Skip to main content

Microsoft Azure Blob Storage

Logs and files stored in Microsoft Azure Blob Storage can be accessed and processed using this extension. It allows you to upload your logs, data dumps like CSV and JSON files to an Azure Blob Storage container and use them in your investigations and hunts.

CategoryFile storage
DirectionQuery source
Sign-inClient Secret, Shared Access Signature (SAS), Account Key
Query languagesSQLite
Websitehttps://azure.microsoft.com/en-us/services/storage/blobs/

Before you start​

Huntbase can sign in to Microsoft Azure Blob Storage with any of these methods: Client Secret, Shared Access Signature (SAS), Account Key. Pick one, create the credential in Microsoft Azure Blob Storage, then keep it to hand for the Connect step.

Client Secret​

Client secret authentication using Azure AD application credentials (client ID and client secret).

  1. In the Microsoft Entra admin center, go to Entra ID › App registrations, select New registration, and register the app.
  2. Copy the Application (client) ID from the app's overview page.
  3. Select Certificates & secrets › Client secrets › New client secret, then select Add. Copy the secret value now: it is only displayed once.
  4. In the Azure portal, open the storage account or container, go to Access control (IAM) › Add › Add role assignment, and assign Storage Blob Data Reader to the app.

Permissions:

  • Storage Blob Data Reader, scoped to the container or storage account

Shared Access Signature (SAS)​

Shared Access Signature (SAS) authentication using a SAS token for accessing Azure Blob Storage.

  1. In the Azure portal, open the storage account and go to Data storage › Containers.
  2. Select the checkbox next to the container, then select the container's More button (...) and choose Generate SAS.
  3. Set Signing method to Account key, choose a Signing key, and set Stored access policy to None.
  4. Under Permissions, select only the permissions needed to read the data, then set the Start and Expiry date and time.
  5. Select Generate SAS token and URL and copy the Blob SAS token. It is only displayed once.

Account Key​

Account key authentication using the storage account name and account key for accessing Azure Blob Storage.

  1. In the Azure portal, open the storage account.
  2. Under Security + networking, select Access keys, then select Show keys.
  3. Under key1, copy the Key value.

Permissions:

  • To view access keys you need a role that includes Microsoft.Storage/storageAccounts/listkeys/action, such as Owner, Contributor or Storage Account Key Operator Service Role.
Watch out for
  • An account key gives full access to all data in the storage account. Prefer the Client Secret or Shared Access Signature (SAS) method, as Microsoft recommends.
  • Rotating a storage account key revokes every SAS token signed with it. Generate a new SAS token after you rotate keys.
  • Role assignments can take up to 10 minutes to take effect.

For the vendor's own instructions, see Microsoft guide to managing blob containers and SAS tokens.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Microsoft Azure Blob Storage​

  1. Go to Connections and click New connection, or click New connection on the Microsoft Azure Blob Storage product page.
  2. On Product, pick Microsoft Azure Blob Storage and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Microsoft Azure Blob Storage lives:

FieldRequiredNotes
Account NameYesThe storage account name only, not the full blob.core.windows.net URL.
Container NameYesThe name of the Azure Blob Storage container.

Credentials​

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

Client Secret​

FieldRequiredNotes
Azure Client IDYesSecret — not shown again after you save it.
Azure Client SecretYesSecret — not shown again after you save it.

Shared Access Signature (SAS)​

FieldRequiredNotes
Azure SAS TokenYesThe Blob SAS token from the portal. The portal gives it without a leading ?, and that is fine. Secret — not shown again after you save it.

Account Key​

FieldRequiredNotes
Azure Account KeyYesSecret — not shown again after you save it.

Query it​

Once connected, Microsoft Azure Blob Storage can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
SQLiteSQL across this source and every other connected source.

Next steps​