Azure Log Analytics
Azure Log Analytics is a cloud-based service that collects and analyzes telemetry data from Azure and sources. Salem can retrieve data from Log Analytics via the KQL language to build Action Conf objects.
Description: In the default case, Salem retrieves data from an Azure Log Analytics resource authenticating with a secret stored in a digital key vault and returning data based on a user-defined query. The user can then process the output using an eval string to build Salem ActionConfs.
Request Workflow:
An HTTP post request is created using the
tenant_id
defined ininput.static_keys
. The request includes aclient_id
, defined in theinput.static_keys
parameter, and the secret housed in the vault resource defined in thecredentials
parameter. The request returns an authentication token.Using the bearer token, an HTTP POST request is made to the Log Analytics resource with the
workspace_id
, defined in theinput.static_keys
parameter. The request includes the input values, defined ininput.input_keys
and populated by the user from the Salem interface.The response is then handled according to the specifications in the
results
parameter, including the expected format of the response and any actions to structure the returned information.
The image below is Salem's default Log Analytics Search webhook action structure. More general information on ActionDefinition parameters and their purpose can be found in the Webhook - ActionDefinition documentation.
See the description below the image for an explanation of how to configure each Action Definition parameter for an Azure Log Analytics webhook action.
By default, the Azure Log Analytics ActionDefinition expects a key vault resource that contains a client secret. This secret is passed as part of the bearer token request. To match this configuration, create a secret value in a key vault resource Salem can access.
tenant_id
: The ID for the Azure environment the resources are deployed within.client_id
: Salem's application registration ID.workspace_id
: The ID of the target Log Analytics resource
The two user inputs included in the default configuration expects a query from the user in KQL format and a time span parameter. The query should identify a table and columns in the Log Analytics resource accessible to Salem.
The example included in the default configuration queries a table called "AADAuthentication" and requests a count of all of the records in the table that match the conditions:
An account field equal to "sample.account@salemcyber.com"
A status field equal to "failed"
The format/structure of requests made by Salem to the target resources (defined in other parameters) is defined in this object.
In the default case, Salem uses OAuth2 to authenticate using a key vault secret and then includes the resulting bearer token as part of the query to Log Analytics. The user input, as described in the preceding section, is also passed as part of the request to Log Analytics.
The expected response from an Azure Log Analytics POST request is data in a JSON format. Salem then formats the response into a two-column table for each key/value pair.
Last updated