Azure Datadog Log Forwarder Deleted
Set up the azure integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect when the Datadog Azure function is deleted which will prevent Azure logs from being sent to Datadog.
Strategy
Monitor Azure logs where @evt.name
is "MICROSOFT.WEB/SITES/DELETE"
, @evt.outcome
is Success
, and the @resourceID
contains DATADOG
and LOG
. This rule does not work if the the Azure resource group or Azure function does not contain DATADOG
or LOG
.
Triage and response
- Verify the Azure function (
@resourceId
) is responsible for forwarding logs to Datadog. - Determine if there is a legitimate reason for deleting the Azure function.
- If activity is not expected, investigate activity from the service principal (
@identity.authorization.evidence
) or user ({{@usr.id}}
).