Configuring the connector

Install terraform on your OS.

Go to the create_all_resources folder inside the package.

Complete the terraform.tfvars file with your values.

In the create_all_resources folder, run the following commands:

Install terraform on your OS.

Go to the existing_workspace folder inside the package.

Complete the terraform.tfvars file with your values.

In the existing_workspace folder, run the following commands:

In the Microsoft Azure Portal, go to the Log Analytics workspace where you want to ingest Sectigo audit logs and note its location.

In the Monitor menu, select Data collection endpoints, and then select Create.

Provide an Endpoint Name, and select the Subscription and Resource Group.

(Optional) Apply Tags to the endpoint.

Click Review + create.

In Data collection endpoints, select your new endpoint, and click Overview.

Make note of the Logs Ingestion URL for later use.

In the Logs Analytics workspace, select Settings > Tables.

Select Create > New custom log (DCR based).

Set the table name to SectigoAuditLogs, and click Create a new data collection rule.

Complete the fields to create a new data collection rule (DCR).

Click Done.

Back on the Create a custom log page, select your Data collection rule and your Data collection endpoint.

Click Next.

In Schema and transformation, upload a sample log file.

[
  {
    "id": "test id",
    "chain_id": "test chain id",
    "timestamp": "2024-06-18T01:19:29.840753Z",
    "service": "test service",
    "action": "test action",
    "category": "test",
    "role": 1,
    "customer_id": 1,
    "username": "test username",
    "details": "test details",
    "json_details": {
      "test_field1": "test value 1",
      "test_field2": "test value 2"
    },
    "object_id": "test object_id",
    "object_type": "test object_type",
    "object_name": "test object_name",
    "object_acls": "test object_acls"
  }
]

Select Transformation editor and type the following KQL query:

source | extend TimeGenerated = todatetime(timestamp) | project TimeGenerated, service, action, login_id=username, customer_id, details = json_details

Click Run, then Apply.

Click Next, then Create.

Go to Data Collection Rules, click on the DCR you created when you created the custom table, and make note of the Immutable Id for use in a later step.

Go to Azure’s Function App page and click Create.

Select the Consumption plan, and click Select.

Make note of the Function App name and the Resource Group name for later use.

Click Next : Storage.

Select an existing storage account or leave it and Azure will create one.

Click Next : Networking.

Disable public access.

Click Next : Monitoring.

Select Yes for Enable Application Insights.

Select an existing Application Insights or leave it and Azure will create one.

Click Review + create, then Create.

Go to Function App > Settings > Identity.

Select System assigned and turn the Status to On.

Click Save.

Click Azure role assignments.

Click Add role assignment.

Set scope to Resource group.

Select the Resource group that the DCR belongs to.

Set role to Monitoring Metrics Publisher.

Click Save.

Navigate to Function App > Settings > Scale Out.

Set Maximum Scale Out Limit to 1, and click Save.

In Settings > Environment variables, click Add.

Add the following environment variables:

Click Apply.

Click Confirm.

Still in Environment variables, click the Azure Cloud Shell session icon in the top right.

Go to Manage files > Upload and upload the integration package.

Modify and run the following command:

`az functionapp deployment source config-zip -g "<FUNCTION_APP_RESOURCE_GROUP>" -n "<FUNCTION_APP_NAME>" --src "<uploaded package file.zip>"`

To check that synchronization works, click the name of the function and switch to the Logs tab.