Skip to content

Commit 917593e

Browse files
SKosierSKosier
authored
feat(azure): customize entra and platform logs (SSPROD-43735) (#52)
1 parent f5ca091 commit 917593e

File tree

3 files changed

+52
-154
lines changed

3 files changed

+52
-154
lines changed

‎modules/integrations/event-hub/README.md

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -59,29 +59,30 @@ No modules.
5959

6060
## Inputs
6161

62-
| Name | Description | Type | Default | Required |
63-
|------|-------------|------|---------|:--------:|
64-
| <a name="input_auto_inflate_enabled"></a> [auto\_inflate\_enabled](#input\_auto\_inflate\_enabled) | Whether or not auto-inflate is enabled for the Event Hub | `bool` | `true` | no |
65-
| <a name="input_consumer_group_name"></a> [consumer\_group\_name](#input\_consumer\_group\_name) | Name of the consumer group to be created | `string` | `"sysdig-consumer-group"` | no |
66-
| <a name="input_diagnostic_settings_name"></a> [diagnostic\_settings\_name](#input\_diagnostic\_settings\_name) | Name of the diagnostic settings to be created | `string` | `"sysdig-diagnostic-settings"` | no |
67-
| <a name="input_enable_entra"></a> [enable\_entra](#input\_enable\_entra) | (Optional) Used to enable or disable Entra logs, defaults to true. | `bool` | `true` | no |
68-
| <a name="input_entra_diagnostic_settings_name"></a> [entra\_diagnostic\_settings\_name](#input\_entra\_diagnostic\_settings\_name) | Name of the Entra diagnostic settings to be created | `string` | `"sysdig-entra-diagnostic-settings"` | no |
69-
| <a name="input_event_hub_name"></a> [event\_hub\_name](#input\_event\_hub\_name) | Name of the Event Hub to be created | `string` | `"sysdig-event-hub"` | no |
70-
| <a name="input_event_hub_namespace_name"></a> [event\_hub\_namespace\_name](#input\_event\_hub\_namespace\_name) | Name of the Event Hub Namespace to be created | `string` | `"sysdig-event-hub-namespace"` | no |
71-
| <a name="input_eventhub_authorization_rule_name"></a> [eventhub\_authorization\_rule\_name](#input\_eventhub\_authorization\_rule\_name) | Name of the authorization rule to be created | `string` | `"sysdig-send-listen-rule"` | no |
72-
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to an Azure Tenant. | `bool` | `false` | no |
73-
| <a name="input_management_group_ids"></a> [management\_group\_ids](#input\_management\_group\_ids) | (Optional) List of Azure Management Group IDs. secure-for-cloud will be deployed to all the subscriptions under these management groups. | `set(string)` | `[]` | no |
74-
| <a name="input_maximum_throughput_units"></a> [maximum\_throughput\_units](#input\_maximum\_throughput\_units) | The maximum number of throughput units to be allocated to the Event Hub | `number` | `20` | no |
75-
| <a name="input_message_retention_days"></a> [message\_retention\_days](#input\_message\_retention\_days) | Number of days during which messages will be retained in the Event Hub | `number` | `1` | no |
76-
| <a name="input_namespace_sku"></a> [namespace\_sku](#input\_namespace\_sku) | SKU (Plan) for the namespace that will be created | `string` | `"Standard"` | no |
77-
| <a name="input_partition_count"></a> [partition\_count](#input\_partition\_count) | The number of partitions in the Event Hub | `number` | `4` | no |
78-
| <a name="input_region"></a> [region](#input\_region) | Datacenter where Sysdig-related resources will be created | `string` | n/a | yes |
79-
| <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | Name of the existing resource group | `string` | `null` | no |
80-
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | Name of the resource group to be created | `string` | `"sysdig-resource-group"` | no |
81-
| <a name="input_subscription_id"></a> [subscription\_id](#input\_subscription\_id) | Identifier of the subscription to be onboarded | `string` | n/a | yes |
82-
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Event Hub integration for (incase of organization, ID of the Sysdig management account) | `string` | n/a | yes |
83-
| <a name="input_throughput_units"></a> [throughput\_units](#input\_throughput\_units) | The number of throughput units to be allocated to the Event Hub | `number` | `1` | no |
84-
62+
| Name | Description | Type | Default | Required |
63+
|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------|:--------:|
64+
