Azure監査ログ

備考

プレビュー

Lakewatchは プライベート プレビュー段階です。アクセスをリクエストするには、Databricksアカウントチームにお問い合わせください。

概要

Azure監査Logs は、Microsoft Entra ID (旧称 Azure Active Directory) からユーザー、グループ、アプリケーションへの変更などのディレクトリ アクティビティをキャプチャします。Lakewatchは、Auto Loaderを使用してクラウドストレージからAzure監査Logを取り込み、組み込みの azure_audit パーサーを使用してデータをスキーマ化します。これはクラウドストレージソースであり、APIコネクタではありません。

Azure監査Logsのオンボード

Azure監査ログを取り込むには、そのクラウドストレージデータソースを作成し、組み込みの azure_audit パーサーをアタッチして、イベントがスキーマ化された解析済みテーブルに書き込まれるようにします。前提条件、Unity Catalogのアクセス、および完全なデータソースのセットアップステップについては、クラウドストレージを参照してください。

解析されたスキーマと観測対象

組み込みのazure_auditパーサーは、Azure監査ログをパース済みテーブルにスケマタイズします。すべてのパース済みテーブルには、Lakewatch管理列もあります：

• lw_id: Lakewatchが主キーとして使用する非null文字列。増分読み取り全体の重複排除をサポートします。
• time: パーサーによって割り当てられたNULL以外のイベントTimestamp。
• lw_meta：標準的なLakewatch処理メタデータ。
• lw_observables: パーサーでセキュリティ観測可能としてマークされたフィールドから抽出された値。

情報については、 パーサー リファレンスを参照してください。

解析されたテーブルスキーマ

azure_auditパーサーは、次の列を書き込みます（パーサー定義から生成）：

列	データ型
Level	STRING
callerIpAddress	STRING
category	STRING
correlationId	STRING
durationMs	DOUBLE
identity	STRING
location	STRING
locationDetails	VARIANT
networkLocationDetails	VARIANT
operationName	STRING
operationVersion	STRING
time	TIMESTAMP
properties	STRUCT<aadTenantId: STRING, activityDateTime: TIMESTAMP, activityDisplayName: STRING, additionalDetails: ARRAY<STRUCT<key: STRING, value: STRING>>, alternateSignInName: STRING, appDisplayName: STRING, appliedConditionalAccessPolicies: VARIANT, appliedEventListeners: VARIANT, appId: STRING, appServicePrincipalId: STRING, authenticationAppDeviceDetails: VARIANT, authenticationStrengths: VARIANT, authenticationAppPolicyEvaluationDetails: VARIANT, authenticationContextClassReferences: VARIANT, authenticationDetails: VARIANT, authenticationMethodsUsed: VARIANT, authenticationProcessingDetails: VARIANT, authenticationProtocol: STRING, authenticationRequirement: STRING, authenticationRequirementPolicies: VARIANT, autonomousSystemNumber: STRING, _billedSize: DOUBLE, category: STRING, clientAppUsed: STRING, clientCredentialType: STRING, conditionalAccessAudiences: VARIANT, conditionalAccessPolicies: VARIANT, conditionalAccessStatus: STRING, correlationId: STRING, createdDateTime: TIMESTAMP, crossTenantAccessType: STRING, deviceDetail: VARIANT, federatedCredentialId: STRING, flaggedForReview: BOOLEAN, globalSecureAccessIpAddress: STRING, homeTenantId: STRING, homeTenantName: STRING, id: STRING, incomingTokenType: STRING, ipAddress: STRING, ipAddressFromResourceProvider: STRING, _isBillable: STRING, isDeleted: BOOLEAN, initiatedBy: STRUCT<app: STRUCT<displayName: STRING, servicePrincipalId: STRING, appId: STRING>, user: STRUCT<id: STRING, displayName: STRING, userPrincipalName: STRING, ipAddress: STRING, roles: VARIANT>>, isProcessing: BOOLEAN, loggedByService: STRING, location: VARIANT, networkLocationDetails: