Collect Microsoft Azure MDM (Mobile Device Management) Intune logs

This document explains how to ingest Microsoft Intune logs to Google Security Operations using API or Blob Storage. The parser processes the logs, transforming them into a Unified Data Model (UDM). It extracts fields, maps them to UDM attributes, handles various activity types (Create, Delete, Patch, Action), and enriches the data with additional context like device information, user details, and security results. It also performs specific logic for "Reprovision CloudPCModel" operations and handles different identity scenarios.

Before you begin

Make sure you have the following prerequisites:

• Google SecOps instance
• Active Azure tenant
• Privileged access to Azure
• Privileged access to Microsoft Intune

Configure log ingestion using Azure Storage

This section outlines the process of configuring log ingestion from Azure Storage, enabling you to effectively collect and analyze logs from Microsoft Intune.

Configure the Azure Storage Account

1. In the Azure console, search for Storage accounts.
2. Click Create.
3. Specify values for the following input parameters:
   • Subscription: select the subscription.
   • Resource Group: select the resource group.
   • Region: select the region.
   • Performance: select the chosen performance (Standard recommended).
   • Redundancy: select the chosen redundancy (GRS or LRS recommended).
   • Storage account name: enter a name for the new Storage account.
4. Click Review + create.
5. Review the overview of the account and click Create.
6. From the Storage Account Overview page, select submenu Access keys in Security + networking.
7. Click Show next to key1 or key2.
8. Click Copy to clipboard to copy the key.
9. Save the key in a secure location for future reference.
10. From the Storage Account Overview page, select submenu Endpoints in Settings.
11. Click Copy to clipboard to copy the Blob service endpoint URL, (for example, https://<storageaccountname>.blob.core.windows.net).
12. Save the endpoint URL in a secure location for future reference.

Configure Log Export for Microsoft Intune Logs

1. Sign in to the Microsoft Intune web UI.
2. Go to Reports > Diagnostic settings.
3. Click + Add diagnostic setting.
4. Provide the following configuration details:
   • Diagnostic setting name: Enter a descriptive name (for example, Intune logs to Google SecOps)
   • Select the diagnostic settings for AuditLogs, OperationalLogs, DeviceComplianceOrg and Devices.
   • Select the Archive to a storage account checkbox as the destination.
   • Specify the Subscription and Storage Account.
5. Click Save.

Set up feeds

To configure a feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed (for example, Azure Storage Audit Logs).
5. Select Microsoft Azure Blob Storage as the Source type.
6. Select Azure Storage Audit as the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Azure uri: the blob endpoint URL.

     ENDPOINT_URL/BLOB_NAME

     Replace the following:

     • ENDPOINT_URL: the blob endpoint URL. (https://<storageaccountname>.blob.core.windows.net)
     • BLOB_NAME: the name of the blob. (such as, <logname>-logs)

   • URI is a: select URI_TYPE according to log stream configuration (Single file | Directory | Directory which includes subdirectories).

   • Source deletion options: select deletion option according to your preference.

   • Shared key: the access key to the Azure Blob Storage.

9. Click Next.

10. Review your new feed configuration in the Finalize screen, and then click Submit.

Configure log ingestion using API

This section details the initial steps for setting up an application within Azure Active Directory to enable API-based log ingestion.

Configure an App on Azure AD

1. Sign in to the Azure Portal.
2. Optional: If you have access to multiple tenants, use the Directories + subscriptions in the top menu to switch to the correct tenant.
3. Search for and select Azure Active Directory.
4. Go to Manage > App registrations > New registration.
5. Provide the following configuration details:
   • Enter a Display Name for the application.
   • Specify who can access the application.
   • Optional: Don't enter anything for Redirect URI.
   • Click Register.
6. Copy and Save the Application (client) ID and Directory (tenant) ID from the Overview screen.

Configure Client Secret

1. In App Registrations, select your new application.
2. Go to Manage > Certificates & secrets > Client secrets > New client secret.
3. Add a name for your client secret.
4. Add an expiration period of 2 Years for the secret or specify a custom period.
5. Click Add.
6. Copy and Save the Secret Value.

Configure App Permissions

1. In App Registrations, select your new application.
2. Go to Manage > API Permissions > Add a permission.
3. Select Microsoft Graph.
4. Add the following Application permissions:
   • DeviceManagementApps.Read.All
   • DeviceManagementConfiguration.Read.All
   • DeviceManagementManagedDevices.Read.All
   • DeviceManagementRBAC.Read.All
   • DeviceManagementServiceConfig.Read.All
   • AuditLog.Read.All
   • Device.Read.All
5. Click Add permissions.

Configure a feed in Google SecOps to ingest Microsoft Intune logs

1. Go to SIEM Settings > Feeds.
2. Click Add New.
3. In the Feed name field, enter a name for the feed (for example, Microsoft Intune Logs).
4. Select Third party API as the Source type.
5. Select Microsoft Intune as the Log type.
6. Click Next.
7. Specify values for the following input parameters:
   • OAuth Client ID: Enter the Application ID copied earlier.
   • OAuth Client Secret: Enter the Secret Value created earlier.
   • Tenant ID: Enter the Directory ID copied earlier.
   • Asset namespace: the [asset namespace] (/chronicle/docs/investigation/asset-namespaces).
   • Ingestion labels: the label applied to the events from this feed.
8. Click Next.
9. Review the feed configuration in the Finalize screen, and then click Submit.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.