Skip to main content

Microsoft Azure Log Analytics

Microsoft Azure Log Analytics is a comprehensive cloud-based monitoring and analytics service within Azure Monitor that collects, analyzes, and acts on telemetry data from cloud and on-premises environments. It serves as a centralized log aggregation and analysis platform for organizations running workloads on Microsoft Azure and hybrid infrastructures.

CategoryObservability
DirectionQuery source
Sign-inAzure AD Application (Service Principal)
Query languagesSTIX, KQL
Query templates4

Before you start​

Huntbase signs in to Microsoft Azure Log Analytics with Azure AD Application (Service Principal). Create the credential in Microsoft Azure Log Analytics first, then keep it to hand for the Connect step.

  1. In the Azure portal, open Microsoft Entra ID and select App registrations › New registration. Enter a Name and select Register.
  2. On the app's overview page, copy the Application (client) ID.
  3. Select Certificates and Secrets, then on the Client secrets tab select New client secret. Enter a Description, select Add, and copy the secret Value straight away.
  4. Open your Log Analytics workspace and select Access control (IAM) › Add › Add role assignment.
  5. On the Role tab select Reader. On the Members tab choose User, group, or service principal, select your app, then select Review + assign.
  6. Copy the Workspace ID from the workspace overview.

Permissions:

  • Reader on the Log Analytics workspace (or on its resource group or subscription)
Watch out for
  • The client secret value is shown only when you create it. If you leave the page without copying it, create a new secret.
  • To register an app you need an Entra role such as Application Developer. To assign the role you need Owner or User Access Administrator on the workspace.

For the vendor's own instructions, see Microsoft guide to registering an app for the Log Analytics API.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Microsoft Azure Log Analytics​

  1. Go to Connections and click New connection, or click New connection on the Microsoft Azure Log Analytics product page.
  2. On Product, pick Microsoft Azure Log Analytics and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Microsoft Azure Log Analytics lives:

FieldRequiredNotes
API HostYesThe Log Analytics API endpoint, api.loganalytics.io. Don't enter your workspace or portal URL. Defaults to api.loganalytics.io.
PortYes443. Defaults to 443.
Workspace IDYesThe workspace ID (a GUID) from the workspace overview, not the workspace name or resource ID.
TablesNoTo search specific Log Analytics workspace tables, select one or more tables (populated dynamically from the connected workspace)

Advanced settings​

These settings are under Advanced. You can usually leave them alone.

FieldRequiredNotes
Max ResultsNoAdvanced. Maximum rows fetched per run (connector default 10000). Lower for large result sets to keep responses fast and avoid timeouts.
Query Timeout (seconds)NoAdvanced. Per-request timeout for the Log Analytics API (connector default 30s). Raise for slow or heavily-loaded workspaces.
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Credentials​

The only Method is Azure AD Application (Service Principal). Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Tenant IDYesThe ID (a GUID) of the Microsoft Entra tenant where you registered the app. Secret — not shown again after you save it.
Client IDYesClient ID of Azure Active directory Application with access to the data source. Secret — not shown again after you save it.
Client SecretYesThe client secret Value you copied when you created the secret. Secret — not shown again after you save it.

Query it​

Once connected, Microsoft Azure Log Analytics can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.
KQLNative Kusto queries against the workspace, sent as written.

Example: STIX​

Suspicious URL or IP across security tables — Hunt for a suspicious URL or IP using a STIX pattern.

[url:value = '{{url}}'] OR [ipv4-addr:value = '{{ip}}']

Example: KQL​

Top talkers by destination — Native KQL aggregation returning the busiest destinations first.

SecurityEvent
| where TimeGenerated > ago(24h)
| summarize events = count() by DestinationIp = tostring(DestinationIp)
| sort by events desc
| take 20

Microsoft Azure Log Analytics ships with 4 query templates. Find them in Library › Queries — see Query templates.

Next steps​