VARIANT, operationType: STRING, result: STRING, resultReason: STRING, isInteractive: BOOLEAN, isRisky: BOOLEAN, isTenantRestricted: BOOLEAN, isThroughGlobalSecureAccess: BOOLEAN, originalRequestId: STRING, originalTransferMethod: STRING, privateLinkDetails: VARIANT, processingTimeInMilliseconds: BIGINT, resource: STRING, resourceDisplayName: STRING, resourceGroup: STRING, resourceId: STRING, resourceIdentity: STRING, resourceProvider: STRING, resourceOwnerTenantId: STRING, resourceServicePrincipalId: STRING, resourceTenantId: STRING, riskEventTypes: VARIANT, riskEventTypes_v2: VARIANT, riskLastUpdatedDateTime: TIMESTAMP, riskDetail: STRING, riskLevel: STRING, riskLevelAggregated: STRING, riskLevelDuringSignIn: STRING, riskState: STRING, rngcStatus: STRING, servicePrincipalId: STRING, servicePrincipalCredentialKeyId: STRING, servicePrincipalName: STRING, sessionId: STRING, sessionLifetimePolicies: VARIANT, signInIdentifier: STRING, signInIdentifierType: STRING, signInTokenProtectionStatus: STRING, sourceSystem: VARIANT, ssoExtensionVersion: STRING, status: VARIANT, targetResources: ARRAY<STRUCT<displayName: STRING, id: STRING, modifiedProperties: ARRAY<STRUCT<oldValue: STRING, displayName: STRING, newValue: STRING>>, type: STRING, administrativeUnits: VARIANT, groupType: STRING, userPrincipalName: STRING>>, tenantId: STRING, timeGenerated: TIMESTAMP, tokenIssuerName: STRING, tokenIssuerType: STRING, tokenProtectionStatusDetails: VARIANT, type: STRING, uniqueTokenIdentifier: STRING, userAgent: STRING, userDisplayName: STRING, userId: STRING, userPrincipalName: STRING, userType: STRING, activity: STRING, additionalInfo: STRING, detectedDateTime: TIMESTAMP, detectionTimingType: STRING, lastUpdatedDateTime: TIMESTAMP, mitreTechniqueId: STRING, riskEventType: STRING, riskType: STRING, source: STRING, identity: STRING, operationName: STRING, resultDescription: STRING, resultType: STRING, C_DeviceId: STRING, C_Sid: STRING, C_Iat: STRING, C_Idtyp: STRING, UserPrincipalObjectID: STRING, __UDI_RequiredFields_EventTime: TIMESTAMP, __UDI_RequiredFields_RegionScope: STRING, __UDI_RequiredFields_TenantId: STRING, __UDI_RequiredFields_UniqueId: STRING, apiVersion: STRING, atContentH: STRING, atContentP: STRING, clientAuthMethod: STRING, clientRequestId: STRING, durationMs: DOUBLE, identityProvider: STRING, operationId: STRING, requestMethod: STRING, requestUri: STRING, responseSizeBytes: BIGINT, responseStatusCode: BIGINT, roles: STRING, scopes: STRING, signInActivityId: STRING, tokenIssuedAt: TIMESTAMP, wids: STRING, requestId: STRING, appOwnerTenantId: STRING, servicePrincipalCredentialThumbprint: STRING, mfaDetail: STRUCT<authDetail: STRING, authMethod: STRING>>
resourceId	STRING
resultDescription	STRING
resultSignature	STRING
resultType	STRING
tenantId	STRING