| <a name="input_auto_inflate_enabled"></a> [auto\_inflate\_enabled](#input\_auto\_inflate\_enabled) | Whether or not auto-inflate is enabled for the Event Hub | `bool` | `true` | no |
65+
| <a name="input_consumer_group_name"></a> [consumer\_group\_name](#input\_consumer\_group\_name) | Name of the consumer group to be created | `string` | `"sysdig-consumer-group"` | no |
66+
| <a name="input_diagnostic_settings_name"></a> [diagnostic\_settings\_name](#input\_diagnostic\_settings\_name) | Name of the diagnostic settings to be created | `string` | `"sysdig-diagnostic-settings"` | no |
67+
| <a name="input_enable_entra"></a> [enable\_entra](#input\_enable\_entra) | (Deprecated, see [enabled_entra_logs](#input\_enabled\_entra\_logs)) Used to enable or disable Entra logs, defaults to true. | `bool` | `true` | no |
68+
| <a name="input_entra_diagnostic_settings_name"></a> [entra\_diagnostic\_settings\_name](#input\_entra\_diagnostic\_settings\_name) | Name of the Entra diagnostic settings to be created | `string` | `"sysdig-entra-diagnostic-settings"` | no |
69+
| <a name="input_event_hub_name"></a> [event\_hub\_name](#input\_event\_hub\_name) | Name of the Event Hub to be created | `string` | `"sysdig-event-hub"` | no |
70+
| <a name="input_event_hub_namespace_name"></a> [event\_hub\_namespace\_name](#input\_event\_hub\_namespace\_name) | Name of the Event Hub Namespace to be created | `string` | `"sysdig-event-hub-namespace"` | no |
71+
| <a name="input_eventhub_authorization_rule_name"></a> [eventhub\_authorization\_rule\_name](#input\_eventhub\_authorization\_rule\_name) | Name of the authorization rule to be created | `string` | `"sysdig-send-listen-rule"` | no |
72+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to an Azure Tenant. | `bool` | `false` | no |
73+
| <a name="input_management_group_ids"></a> [management\_group\_ids](#input\_management\_group\_ids) | (Optional) List of Azure Management Group IDs. secure-for-cloud will be deployed to all the subscriptions under these management groups. | `set(string)` | `[]` | no |
74+
| <a name="input_maximum_throughput_units"></a> [maximum\_throughput\_units](#input\_maximum\_throughput\_units) | The maximum number of throughput units to be allocated to the Event Hub | `number` | `20` | no |
75+
| <a name="input_message_retention_days"></a> [message\_retention\_days](#input\_message\_retention\_days) | Number of days during which messages will be retained in the Event Hub | `number` | `1` | no |
76+
| <a name="input_namespace_sku"></a> [namespace\_sku](#input\_namespace\_sku) | SKU (Plan) for the namespace that will be created | `string` | `"Standard"` | no |
77+
| <a name="input_partition_count"></a> [partition\_count](#input\_partition\_count) | The number of partitions in the Event Hub | `number` | `4` | no |
78+
| <a name="input_region"></a> [region](#input\_region) | Datacenter where Sysdig-related resources will be created | `string` | n/a | yes |
79+
| <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | Name of the existing resource group | `string` | `null` | no |
80+
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | Name of the resource group to be created | `string` | `"sysdig-resource-group"` | no |
81+
| <a name="input_subscription_id"></a> [subscription\_id](#input\_subscription\_id) | Identifier of the subscription to be onboarded | `string` | n/a | yes |
82+
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Event Hub integration for (incase of organization, ID of the Sysdig management account) | `string` | n/a | yes |
83+
| <a name="input_throughput_units"></a> [throughput\_units](#input\_throughput\_units) | The number of throughput units to be allocated to the Event Hub | `number` | `1` | no |
84+
| <a name="input_enabled_platform_logs"></a> [enabled\_platform\_logs](#input\_enabled\_platform\_logs) | List of platform logs to enable | `list(string)` | `["Administrative", "Security", "Policy"]` | no |
85+
| <a name="input_enabled_entra_logs"></a> [enabled\_entra\_logs](#input\_enabled\_entra\_logs) | List of Entra logs to enable | `list(string)` | `["AuditLogs","SignInLogs","NonInteractiveUserSignInLogs","ServicePrincipalSignInLogs","ManagedIdentitySignInLogs","ProvisioningLogs","ADFSSignInLogs","RiskyUsers","UserRiskEvents","NetworkAccessTrafficLogs","RiskyServicePrincipals","ServicePrincipalRiskEvents","EnrichedOffice365AuditLogs","MicrosoftGraphActivityLogs","RemoteNetworkHealthLogs"]` | no |
8586
## Outputs
8687

