Collect Azure DevOps audit logs

Overview

This parser handles Azure DevOps audit logs in JSON format. It extracts fields from nested and top-level JSON structures, mapping them to the UDM. Conditional logic based on specific field values categorizes events and enriches the output with relevant security information. The parser also handles non-JSON formatted messages by attempting to extract a JSON payload using grok patterns.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• An active Azure DevOps Organization
• Privileged access to Azure Devops Organization and Azure

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New Feed
• Content Hub > Content Packs > Get Started

How to set up the Azure DevOps audit feed

1. Click the Azure Platform pack.
2. Locate the Azure DevOps audit log type and click Add new feed.

3. Specify values for the following fields:

   • Source Type: Microsoft Azure Blob Storage V2.
   • Azure URI: The blob endpoint URL.
     • ENDPOINT_URL/BLOB_NAME
       • Replace the following:
         • ENDPOINT_URL: The blob endpoint URL (https://<storageaccountname>.blob.core.windows.net)
         • BLOB_NAME: The name of the blob (such as, insights-logs-<logname>)

   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Maximum File Age: Includes files modified in the last number of days. Default is 180 days.

   • Shared key: The shared key (a 512-bit random string in base-64 encoding) used to access Azure resources.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset namespace: The asset namespace.
   • Ingestion labels: The label applied to the events from this feed.

4. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

Create an API key for the webhook feed

1. Go to Google Cloud console > Credentials.

   Go to Credentials

2. Click Create credentials, and then select API key.

3. Restrict the API key access to the Google Security Operations API.

Specify the endpoint URL

1. In your client application, specify the HTTPS endpoint URL provided in the webhook feed.

2. Enable authentication by specifying the API key and secret key as part of the custom header in the following format:

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   Recommendation: Specify the API key as a header instead of specifying it in the URL. If your webhook client doesn't support custom headers, you can specify the API key and secret key using query parameters in the following format:

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

Replace the following:

• ENDPOINT_URL: The feed endpoint URL.
• API_KEY: The API key to authenticate to Google Security Operations.
• SECRET: The secret key that you generated to authenticate the feed.

Configure Auditing feature in Azure Devops

1. Sign in to your organization (https://dev.azure.com/{yourorganization}).
2. Select the gear icon for Organization settings.
3. Select Policies under Security.
4. Toggle the Log Audit Events button to ON.

Configure an Event Grid Topic in Azure

1. Sign in to the Azure Portal.
2. Search for and access Event Grid.
3. Locate Topics under Custom events.
4. Click + Create.
5. Select your Subscription and Resource Group. Provide a name (for example, DevopsAuditLog) and select the region. Click Review and create.
6. Access the new Topic and copy the Topic Endpoint URL.
7. Go to Settings > Access Keys and copy Key 1.

Configure Azure Devops Log Stream to Event Grid

1. Sign in to your organization (https://dev.azure.com/{yourorganization}).
2. Select the gear icon for Organization settings.
3. Select Auditing.
4. Go to the Streams tab and select New stream > Event Grid.
5. Enter the topic endpoint and access key created in Configure an Event Grid Topic in Azure.

Configure a Webhook in Azure DevOps for Google SecOps

1. In the Azure Portal, search for and access Event Grid.
2. Select previously created Topic.
3. Go to Entities > Event Subscription.
4. Click + Event Subscription.
5. Provide a descriptive name (for example, *Google SecOps Integration).
6. Select Web Hook and click Configure an endpoint.
7. Configure the endpoint:
   1. Subscriber endpoint: Enter the Google SecOps API endpoint URL.
   2. In the HTTP headers section, add the following headers:
      • Header 1:
        • Key: X-goog-api-key
        • Value: The API key you created in the Create an API key for the webhook feed section.
      • Header 2:
        • Key: X-Webhook-Access-Key
        • Value: The secret key you generated in the Configure a feed in Google SecOps to ingest the Azure Devops logs section.
   3. Set the Content-Type header to application/json.
8. Click Create.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.