列	データ型
Level	STRING
callerIpAddress	STRING
category	STRING
correlationId	STRING
durationMs	DOUBLE
identity	STRING
location	STRING
locationDetails	VARIANT
networkLocationDetails	VARIANT
operationName	STRING
operationVersion	STRING
time	TIMESTAMP
properties	STRUCT<aadTenantId: STRING, activityDateTime: TIMESTAMP, activityDisplayName: STRING, additionalDetails: ARRAY<STRUCT<key: STRING, value: STRING>>, alternateSignInName: STRING, appDisplayName: STRING, appliedConditionalAccessPolicies: VARIANT, appliedEventListeners: VARIANT, appId: STRING, appServicePrincipalId: STRING, authenticationAppDeviceDetails: VARIANT, authenticationStrengths: VARIANT, authenticationAppPolicyEvaluationDetails: VARIANT, authenticationContextClassReferences: VARIANT, authenticationDetails: VARIANT, authenticationMethodsUsed: VARIANT, authenticationProcessingDetails: VARIANT, authenticationProtocol: STRING, authenticationRequirement: STRING, authenticationRequirementPolicies: VARIANT, autonomousSystemNumber: STRING, _billedSize: DOUBLE, category: STRING, clientAppUsed: STRING, clientCredentialType: STRING, conditionalAccessAudiences: VARIANT, conditionalAccessPolicies: VARIANT, conditionalAccessStatus: STRING, correlationId: STRING, createdDateTime: TIMESTAMP, crossTenantAccessType: STRING, deviceDetail: VARIANT, federatedCredentialId: STRING, flaggedForReview: BOOLEAN, globalSecureAccessIpAddress: STRING, homeTenantId: STRING, homeTenantName: STRING, id: STRING, incomingTokenType: STRING, ipAddress: STRING, ipAddressFromResourceProvider: STRING, _isBillable: STRING, isDeleted: BOOLEAN, initiatedBy: STRUCT<app: STRUCT<displayName: STRING, servicePrincipalId: STRING, appId: STRING>, user: STRUCT<id: STRING, displayName: STRING, userPrincipalName: STRING, ipAddress: STRING, roles: VARIANT>>, isProcessing: BOOLEAN, loggedByService: STRING, location: VARIANT, networkLocationDetails: VARIANT, operationType: STRING, result: STRING, resultReason: STRING, isInteractive: BOOLEAN, isRisky: BOOLEAN, isTenantRestricted: BOOLEAN, isThroughGlobalSecureAccess: BOOLEAN, originalRequestId: STRING, originalTransferMethod: STRING, privateLinkDetails: VARIANT, processingTimeInMilliseconds: BIGINT, resource: STRING, resourceDisplayName: STRING, resourceGroup: STRING, resourceId: STRING, resourceIdentity: STRING, resourceProvider: STRING, resourceOwnerTenantId: STRING, resourceServicePrincipalId: STRING, resourceTenantId: STRING, riskEventTypes: VARIANT, riskEventTypes_v2: VARIANT, riskLastUpdatedDateTime: TIMESTAMP, riskDetail: STRING, riskLevel: STRING, riskLevelAggregated: STRING, riskLevelDuringSignIn: STRING, riskState: STRING, rngcStatus: STRING, servicePrincipalId: STRING, servicePrincipalCredentialKeyId: STRING, servicePrincipalName: STRING, sessionId: STRING, sessionLifetimePolicies: VARIANT, signInIdentifier: STRING, signInIdentifierType: STRING, signInTokenProtectionStatus: STRING, sourceSystem: VARIANT, ssoExtensionVersion: STRING, status: VARIANT, targetResources: ARRAY<STRUCT<displayName: STRING, id: STRING, modifiedProperties: ARRAY<STRUCT<oldValue: STRING, displayName: STRING, newValue: STRING>>, type: STRING, administrativeUnits: VARIANT, groupType: STRING, userPrincipalName: STRING>>, tenantId: STRING, timeGenerated: TIMESTAMP, tokenIssuerName: STRING, tokenIssuerType: STRING, tokenProtectionStatusDetails: VARIANT, type: STRING, uniqueTokenIdentifier: STRING, userAgent: STRING, userDisplayName: STRING, userId: STRING, userPrincipalName: STRING, userType: STRING, activity: STRING, additionalInfo: STRING, detectedDateTime: TIMESTAMP, detectionTimingType: STRING, lastUpdatedDateTime: TIMESTAMP, mitreTechniqueId: STRING, riskEventType: STRING, riskType: STRING, source: STRING, identity: STRING, operationName: STRING, resultDescription: STRING, resultType: STRING, C_DeviceId: STRING, C_Sid: STRING, C_Iat: STRING, C_Idtyp: STRING, UserPrincipalObjectID: STRING, __UDI_RequiredFields_EventTime: TIMESTAMP, __UDI_RequiredFields_RegionScope: STRING, __UDI_RequiredFields_TenantId: STRING, __UDI_RequiredFields_UniqueId: STRING, apiVersion: STRING, atContentH: STRING, atContentP: STRING, clientAuthMethod: STRING, clientRequestId: STRING, durationMs: DOUBLE, identityProvider: STRING, operationId: STRING, requestMethod: STRING, requestUri: STRING, responseSizeBytes: BIGINT, responseStatusCode: BIGINT, roles: STRING, scopes: STRING, signInActivityId: STRING, tokenIssuedAt: TIMESTAMP, wids: STRING, requestId: STRING, appOwnerTenantId: STRING, servicePrincipalCredentialThumbprint: STRING, mfaDetail: STRUCT<authDetail: STRING, authMethod: STRING>>
resourceId	STRING
resultDescription	STRING
resultSignature	STRING
resultType	STRING
tenantId	STRING

パーサーのオブザーバブル

パーサーは、以下のフィールドをlw_observablesに抽出します（パーサー定義から生成）。

フィールド	可観測項目
callerIpAddress	ip
correlationId	trace_id
properties.alternateSignInName	username
properties.ipAddress	ip
properties.ipAddressFromResourceProvider	ip
properties.initiatedBy.user.displayName	username
properties.initiatedBy.user.ipAddress	ip
properties.userDisplayName	username
properties.userPrincipalName	username
properties.userPrincipalName	email
properties.mitreTechniqueId	mitre_attack_technique

フィールド	可観測項目
callerIpAddress	ip
correlationId	trace_id
properties.alternateSignInName	username
properties.ipAddress	ip
properties.ipAddressFromResourceProvider	ip
properties.initiatedBy.user.displayName	username
properties.initiatedBy.user.ipAddress	ip
properties.userDisplayName	username
properties.userPrincipalName	username
properties.userPrincipalName	email
properties.mitreTechniqueId	mitre_attack_technique