About The Device
Azure VPN Gateway is a service that uses a specific type of virtual network gateway to send encrypted traffic between an Azure virtual network and on-premises locations over the public Internet. You can also use VPN Gateway to send encrypted traffic between Azure virtual networks over the Microsoft network. Multiple connections can be created to the same VPN gateway. When you create multiple connections, all VPN tunnels share the available gateway bandwidth.
Because you can create multiple connection configurations using VPN Gateway, you need to determine which configuration best fits your needs. Point-to-Site, Site-to-Site, and coexisting ExpressRoute/Site-to-Site connections all have different instructions and configuration requirements.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | Microsoft |
Product Name | Azure VPN |
Type of Device | Hybrid |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log Collection Method |
|---|---|---|---|
Azure VPN | AZURE_VPN | C2C Storage - JSON | CyberHub |
Device Configuration
Prerequisites:
An Azure subscription that you can sign in to.
A user who's a Global Administrator
Azure Storage Account to store the logs or an Event Hub to stream the logs.
Reference URLs
How to create storage account?
https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portalHow to configure Event Hub?
https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-create
Configuration Steps
Use Azure Admin credentials to configure the steps on the device.
Log in to the Azure portal, navigate to Azure VPN Gateway
In Settings, select Diagnostic settings and click + Add diagnostic setting
On the next Window, provide the required name and select all types of Logs Categories.
As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. Adaptive MxDR supports log collection from both the options.
Configure a Storage Account
Adaptive MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies
To store logs in Storage Account, In Destination details, select Archive to a storage account and choose an existing Subscription and Storage account.
OR
Configure EventHub
Select Stream to an event hub.
Select Subscription, Event hub namespace, Event hub name and Event hub policy name created during Event Hub as part of the prerequisite.
Get credentials of Azure Storage and Azure EventHub: Get Credentials of Azure Storage and Azure EventHub
Integration Parameters
Parameters required from customer for Integration.
Via Azure Storage:
Property | Default Value | Description |
|---|---|---|
Logging Source | N/A | Select Storage |
eventHubConnectionString | N/A | N/A (keep blank) |
consumerGroupName | N/A | N/A (keep blank) |
Account Key | Custome value | Access Key to access storage account |
Blob Container | N/A | Storage blob Container name e.g. |
Storage Account Name | Custome value | Azure storage account name |
Subscription | N/A | Subscription ID that customer wants to be monitored |
initialReadPolicy | N/A | Select Beginning to start reading from beginning and End to start reading logs from the end |
Via Azure EventHub:
Property | Default Value | Description |
|---|---|---|
Logging Source | N/A | Select EventHub |
eventHubConnectionString | N/A | Event hub connection string |
consumerGroupName | N/A | Optional and used if consumer Group is other than default |
Account Key | Custom Value | Access Key to access storage account |
Blob Container | N/A | Storage blob Container name |
Storage Account Name | Custom Value | Azure storage account name |
Subscription | N/A | Set EventHub name |
initialReadPolicy | N/A | N/A (keep default selection) |