---
# System prepended metadata

title: Azure Log導入至Sentinel
tags: [SIEM analysis]

---

Azure Log導入至Sentinel
===
###### tags: `SIEM analysis`
## AAD log to log analytics workspace

可以導出的資料類型
* Audit logs
tenant 下所有的操作行為歷史紀錄
* Sign-in logs
* Provisioning logs
monitor which users have been created, updated, and deleted in all your third-party applications.
* Risky users logs (public preview)
monitor changes in user risk level and remediation activity.
* Risk detections logs (public preview): 
monitor user's risk detections and analyze trends in risk activity detected in your organization.

### Streaming connector
:::info
reference
* https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-log-analytics-wizard
* https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics
:::

step0.
* user who's a global administrator or security administrator for the Azure AD tenant
* Log Analytics workspace in your Azure subscription
* Licensing requirements - Azure AD Premium P1 or P2 tenant

step1.
* Select **Azure Active Directory > Diagnostic settings -> Add diagnostic setting**
或是 **select Export Settings from the Audit Logs or Sign-ins** page

step2.
* 選擇需要匯出的 log & location，等 15min 左右即可完成

step3.
* ==舊的 log 只能想辦法手動匯入==


## Azure activity log to log analytics workspace
:::info
reference
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

:::

或許可以直接從這裡看 (我沒有權限
![](https://i.imgur.com/30lGgGQ.png)

step1.
* Select **Export Activity Logs** to send the activity log to a Log Analytics workspace.
![](https://i.imgur.com/0E3SA5M.png)
![](https://i.imgur.com/t3XizF5.png)
![](https://i.imgur.com/OlCw7tA.png)



step2.
* ==舊的 log 只能想辦法手動匯入==

## Others
![](https://i.imgur.com/XrA6Vfy.png)

- 從Sentinel Data Connector端直接啟用連接
    - AD Log需要對應
