Journaux d’audit Azure

info

Aperçu

Lakewatch est en aperçu privé. Pour demander l'accès, contactez l'équipe de votre compte Databricks.

Présentation

Les logs d'audit Azure capturent l'activité du répertoire à partir de Microsoft Entra ID (anciennement Azure Active Directory), comme les modifications apportées aux utilisateurs, aux groupes et aux applications. Lakewatch ingère les logs d'audit Azure à partir du stockage cloud à l'aide d'Auto Loader et schématise les données avec l'analyseur azure_audit intégré. Il s'agit d'une source de stockage cloud, pas d'un connecteur API.

Intégrer les Logs d’audit Azure

Pour ingérer les journaux d’audit Azure, créez une source de données de stockage cloud et attachez l’analyseur azure_audit intégré pour que les événements soient écrits dans une table analysée schématisée. Pour connaître les prérequis, les accès Unity Catalog et les étapes complètes de configuration de la source de données, reportez-vous à Stockage cloud.

Schéma analysé et observables

L’analyseur azure_audit intégré schématise les Logs d’audit Azure dans une table analysée. Chaque table analysée contient également les colonnes gérées par Lakewatch :

• lw_id: Chaîne non nulle que Lakewatch utilise comme clé primaire, prenant en charge la déduplication lors des lectures incrémentielles.
• time: un timestamp d'événement non nul attribué par le parser.
• lw_meta: métadonnées de traitement Lakewatch standard.
• lw_observables: Valeurs extraites des champs marqués comme observables de sécurité dans l’analyseur.

Pour plus d'informations, consultez la référence du parser.

Schéma de table analysé

Le parser azure_audit écrit les colonnes suivantes (générées à partir de la définition du parser) :

Colonne	Type de données
Level	STRING
callerIpAddress	STRING
category	STRING
correlationId	STRING
durationMs	DOUBLE
identity	STRING
location	STRING
locationDetails	VARIANT
networkLocationDetails	VARIANT
operationName	STRING
operationVersion	STRING
time	TIMESTAMP
properties	STRUCT<aadTenantId: STRING, activityDateTime: TIMESTAMP, activityDisplayName: STRING, additionalDetails: ARRAY<STRUCT<key: STRING, value: STRING>>, alternateSignInName: STRING, appDisplayName: STRING, appliedConditionalAccessPolicies: VARIANT, appliedEventListeners: VARIANT, appId: STRING, appServicePrincipalId: STRING, authenticationAppDeviceDetails: VARIANT, authenticationStrengths: VARIANT, authenticationAppPolicyEvaluationDetails: VARIANT, authenticationContextClassReferences: VARIANT, authenticationDetails: VARIANT, authenticationMethodsUsed: VARIANT, authenticationProcessingDetails: VARIANT, authenticationProtocol: STRING, authenticationRequirement: STRING, authenticationRequirementPolicies: VARIANT, autonomousSystemNumber: STRING, _billedSize: DOUBLE, category: STRING, clientAppUsed: STRING, clientCredentialType: STRING, conditionalAccessAudiences: VARIANT, conditionalAccessPolicies: VARIANT, conditionalAccessStatus: STRING, correlationId: STRING, createdDateTime: TIMESTAMP, crossTenantAccessType: STRING, deviceDetail: VARIANT, federatedCredentialId: STRING, flaggedForReview: BOOLEAN, globalSecureAccessIpAddress: STRING, homeTenantId: STRING, homeTenantName: STRING, id: STRING, incomingTokenType: