The Microsoft Azure Event Hubs protocol
collects events that are inside of an Event Hub. This protocol collects events regardless of source
provided they are inside the Event Hub. However, these events might not be parsable by an existing
DSM.
Before you begin
To retrieve events in QRadar®, you need to create a Microsoft Azure Storage Account
and an Event Hub entity under the Azure Event Hub Namespace. For every Namespace, port 5671 must be
open. For every Storage Account, port 443 must be open.
The Namespace hostname is usually [Namespace Name].servicebus.windows.net
and the Storage Account hostname is usually
[Storage_Account_Name].blob.core.windows.net. The Event Hub must have at least
one Shared Access Signature that is created with Listen Policy and at least one Consumer Group.
Procedure
-
Obtain a Microsoft Azure Storage Account Connection
String.
The Storage Account Connection String contains authentication for the Storage Account Name and
the Storage Account Key that is used to access the data in the Azure Storage account.
-
Log in to the Azure
Portal. (https://portal.azure.com)
-
From the dashboard, in the All resources section, select a
Storage account.
- From the All types list, disable Select
All. In the filter items search box, type Storage Accounts, and
then select Storage Accounts from the list.
- From the Storage account menu, select Access
keys.
-
Record the value for the Storage account name. Use this value for the
Storage Account Name parameter value when you configure a log source in IBM®
QRadar.
-
From the key 1 or key 2 section, record the
following values.
- Key - Use this value for the Storage Account Key
parameter value when you configure a log source in QRadar.
- Connection string - Use this value for the Storage Account
Connection String parameter value when you configure a log source in QRadar.
Example:
DefaultEndpointsProtocol=https;AccountName=[Storage Account Name]
;AccountKey=[Storage Account Key];EndpointSuffix=core.windows.net
Most storage accounts use core.windows.net for the end-point suffix, but
this value can change depending on its location. For example, a government-related storage account
might have a different endpoint suffix value. You can use the Storage Account
Name and Storage Account Key values, or you can use the
Storage Account Connection String value to connect to the Storage Account.
You can use key1 or key2.
Important: To connect to a Microsoft
Azure Event Hub, you must be able to create a block blob on the Azure Storage Account you select.
Page and append blob types are not compatible with the Microsoft Azure Event Hubs Protocol.
For more information, see Introduction to Azure Blob storage
(https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) and Understanding Block Blobs, Append Blobs, and Page Blobs
(https://docs.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-page-blobs).
For further help, see Microsoft Support
(https://azure.microsoft.com/en-us/support/options).
QRadar creates a
container that is named
qradar in the provided storage blob.
Tip: Through the Azure Event Hubs SDK, QRadar uses a container in the
configured storage account blob to track event consumption from the Event Hub. A container that is
named qradar is automatically created to store the tracking data, or you can
manually create the container.
-
Obtain a Microsoft Azure Event Hub Connection
String.
The Event Hub Connection String contains the Namespace Name, the path to
the Event Hub within the namespace and the Shared Access Signature (SAS) authentication
information.
-
Log in to the Azure
Portal (https://portal.azure.com).
-
From the dashboard, in the All resources section, select an Event Hub.
Record this value to use as the Namespace Name parameter value when you
configure a log source in QRadar.
-
In the Entities section, select Event Hubs.
Record this value to use for the Event Hub Name parameter value when you
configure a log source in QRadar.
- From the All types list, disable Select
All. In the filter items search box, type event
hub, and then select Event Hubs Namespace from the
list.
-
In the Event Hub section, select the event hub that you want to use from the list. Record this
value to use for the Event Hub Name parameter value when you configure a log source in QRadar.
-
In the Settings section, select Shared access
policies.
Important: In the Entities section, ensure that the Consumer Groups option is listed. If
Event Hubs is listed, return to Step c.
- Select a POLICY that contains a Listen
CLAIMS. Record this value to use for the SAS Key Name
parameter value when you configure a log source in QRadar.
- Record the values for the following parameters:
- Primary key or Secondary key
- Use the value for the SAS Key parameter value when you configure a log
source in QRadar. The Primary
key and Secondary key are functionally the same.
- Connection string-primary key or Connection string-secondary key
- Use this value for the Event Hub Connection String parameter value when you
configure a log source in QRadar. The Connection string-primary key and Connection string-secondary key are functionally the
same.
Example : Endpoint=sb://[Namespace Name].servicebus.windows.net
/;SharedAccessKeyName=[SAS Key Name];SharedAccessKey=[SAS Key];
EntityPath=[Event Hub Name]
You can use the
Namespace Name,
Event Hub Name,
SAS Key Name and
SAS
Key values, or you can use the
Event Hub Connection String value
to connect to the Event Hub.
-
In the Entities section, select Consumer groups.
Record the value to use for the Consumer Group parameter value when you
configure a log source in QRadar.
Important: Do not use the $Default consumer group that is
automatically created. Use an existing consumer group that is not in use or create a new consumer
group. Each consumer group must be used by only one device, such as QRadar.