Alerts in Azure | Centralized Dashboard |

Prasenna Kannan 436

Hello,

I'm trying to accomplish the below requirements :

1) Whenever a user copy a file from a storage account - file, an alert has to be triggered and incident created.
2) Create an alert when a backup is not successful.
3) Malicious sign-in activity from Azure.
4) Create a dashboard based on the alerts.

Need a kind of high level design to approach the requirements.

James Hamil 24,661 Reputation points Microsoft Employee

2020-11-16T22:15:00.117+00:00

Hi! Have you looked at this documentation? Or are you specifically talking about Azure Sentinel?
Prasenna Kannan 436 Reputation points

2020-11-17T05:23:51.067+00:00

@James Hamil : My question is specific to Azure Sentinel.

I wanted to accomplish below,

1) If any VM CPU percentage is more than 70% across all subscription, an incident needs to be created. All the VM's across all the subscriptions are pushing the logs to log analytic workspace.

2) If a storage account - files is being accessed by a person, I need to create an incident in Sentinel. I have enabled diagnostic setting in the storage account for the file to tracking storageWrite, storageRead, storageDelete, transactions and all these are being sent to log analytics.

Thanks!
Clive Watson - MSFT 106 Reputation points

2020-11-26T10:09:32.997+00:00
For #1 you will need to collect the Perf data, via this method https://learn.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-performance-counters or this: https://learn.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-performance

(I used 10 in my testing, but you can change that to 70)

let maxAllowed = 10; Perf | where TimeGenerated > ago(7d) | where CounterName == "% Processor Time" and InstanceName == "_Total" | project TimeGenerated, Computer, ObjectName, CounterName, InstanceName, round(CounterValue, 2) | summarize arg_max(TimeGenerated, *) by Computer //| top 10 by CounterValue | where CounterValue > maxAllowed

Linux has different counters and the query would need to be adjusted https://learn.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-linux-applications
Clive Watson - MSFT 106 Reputation points

2020-11-26T10:17:23.6+00:00

2 - did you use https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal ?

There are some example queries at the end of the page.
Prasenna Kannan 436 Reputation points

2020-11-30T07:48:58.59+00:00

'Yes, I have used the one.

I'm able to get the logs from the log analytic workspace and create incidents based on the logs ingested in the LA.

Share via

Alerts in Azure | Centralized Dashboard |

2 - did you use https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal ?

Your answer