Logs de auditoria do Azure

info

Visualização

Lakewatch está em Prévia privada. Para solicitar acesso, entre em contato com a equipe da sua account Databricks.

Visão geral

Os logs de auditoria do Azure capturam a atividade do diretório do Microsoft Entra ID (antigo Azure Active Directory), como alterações em usuários, grupos e aplicativos. O Lakewatch ingere logs de auditoria do Azure do armazenamento em cloud usando o Auto Loader e esquematiza os dados com o analisador azure_audit integrado. Esta é uma fonte de armazenamento em cloud, não um conector de API.

Integrar logs de auditoria do Azure

Para ingerir Logs de auditoria do Azure, crie uma fonte de dados de armazenamento na cloud para ela e anexe o analisador azure_audit integrado para que os eventos sejam gravados em uma tabela analisada esquematizada. Para pré-requisitos, acesso ao Unity Catalog e os passos completos de configuração da fonte de dados, consulte Armazenamento na cloud.

Esquema analisado e observáveis

O analisador azure_audit integrado esquematiza os logs de auditoria do Azure em uma tabela analisada. Cada tabela analisada também carrega as colunas gerenciadas pelo Lakewatch:

• lw_id: Uma strings não nula que o Lakewatch usa como chave primária key, permitindo a desduplicação em leituras incrementais.
• time: Um Timestamp de evento não nulo atribuído pelo analisador.
• lw_meta: Metadados de processamento padrão do Lakewatch.
• lw_observables: Valores extraídos de campos marcados como observáveis de segurança no analisador.

Para obter mais informações, consulte a referência do parser.

Esquema de tabela analisado

O analisador azure_audit escreve as seguintes colunas (geradas a partir da definição do analisador):

Coluna	Tipo de dados
Level	STRING
callerIpAddress	STRING
category	STRING
correlationId	STRING
durationMs	DOUBLE
identity	STRING
location	STRING
locationDetails	VARIANT
networkLocationDetails	VARIANT
operationName	STRING
operationVersion	STRING
time	TIMESTAMP
properties	STRUCT<aadTenantId: STRING, activityDateTime: TIMESTAMP, activityDisplayName: STRING, additionalDetails: ARRAY<STRUCT<key: STRING, value: STRING>>, alternateSignInName: STRING, appDisplayName: STRING, appliedConditionalAccessPolicies: VARIANT, appliedEventListeners: VARIANT, appId: STRING, appServicePrincipalId: STRING, authenticationAppDeviceDetails: VARIANT, authenticationStrengths: VARIANT, authenticationAppPolicyEvaluationDetails: VARIANT, authenticationContextClassReferences: VARIANT, authenticationDetails: VARIANT, authenticationMethodsUsed: VARIANT, authenticationProcessingDetails: VARIANT, authenticationProtocol: STRING, authenticationRequirement: STRING, authenticationRequirementPolicies: VARIANT, autonomousSystemNumber: STRING, _billedSize: DOUBLE, category: STRING, clientAppUsed: STRING, clientCredentialType: STRING, conditionalAccessAudiences: VARIANT, conditionalAccessPolicies: VARIANT, conditionalAccessStatus: STRING, correlationId: STRING, createdDateTime: TIMESTAMP, crossTenantAccessType: STRING, deviceDetail: VARIANT, federatedCredentialId: STRING, flaggedForReview: BOOLEAN, globalSecureAccessIpAddress: STRING, homeTenantId: STRING, homeTenantName: STRING, id: STRING, incomingTokenType: