Storage Account Blobs to Azure Sentinel

This custom Azure Sentinel Data connector ingests Azure Storage Account Blobs to Azure Sentinel

Pre-requisites

1. Click on Deploy to Azure (For both Commercial & Azure GOV)
   

2. Select the preferred Subscription, Resource Group and Location
   Note
   Best practice : Create new Resource Group while deploying - all the resources of your custom Data connector will reside in the newly created Resource Group

3. Enter the following value in the ARM template deployment

   "Storage Account Name": Storage Account Name
   "Workspace Id": Azure Log Analytics Workspace Id​
   "Workspace Key": Azure Log Analytics Workspace Key
   

4. Deploy function app:

   git clone https://github.com/japan-d2/AzureStorageAccountBlobsIngestion
   cd AzureStorageAccountBlobsIngestion/StorageAccountBlobsIngestion
   func azure functionapp publish {functionapp name}  --python
   

   Function app name is in the format: <<Storage Account Name>><<uniqueid>>ew

5. Send auth0 log to "logssource" container in <<Storage Account Name>><<uniqueid>>sa.