STRING, ipAddress: STRING, ipAddressFromResourceProvider: STRING, _isBillable: STRING, isDeleted: BOOLEAN, initiatedBy: STRUCT<app: STRUCT<displayName: STRING, servicePrincipalId: STRING, appId: STRING>, user: STRUCT<id: STRING, displayName: STRING, userPrincipalName: STRING, ipAddress: STRING, roles: VARIANT>>, isProcessing: BOOLEAN, loggedByService: STRING, location: VARIANT, networkLocationDetails: VARIANT, operationType: STRING, result: STRING, resultReason: STRING, isInteractive: BOOLEAN, isRisky: BOOLEAN, isTenantRestricted: BOOLEAN, isThroughGlobalSecureAccess: BOOLEAN, originalRequestId: STRING, originalTransferMethod: STRING, privateLinkDetails: VARIANT, processingTimeInMilliseconds: BIGINT, resource: STRING, resourceDisplayName: STRING, resourceGroup: STRING, resourceId: STRING, resourceIdentity: STRING, resourceProvider: STRING, resourceOwnerTenantId: STRING, resourceServicePrincipalId: STRING, resourceTenantId: STRING, riskEventTypes: VARIANT, riskEventTypes_v2: VARIANT, riskLastUpdatedDateTime: TIMESTAMP, riskDetail: STRING, riskLevel: STRING, riskLevelAggregated: STRING, riskLevelDuringSignIn: STRING, riskState: STRING, rngcStatus: STRING, servicePrincipalId: STRING, servicePrincipalCredentialKeyId: STRING, servicePrincipalName: STRING, sessionId: STRING, sessionLifetimePolicies: VARIANT, signInIdentifier: STRING, signInIdentifierType: STRING, signInTokenProtectionStatus: STRING, sourceSystem: VARIANT, ssoExtensionVersion: STRING, status: VARIANT, targetResources: ARRAY<STRUCT<displayName: STRING, id: STRING, modifiedProperties: ARRAY<STRUCT<oldValue: STRING, displayName: STRING, newValue: STRING>>, type: STRING, administrativeUnits: VARIANT, groupType: STRING, userPrincipalName: STRING>>, tenantId: STRING, timeGenerated: TIMESTAMP, tokenIssuerName: STRING, tokenIssuerType: STRING, tokenProtectionStatusDetails: VARIANT, type: STRING, uniqueTokenIdentifier: STRING, userAgent: STRING, userDisplayName: STRING, userId: STRING, userPrincipalName: STRING, userType: STRING, activity: STRING, additionalInfo: STRING, detectedDateTime: TIMESTAMP, detectionTimingType: STRING, lastUpdatedDateTime: TIMESTAMP, mitreTechniqueId: STRING, riskEventType: STRING, riskType: STRING, source: STRING, identity: STRING, operationName: STRING, resultDescription: STRING, resultType: STRING, C_DeviceId: STRING, C_Sid: STRING, C_Iat: STRING, C_Idtyp: STRING, UserPrincipalObjectID: STRING, __UDI_RequiredFields_EventTime: TIMESTAMP, __UDI_RequiredFields_RegionScope: STRING, __UDI_RequiredFields_TenantId: STRING, __UDI_RequiredFields_UniqueId: STRING, apiVersion: STRING, atContentH: STRING, atContentP: STRING, clientAuthMethod: STRING, clientRequestId: STRING, durationMs: DOUBLE, identityProvider: STRING, operationId: STRING, requestMethod: STRING, requestUri: STRING, responseSizeBytes: BIGINT, responseStatusCode: BIGINT, roles: STRING, scopes: STRING, signInActivityId: STRING, tokenIssuedAt: TIMESTAMP, wids: STRING, requestId: STRING, appOwnerTenantId: STRING, servicePrincipalCredentialThumbprint: STRING, mfaDetail: STRUCT<authDetail: STRING, authMethod: STRING>>
resourceId	STRING
resultDescription	STRING
resultSignature	STRING
resultType	STRING
tenantId	STRING

