Microsoft Azure VPN

1 About The Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About The Device

Azure VPN Gateway is a service that uses a specific type of virtual network gateway to send encrypted traffic between an Azure virtual network and on-premises locations over the public Internet. You can also use VPN Gateway to send encrypted traffic between Azure virtual networks over the Microsoft network. Multiple connections can be created to the same VPN gateway. When you create multiple connections, all VPN tunnels share the available gateway bandwidth.

Because you can create multiple connection configurations using VPN Gateway, you need to determine which configuration best fits your needs. Point-to-Site, Site-to-Site, and coexisting ExpressRoute/Site-to-Site connections all have different instructions and configuration requirements.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Microsoft
Product Name	Azure VPN
Type of Device	Hybrid

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method
Azure VPN	AZURE_VPN	C2C Storage - JSON	CyberHub

Device Configuration

Prerequisites:

An Azure subscription that you can sign in to.
A user who's a Global Administrator
Azure Storage Account to store the logs or an Event Hub to stream the logs.

Reference URLs

How to create storage account?
https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal
How to configure Event Hub?
https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-create

Configuration Steps

Use Azure Admin credentials to configure the steps on the device.
Log in to the Azure portal, navigate to Azure VPN Gateway
In Settings, select Diagnostic settings and click + Add diagnostic setting

On the next Window, provide the required name and select all types of Logs Categories.
As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. Adaptive MxDR supports log collection from both the options.

Configure a Storage Account

Adaptive MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies

To store logs in Storage Account, In Destination details, select Archive to a storage account and choose an existing Subscription and Storage account.

OR

Configure EventHub

Select Stream to an event hub.
Select Subscription, Event hub namespace, Event hub name and Event hub policy name created during Event Hub as part of the prerequisite.

Get credentials of Azure Storage and Azure EventHub: Get Credentials of Azure Storage and Azure EventHub

Integration Parameters

Parameters required from customer for Integration.

Via Azure Storage:

Property	Default Value	Description

Property	Default Value	Description
Logging Source	N/A	Select Storage
eventHubConnectionString	N/A	N/A (keep blank)
consumerGroupName	N/A	N/A (keep blank)
Account Key	Custome value	Access Key to access storage account
Blob Container	N/A	Storage blob Container name e.g. insights-activity-logs
Storage Account Name	Custome value	Azure storage account name
Subscription	N/A	Subscription ID that customer wants to be monitored
initialReadPolicy	N/A	Select Beginning to start reading from beginning and End to start reading logs from the end

Via Azure EventHub:

Property	Default Value	Description

Property	Default Value	Description
Logging Source	N/A	Select EventHub
eventHubConnectionString	N/A	Event hub connection string
consumerGroupName	N/A	Optional and used if consumer Group is other than default
Account Key	Custom Value	Access Key to access storage account
Blob Container	N/A	Storage blob Container name
Storage Account Name	Custom Value	Azure storage account name
Subscription	N/A	Set EventHub name
initialReadPolicy	N/A	N/A (keep default selection)