STRING, ipAddress: STRING, ipAddressFromResourceProvider: STRING, _isBillable: STRING, isDeleted: BOOLEAN, initiatedBy: STRUCT<app: STRUCT<displayName: STRING, servicePrincipalId: STRING, appId: STRING>, user: STRUCT<id: STRING, displayName: STRING, userPrincipalName: STRING, ipAddress: STRING, roles: VARIANT>>, isProcessing: BOOLEAN, loggedByService: STRING, location: VARIANT, networkLocationDetails: VARIANT, operationType: STRING, result: STRING, resultReason: STRING, isInteractive: BOOLEAN, isRisky: BOOLEAN, isTenantRestricted: BOOLEAN, isThroughGlobalSecureAccess: BOOLEAN, originalRequestId: STRING, originalTransferMethod: STRING, privateLinkDetails: VARIANT, processingTimeInMilliseconds: BIGINT, resource: STRING, resourceDisplayName: STRING, resourceGroup: STRING, resourceId: STRING, resourceIdentity: STRING, resourceProvider: STRING, resourceOwnerTenantId: STRING, resourceServicePrincipalId: STRING, resourceTenantId: STRING, riskEventTypes: VARIANT, riskEventTypes_v2: VARIANT, riskLastUpdatedDateTime: TIMESTAMP, riskDetail: STRING, riskLevel: STRING, riskLevelAggregated: STRING, riskLevelDuringSignIn: STRING, riskState: STRING, rngcStatus: STRING, servicePrincipalId: STRING, servicePrincipalCredentialKeyId: STRING, servicePrincipalName: STRING, sessionId: STRING, sessionLifetimePolicies: VARIANT, signInIdentifier: STRING, signInIdentifierType: STRING, signInTokenProtectionStatus: STRING, sourceSystem: VARIANT, ssoExtensionVersion: STRING, status: VARIANT, targetResources: ARRAY<STRUCT<displayName: STRING, id: STRING, modifiedProperties: ARRAY<STRUCT<oldValue: STRING, displayName: STRING, newValue: STRING>>, type: STRING, administrativeUnits: VARIANT, groupType: STRING, userPrincipalName: STRING>>, tenantId: STRING, timeGenerated: TIMESTAMP, tokenIssuerName: STRING, tokenIssuerType: STRING, tokenProtectionStatusDetails: VARIANT, type: STRING, uniqueTokenIdentifier: STRING, userAgent: STRING, userDisplayName: STRING, userId: STRING, userPrincipalName: STRING, userType: STRING, activity: STRING, additionalInfo: STRING, detectedDateTime: TIMESTAMP, detectionTimingType: STRING, lastUpdatedDateTime: TIMESTAMP, mitreTechniqueId: STRING, riskEventType: STRING, riskType: STRING, source: STRING, identity: STRING, operationName: STRING, resultDescription: STRING, resultType: STRING, C_DeviceId: STRING, C_Sid: STRING, C_Iat: STRING, C_Idtyp: STRING, UserPrincipalObjectID: STRING, __UDI_RequiredFields_EventTime: TIMESTAMP, __UDI_RequiredFields_RegionScope: STRING, __UDI_RequiredFields_TenantId: STRING, __UDI_RequiredFields_UniqueId: STRING, apiVersion: STRING, atContentH: STRING, atContentP: STRING, clientAuthMethod: STRING, clientRequestId: STRING, durationMs: DOUBLE, identityProvider: STRING, operationId: STRING, requestMethod: STRING, requestUri: STRING, responseSizeBytes: BIGINT, responseStatusCode: BIGINT, roles: STRING, scopes: STRING, signInActivityId: STRING, tokenIssuedAt: TIMESTAMP, wids: STRING, requestId: STRING, appOwnerTenantId: STRING, servicePrincipalCredentialThumbprint: STRING, mfaDetail: STRUCT<authDetail: STRING, authMethod: STRING>>
resourceId	STRING
resultDescription	STRING
resultSignature	STRING
resultType	STRING
tenantId	STRING