Colonne	Type de données
Level	STRING
callerIpAddress	STRING
category	STRING
correlationId	STRING
durationMs	DOUBLE
identity	STRING
location	STRING
locationDetails	VARIANT
networkLocationDetails	VARIANT
operationName	STRING
operationVersion	STRING
time	TIMESTAMP
properties	STRUCT<aadTenantId: STRING, activityDateTime: TIMESTAMP, activityDisplayName: STRING, additionalDetails: ARRAY<STRUCT<key: STRING, value: STRING>>, alternateSignInName: STRING, appDisplayName: STRING, appliedConditionalAccessPolicies: VARIANT, appliedEventListeners: VARIANT, appId: STRING, appServicePrincipalId: STRING, authenticationAppDeviceDetails: VARIANT, authenticationStrengths: VARIANT, authenticationAppPolicyEvaluationDetails: VARIANT, authenticationContextClassReferences: VARIANT, authenticationDetails: VARIANT, authenticationMethodsUsed: VARIANT, authenticationProcessingDetails: VARIANT, authenticationProtocol: STRING, authenticationRequirement: STRING, authenticationRequirementPolicies: VARIANT, autonomousSystemNumber: STRING, _billedSize: DOUBLE, category: STRING, clientAppUsed: STRING, clientCredentialType: STRING, conditionalAccessAudiences: VARIANT, conditionalAccessPolicies: VARIANT, conditionalAccessStatus: STRING, correlationId: STRING, createdDateTime: TIMESTAMP, crossTenantAccessType: STRING, deviceDetail: VARIANT, federatedCredentialId: STRING, flaggedForReview: BOOLEAN, globalSecureAccessIpAddress: STRING, homeTenantId: STRING, homeTenantName: STRING, id: STRING, incomingTokenType: STRING, ipAddress: STRING, ipAddressFromResourceProvider: STRING, _isBillable: STRING, isDeleted: BOOLEAN, initiatedBy: STRUCT<app: STRUCT<displayName: STRING, servicePrincipalId: STRING, appId: STRING>, user: STRUCT<id: STRING, displayName: STRING, userPrincipalName: STRING, ipAddress: STRING, roles: VARIANT>>, isProcessing: BOOLEAN, loggedByService: STRING, location: VARIANT, networkLocationDetails: VARIANT, operationType: STRING, result: STRING, resultReason: STRING, isInteractive: BOOLEAN, isRisky: BOOLEAN, isTenantRestricted: BOOLEAN, isThroughGlobalSecureAccess: BOOLEAN, originalRequestId: STRING, originalTransferMethod: STRING, privateLinkDetails: VARIANT, processingTimeInMilliseconds: BIGINT, resource: STRING, resourceDisplayName: STRING, resourceGroup: STRING, resourceId: STRING, resourceIdentity: STRING, resourceProvider: STRING, resourceOwnerTenantId: STRING, resourceServicePrincipalId: STRING, resourceTenantId: STRING, riskEventTypes: VARIANT, riskEventTypes_v2: VARIANT, riskLastUpdatedDateTime: TIMESTAMP, riskDetail: STRING, riskLevel: STRING, riskLevelAggregated: STRING, riskLevelDuringSignIn: STRING, riskState: STRING, rngcStatus: STRING, servicePrincipalId: STRING, servicePrincipalCredentialKeyId: STRING, servicePrincipalName: STRING, sessionId: STRING, sessionLifetimePolicies: VARIANT, signInIdentifier: STRING, signInIdentifierType: STRING, signInTokenProtectionStatus: STRING, sourceSystem: VARIANT, ssoExtensionVersion: STRING, status: VARIANT, targetResources: ARRAY<STRUCT<displayName: STRING, id: STRING, modifiedProperties: ARRAY<STRUCT<oldValue: STRING, displayName: STRING, newValue: STRING>>, type: STRING, administrativeUnits: VARIANT, groupType: STRING, userPrincipalName: STRING>>, tenantId: STRING, timeGenerated: TIMESTAMP, tokenIssuerName: STRING, tokenIssuerType: STRING, tokenProtectionStatusDetails: VARIANT, type: STRING, uniqueTokenIdentifier: STRING, userAgent: STRING, userDisplayName: STRING, userId: STRING, userPrincipalName: STRING, userType: STRING, activity: STRING, additionalInfo: STRING, detectedDateTime: TIMESTAMP, detectionTimingType: STRING, lastUpdatedDateTime: TIMESTAMP, mitreTechniqueId: STRING, riskEventType: STRING, riskType: STRING, source: STRING, identity: STRING, operationName: STRING, resultDescription: STRING, resultType: STRING, C_DeviceId: STRING, C_Sid: STRING, C_Iat: STRING, C_Idtyp: STRING, UserPrincipalObjectID: STRING, __UDI_RequiredFields_EventTime: TIMESTAMP, __UDI_RequiredFields_RegionScope: STRING, __UDI_RequiredFields_TenantId: STRING, __UDI_RequiredFields_UniqueId: STRING, apiVersion: STRING, atContentH: STRING, atContentP: STRING, clientAuthMethod: STRING, clientRequestId: STRING, durationMs: DOUBLE, identityProvider: STRING, operationId: STRING, requestMethod: STRING, requestUri: STRING, responseSizeBytes: BIGINT, responseStatusCode: BIGINT, roles: STRING, scopes: STRING, signInActivityId: STRING, tokenIssuedAt: TIMESTAMP, wids: STRING, requestId: STRING, appOwnerTenantId: STRING, servicePrincipalCredentialThumbprint: STRING, mfaDetail: STRUCT<authDetail: STRING, authMethod: STRING>>
resourceId	STRING
resultDescription	STRING
resultSignature	STRING
resultType	STRING
tenantId	STRING

Observables de l’analyseur

L’analyseur extrait les champs suivants dans lw_observables (généré à partir de la définition de l’analyseur) :

Champ	Observable
callerIpAddress	ip
correlationId	trace_id
properties.alternateSignInName	username
properties.ipAddress	ip
properties.ipAddressFromResourceProvider	ip
properties.initiatedBy.user.displayName	username
properties.initiatedBy.user.ipAddress	ip
properties.userDisplayName	username
properties.userPrincipalName	username
properties.userPrincipalName	email
properties.mitreTechniqueId	mitre_attack_technique

Champ	Observable
callerIpAddress	ip
correlationId	trace_id
properties.alternateSignInName	username
properties.ipAddress	ip
properties.ipAddressFromResourceProvider	ip
properties.initiatedBy.user.displayName	username
properties.initiatedBy.user.ipAddress	ip
properties.userDisplayName	username
properties.userPrincipalName	username
properties.userPrincipalName	email
properties.mitreTechniqueId	mitre_attack_technique