---
title: "Azure Audit Logs"
slug: "azure-audit"
updated: 2024-09-12T07:41:08Z
published: 2024-09-12T07:41:08Z
canonical: "docs.hunters.ai/azure-audit"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Audit Logs

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

## Overview

**Table name:** `azure_audit`

Azure Audit logs and tracks all operations performed on Azure resources, making this data available for auditing and compliance purposes.

## Send data to Hunters

Hunters supports the ingestion of these logs using Azure Event Hub. Follow the steps below to complete the connection.

### STEP 1: Set up Azure Event Hub

Before setting up the connection on the Hunters platform, you'll need to set up and create an Azure Event Hub.

Follow [this guide](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub) to complete the set up.

### STEP 2: Route logs to the Event Hub

1. In the Azure portal home screen, open the side menu and click **Microsoft Entra ID**. ![Microsoft Entra ID](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Microsoft%20Entra%20ID%281%29.jpg)
2. Now, scroll down the side menu to the Monitoring section, and click **Audit Logs**. ![Entra ID Audit Logs](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Entra%20ID%20Audit%20Logs.jpg)
3. Click **Export Data Settings**. ![Audit log Sign In log export data setting](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Audit%20log%20Sign%20In%20log%20export%20data%20setting.jpg)

The Diagnostic Settings page opens.
4. Click **Add Diagnostic setting**.
5. Under **Logs**, check the **AuditLogs** checkbox.
6. Under **Destination details**, check the **Stream to an Event Hub** option.
7. Fill in the requested details and give the diagnostic setting a name.
8. Click **Save**.

### STEP 3: Set up the connection on Hunters

          📘 Before you begin

          To complete this process you will need the information gathered when following [this guide](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub).

**To connect logs to Hunters:**

1. Open the Hunters platform and navigate to **Data > Data Sources**.  

![Data sources1](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Data%20sources%281%29.png)
2. Click **ADD DATA SOURCES**.  

![Add data source4](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Add%20data%20source%284%29.png)
3. Locate the **Microsoft Azure** panel and click **Connect**.  

The Add Data Flows window opens.
4. Fill in the required Azure application details, as gathered [here](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub) under **STEP 2**.  

![Connect Azure logs on Hunters](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Connect%20Azure%20logs%20on%20Hunters.jpg)
5. Under the **Data Types** section, activate the data types you want to connect.
6. For each activated data type, fill in the required information, as gathered [here](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub):
  1. Under STEP 1 - **Subscription ID**
  2. Under STEP 3 - **Resource group name** and **Event Hub namespace** and
  3. Under STEP 4 - **Event Hub name**.
7. OPTIONAL: Under the **Consumer group** field you can specify a specific Azure Event Hub consumer group, or leave this field empty to use the default consumer group.
8. Click **Test Connection** to make sure everything was set up correctly.
9. Once the connection is established, click **Submit**.

## Expected format

```
{"caller": "Microsoft.Insights/ActivityLogAlerts", "time": "2023-10-03T02:04:37.6448162Z", "resourceId": "/subscriptions/1111/resourceGroups/cc_az_activity_log_alert", "location": "global", "operationName": "Microsoft.Insights/ActivityLogAlerts/Activated/action", "correlationId": "aaaa-1111", "category": "Alert", "resultType": "Succeeded", "resultDescription": "Alert: cc_az_activity_log_alert called on action groups : cc_az_webhook_action_group", "level": "Informational", "identity": {"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/spn":"Microsoft.Insights/activityLogAlerts"}, "properties": {"subscriptionId":"1111-aaaa","tenantId":"2222-bbbb","eventDataId":"asdf1234","resourceGroup":"azure-arc-vmware","resourceId":"/subscriptions/1111/resourceGroups/cc_az_activity_log_alert","eventTimestamp":"2023-10-03T01:57:02.5719195Z","operationName":"Microsoft.Automanage/configurationProfileAssignments/write","status":"Succeeded"}}
```