Coluna	Tipo de dados
Level	STRING
callerIpAddress	STRING
category	STRING
correlationId	STRING
durationMs	DOUBLE
identity	STRING
location	STRING
locationDetails	VARIANT
networkLocationDetails	VARIANT
operationName	STRING
operationVersion	STRING
time	TIMESTAMP
properties	STRUCT<aadTenantId: STRING, activityDateTime: TIMESTAMP, activityDisplayName: STRING, additionalDetails: ARRAY<STRUCT<key: STRING, value: STRING>>, alternateSignInName: STRING, appDisplayName: STRING, appliedConditionalAccessPolicies: VARIANT, appliedEventListeners: VARIANT, appId: STRING, appServicePrincipalId: STRING, authenticationAppDeviceDetails: VARIANT, authenticationStrengths: VARIANT, authenticationAppPolicyEvaluationDetails: VARIANT, authenticationContextClassReferences: VARIANT, authenticationDetails: VARIANT, authenticationMethodsUsed: VARIANT, authenticationProcessingDetails: VARIANT, authenticationProtocol: STRING, authenticationRequirement: STRING, authenticationRequirementPolicies: VARIANT, autonomousSystemNumber: STRING, _billedSize: DOUBLE, category: STRING, clientAppUsed: STRING, clientCredentialType: STRING, conditionalAccessAudiences: VARIANT, conditionalAccessPolicies: VARIANT, conditionalAccessStatus: STRING, correlationId: STRING, createdDateTime: TIMESTAMP, crossTenantAccessType: STRING, deviceDetail: VARIANT, federatedCredentialId: STRING, flaggedForReview: BOOLEAN, globalSecureAccessIpAddress: STRING, homeTenantId: STRING, homeTenantName: STRING, id: STRING, incomingTokenType: STRING, ipAddress: STRING, ipAddressFromResourceProvider: STRING, _isBillable: STRING, isDeleted: BOOLEAN, initiatedBy: STRUCT<app: STRUCT<displayName: STRING, servicePrincipalId: STRING, appId: STRING>, user: STRUCT<id: STRING, displayName: STRING, userPrincipalName: STRING, ipAddress: STRING, roles: VARIANT>>, isProcessing: BOOLEAN, loggedByService: STRING, location: VARIANT, networkLocationDetails: VARIANT, operationType: STRING, result: STRING, resultReason: STRING, isInteractive: BOOLEAN, isRisky: BOOLEAN, isTenantRestricted: BOOLEAN, isThroughGlobalSecureAccess: BOOLEAN, originalRequestId: STRING, originalTransferMethod: STRING, privateLinkDetails: VARIANT, processingTimeInMilliseconds: BIGINT, resource: STRING, resourceDisplayName: STRING, resourceGroup: STRING, resourceId: STRING, resourceIdentity: STRING, resourceProvider: STRING, resourceOwnerTenantId: STRING, resourceServicePrincipalId: STRING, resourceTenantId: STRING, riskEventTypes: VARIANT, riskEventTypes_v2: VARIANT, riskLastUpdatedDateTime: TIMESTAMP, riskDetail: STRING, riskLevel: STRING, riskLevelAggregated: STRING, riskLevelDuringSignIn: STRING, riskState: STRING, rngcStatus: STRING, servicePrincipalId: STRING, servicePrincipalCredentialKeyId: STRING, servicePrincipalName: STRING, sessionId: STRING, sessionLifetimePolicies: VARIANT, signInIdentifier: STRING, signInIdentifierType: STRING, signInTokenProtectionStatus: STRING, sourceSystem: VARIANT, ssoExtensionVersion: STRING, status: VARIANT, targetResources: ARRAY<STRUCT<displayName: STRING, id: STRING, modifiedProperties: ARRAY<STRUCT<oldValue: STRING, displayName: STRING, newValue: STRING>>, type: STRING, administrativeUnits: VARIANT, groupType: STRING, userPrincipalName: STRING>>, tenantId: STRING, timeGenerated: TIMESTAMP, tokenIssuerName: STRING, tokenIssuerType: STRING, tokenProtectionStatusDetails: VARIANT, type: STRING, uniqueTokenIdentifier: STRING, userAgent: STRING, userDisplayName: STRING, userId: STRING, userPrincipalName: STRING, userType: STRING, activity: STRING, additionalInfo: STRING, detectedDateTime: TIMESTAMP, detectionTimingType: STRING, lastUpdatedDateTime: TIMESTAMP, mitreTechniqueId: STRING, riskEventType: STRING, riskType: STRING, source: STRING, identity: STRING, operationName: STRING, resultDescription: STRING, resultType: STRING, C_DeviceId: STRING, C_Sid: STRING, C_Iat: STRING, C_Idtyp: STRING, UserPrincipalObjectID: STRING, __UDI_RequiredFields_EventTime: TIMESTAMP, __UDI_RequiredFields_RegionScope: STRING, __UDI_RequiredFields_TenantId: STRING, __UDI_RequiredFields_UniqueId: STRING, apiVersion: STRING, atContentH: STRING, atContentP: STRING, clientAuthMethod: STRING, clientRequestId: STRING, durationMs: DOUBLE, identityProvider: STRING, operationId: STRING, requestMethod: STRING, requestUri: STRING, responseSizeBytes: BIGINT, responseStatusCode: BIGINT, roles: STRING, scopes: STRING, signInActivityId: STRING, tokenIssuedAt: TIMESTAMP, wids: STRING, requestId: STRING, appOwnerTenantId: STRING, servicePrincipalCredentialThumbprint: STRING, mfaDetail: STRUCT<authDetail: STRING, authMethod: STRING>>
resourceId	STRING
resultDescription	STRING
resultSignature	STRING
resultType	STRING
tenantId	STRING

Observáveis do analisador

O analisador extrai os seguintes campos em lw_observables (gerados a partir da definição do analisador):

campo	Observável
callerIpAddress	ip
correlationId	trace_id
properties.alternateSignInName	username
properties.ipAddress	ip
properties.ipAddressFromResourceProvider	ip
properties.initiatedBy.user.displayName	username
properties.initiatedBy.user.ipAddress	ip
properties.userDisplayName	username
properties.userPrincipalName	username
properties.userPrincipalName	email
properties.mitreTechniqueId	mitre_attack_technique

campo	Observável
callerIpAddress	ip
correlationId	trace_id
properties.alternateSignInName	username
properties.ipAddress	ip
properties.ipAddressFromResourceProvider	ip
properties.initiatedBy.user.displayName	username
properties.initiatedBy.user.ipAddress	ip
properties.userDisplayName	username
properties.userPrincipalName	username
properties.userPrincipalName	email
properties.mitreTechniqueId	mitre_attack_technique