Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser dengan label penyerapan
AZURE_KEYVAULT_AUDI.
Sebelum memulai
Pastikan Anda memenuhi prasyarat berikut:
Langganan Azure yang dapat Anda gunakan untuk login
Lingkungan (tenant) Azure Key Vault di Azure
Peran administrator global atau administrator Azure Key Vault
Akun penyimpanan Azure untuk menyimpan log
Mengonfigurasi akun penyimpanan
Login ke portal Azure.
Di konsol Azure, cari Storage accounts.
Pilih akun penyimpanan tempat log harus diambil, lalu pilih Kunci akses. Untuk membuat akun penyimpanan baru, lakukan langkah berikut:
Klik Buat.
Masukkan nama untuk akun penyimpanan baru.
Pilih langganan, grup resource, region, performa, dan redundansi untuk akun. Sebaiknya setel performa ke standard, dan redundansi ke GRS atau LRS.
Klik Review + create.
Tinjau ringkasan akun, lalu klik Buat.
Klik Show keys dan catat kunci bersama untuk akun penyimpanan.
Pilih Endpoints dan catat endpoint Blob service.
Untuk mengetahui informasi selengkapnya tentang cara membuat akun penyimpanan, lihat bagian Membuat akun penyimpanan Azure di dokumentasi Microsoft.
Mengonfigurasi logging Azure Key Vault
Di portal Azure, buka Key vaults, lalu pilih key vault yang ingin Anda konfigurasi untuk pencatatan log.
Di bagian Monitoring, pilih Setelan diagnostik.
Pilih Tambahkan setelan diagnostik. Jendela Setelan diagnostik menyediakan setelan untuk log diagnostik.
Di kolom Nama setelan diagnostik, tentukan nama untuk setelan diagnostik.
Di bagian Grup kategori, centang kotak audit.
Di kolom Retensi (hari), tentukan nilai retensi log yang sesuai dengan kebijakan organisasi Anda.
Google SecOps merekomendasikan retensi log minimal satu hari.
Anda dapat menyimpan log Azure Key Vault logging di akun penyimpanan atau mengalirkan log ke Event Hubs. Google SecOps mendukung pengumpulan log menggunakan akun penyimpanan.
Mengarsipkan ke akun penyimpanan
Untuk menyimpan log di akun penyimpanan, di jendela Setelan diagnostik, centang kotak Arsipkan ke akun penyimpanan.
Di daftar Langganan, pilih langganan yang ada.
Di daftar Storage account, pilih akun penyimpanan yang ada.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
Setelan SIEM > Feed > Tambahkan Baru
Hub Konten > Paket Konten > Mulai
Cara menyiapkan feed logging Azure Key Vault
Klik paket Azure Platform.
Cari jenis log Azure Key Vault logging, lalu klik Add new feed.
Tentukan nilai untuk kolom berikut:
Jenis Sumber: Microsoft Azure Blob Storage V2.
URI Azure: tentukan endpoint Blob service yang Anda peroleh sebelumnya bersama dengan salah satu nama container akun penyimpanan tersebut. Misalnya, https://xyz.blob.core.windows.net/abc/.
Usia File Maksimum: Menyertakan file yang diubah dalam beberapa hari terakhir.
Defaultnya adalah 180 hari.
Key: tentukan kunci bersama yang Anda peroleh sebelumnya.
Opsi lanjutan
Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
Namespace Aset: Namespace yang terkait dengan feed.
Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Collect Microsoft Azure Key Vault logging logs\n==============================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the Azure Key Vault logging logs by setting up a Google Security Operations feed.\n\nFor more information, see [Data ingestion to Google SecOps](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser which normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the\n`AZURE_KEYVAULT_AUDI` ingestion label.\n\nBefore you begin\n----------------\n\nEnsure that you have the following prerequisites:\n\n- Azure subscription that you can sign in to\n- Azure Key Vault environment (tenant) in Azure\n- Global administrator or Azure Key Vault administrator role\n- Azure storage account to store the logs\n\nConfigure a storage account\n---------------------------\n\n1. Sign in to the **Azure** portal.\n2. In the **Azure** console, search for **Storage accounts**.\n3. Select the storage account that the logs must be pulled from, and then select **Access key**. To create a new storage account, do the following:\n\n 1. Click **Create.**\n 2. Enter a name for the new storage account.\n 3. Select the subscription, resource group, region, performance, and redundancy for the account. We recommend setting the performance to *standard* , and the redundancy to *GRS* or *LRS*.\n\n 4. Click **Review + create**.\n\n 5. Review the overview of the account and click **Create.**\n\n4. Click **Show keys** and make a note of the shared key for the storage account.\n\n5. Select **Endpoints** and make a note of the **Blob service** endpoint.\n\n For more information about creating a storage account, see the **Create an Azure storage account** section in the [Microsoft documentation](http://learn.microsoft.com/).\n\nConfigure Azure Key Vault logging\n---------------------------------\n\n1. In the **Azure** portal, go to **Key vaults** and select the key vault that you want to configure for logging.\n2. In the **Monitoring** section, select **Diagnostic settings**.\n3. Select **Add diagnostic setting** . The **Diagnostics settings** window provides the settings for the diagnostic logs.\n4. In the **Diagnostic setting name** field, specify the name for diagnostic setting.\n5. In the **Category groups** section, select the **audit** checkbox.\n6. In the **Retention (days)** field, specify a log retention value that complies with your organization's policies.\n Google SecOps recommends a minimum of one day of log retention.\n\n You can store the Azure Key Vault logging logs in a storage account or stream the logs to Event Hubs. Google SecOps supports log collection using a storage account.\n\n### Archive to a storage account\n\n1. To store logs in storage account, in the **Diagnostics settings** window, select the **Archive to a storage account** checkbox.\n2. In the **Subscription** list, select the existing subscription.\n3. In the **Storage account** list, select the existing storage account.\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the Azure key vault logging feed\n----------------------------------------------\n\n1. Click the **Azure Platform** pack.\n2. Locate the **Azure Key Vault logging** log type and click **Add new feed**.\n3. Specify values for the following fields:\n\n - **Source Type** : **Microsoft Azure Blob Storage V2**.\n - **Azure URI** : specify the **Blob service** endpoint that you obtained previously along with one of the container names of that storage account. For example, `https://xyz.blob.core.windows.net/abc/`.\n - **Source deletion option**: specify the source deletion option.\n - **Maximum File Age**: Includes files modified in the last number of days. Default is 180 days.\n - **Key**: specify the shared key that you obtained previously.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace**: Namespace associated with the feed.\n - **Ingestion Labels**: Labels applied to all events from this feed.\n4. Click **Create feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\nFor more information about Google SecOps feeds, see [Google SecOps feeds documentation](/chronicle/docs/administration/feed-management).\n\nFor information about requirements for each feed type, see [Feed configuration by type](/chronicle/docs/reference/feed-management-api#feed_configuration_by_type).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
