↓ Skip to main content
Azure Policy: Mapping Audit Log Events to Policy Objects
  1. Posts/

Azure Policy: Mapping Audit Log Events to Policy Objects

·181 words·1 min
Christoph Petersen
Author
Christoph Petersen

Azure Policy is a great tool to define governance controls in Azure. With addition of the compliance pieces this feature which was part of Azure for quite some time finally had it’s appearance on main stage (deep dive on implementing governance at scale in this video from Ignite 2017 by Joseph Chan and Liz Kim)

Events that pertain to policy are logged to the Azure Activity Log. The Activity Log can be shipped to Log Analytics to run analytics on the logs or even implement alerting with Azure Monitor.

Policy related alerts reference the policy objects that were created under the hood when defining policy. That means there is a missing link between the event in Activity Log and what policy it pertains to. No very handy when trying to do analytics or monitoring ontop of it.

My esteemed colleague Ivan McKinley has written a script/docker image that takes the policy objects from the API and writes them to a custom log in Log Analytics. With a query magic it is now possible to correlate the events to the actual policy:

policy

Related

Process Monitoring for Linux with Log Analytics & Azure Monitor

·979 words·5 mins
Nearly every customer I talk to about Azure management asks me this: “How can I do process monitoring?”. As there is currently no way to directly instrument either the Windows or the Linux agent to do explicit process monitoring another way need to be found.

First post.

·71 words·1 min
After really starting to manage the Inner Circle for Azure Security & Management community and sharing some useful information I collect every day, I asked myself: “This is exactly what could be published on a blog so that a broader audience can benefit from it”. Thoughts thought, here we are with a brand new blog running Ghost on Azure in a Docker container (kids will be kids, nerds will be nerds…).