vault helps solve the following problems:

Secrets Management - Azure Key Vault can be used to Securely store and tightly control access to tokens, passwords, certificates, API keys, and other secrets
Key Management - Azure Key Vault can also be used as a Key Management solution. Azure Key Vault makes it easy to create and control the encryption keys used to encrypt your data.
Certificate Management - Azure Key Vault is also a service that lets you easily provision, manage, and deploy public and private Transport Layer Security/Secure Sockets Layer (TLS/SSL) certificates for use with Azure and your internal connected resources.

Azure Key Vault has two service tiers: Standard, which encrypts with a software key, and a Premium tier, which includes hardware security module(HSM)-protected keys.

Device Information

Entity	Particulars
Vendor Name	Microsoft Azure
Product Name	Key Vault
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method	Data Source
Azure Key Vault logging	AZURE_KEYVAULT_AUDIT	Cloud Storage - JSON	CyberHub	https://cloud.google.com/chronicle/docs/reference/feed-management-api#azure_blobstore

Device Configuration

Prerequisites

An Azure Key Vault environment (tenant) in Azure.
A user who's a Global Administrator or Key Vault Administrator.
Azure Storage Account to store the logs or an Event Hub to stream the logs.

Reference URLs:

How to create storage account: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal

How to configure Event Hub: https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-create

Configuration Steps

In the Azure portal, open Key Vaults and select the key vault to be configured for logging.

In Monitoring, click Diagnostic settings.

Select Add diagnostic setting. The Diagnostics settings page provides the settings for the diagnostic logs.
Provide Name, Select AuditEvents from Logs Categories.
As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. Adaptive MxDR supports log collection from both the options.

To configure archive to a storage account

Select Archive to a storage account as shown in below screenshot and choose an existing Subscription and Storage account.

Adaptive MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies.

To configure stream logs to an event hub

Select Stream to an event hub as shown in below screenshot.
Select Subscription, event hub namespace, event hub name and event hub policy name created during Event Hub as part of prerequisite.

Use below link to get credentials for Azure Storage and Azure Event HUB:

Get Credentials of Azure Storage and Azure EventHub

Integration Parameters

Parameters required from customer for Integration.

Via Azure EventHub:

Property	Default Value	Description
Logging Source	N/A	Select Storage
eventHubConnectionString	N/A	Event hub connection string
consumerGroupName	N/A	Optional and used if consumer Group is other than default
Account Key	Custom value	Access Key to access storage account
Blob Container	N/A	Storage blob Container name
Storage Account Name	Custom Value	Azure storage account name
Subscription	N/A	Set EventHub name
initialReadPolicy	N/A	N/A (keep default selection)

Via Azure Storage:

Property	Default Value	Description
Logging Source	N/A	Select EventHub
eventHubConnectionString	N/A	N/A (keep blank)
consumerGroupName	N/A	N/A (keep blank)
Account Key	Custom Value	Access Key to access storage account
Blob Container	N/A	Storage blob Container name e.g. insights-activity-logs
Storage Account Name	Custom Value	Azure storage account name
Subscription	N/A	Subscription ID that customer wants to be monitored
initialReadPolicy	N/A	Select Beginning to start reading from beginning and End to start reading logs from the end