8788
| Name | Description |

‎modules/integrations/event-hub/main.tf

Lines changed: 15 additions & 130 deletions
Original file line numberDiff line numberDiff line change
@@ -121,151 +121,36 @@ resource "azurerm_role_assignment" "sysdig_data_receiver" {
121121
# Create diagnostic settings for the subscription
122122
#---------------------------------------------------------------------------------------------
123123
resource "azurerm_monitor_diagnostic_setting" "sysdig_diagnostic_setting" {
124-
count = var.is_organizational ? 0 : 1
125-
124+
count = length(var.enabled_platform_logs) > 0 ? 1 : 0
125+
126126
name = "${var.diagnostic_settings_name}-${random_string.random.result}-${local.subscription_hash}"
127127
target_resource_id = data.azurerm_subscription.sysdig_subscription.id
128128
eventhub_authorization_rule_id = azurerm_eventhub_namespace_authorization_rule.sysdig_rule.id
129129
eventhub_name = azurerm_eventhub.sysdig_event_hub.name
130130

131-
enabled_log {
132-
category = "Administrative"
133-
}
134-
135-
enabled_log {
136-
category = "Security"
137-
}
138-
139-
enabled_log {
140-
category = "Policy"
131+
dynamic "enabled_log" {
132+
for_each = var.enabled_platform_logs
133+
content {
134+
category = enabled_log.value
135+
}
141136
}
142137
}
143138

144139
resource "azurerm_monitor_aad_diagnostic_setting" "sysdig_entra_diagnostic_setting" {
145-
count = var.enable_entra ? 1 : 0
140+
count = var.enable_entra && length(var.enabled_entra_logs) > 0 ? 1 : 0
146141

147142
name = "${var.entra_diagnostic_settings_name}-${local.subscription_hash}"
148143
eventhub_authorization_rule_id = azurerm_eventhub_namespace_authorization_rule.sysdig_rule.id
149144
eventhub_name = azurerm_eventhub.sysdig_event_hub.name
150145

151-
enabled_log {
152-
category = "AuditLogs"
153-
154-
retention_policy {
155-
enabled = false
156-
}
157-
}
158-
159-
enabled_log {
160-
category = "SignInLogs"
161-
162-
retention_policy {
163-
enabled = false
164-
}
165-
}
166-
167-
enabled_log {
168-
category = "NonInteractiveUserSignInLogs"
169-
170-
retention_policy {
171-
enabled = false
172-
}
173-
}
174-
175-
enabled_log {
176-
category = "ServicePrincipalSignInLogs"
177-
178-
retention_policy {
179-
enabled = false
180-
}
181-
}
182-
183-
enabled_log {
184-
category = "ManagedIdentitySignInLogs"
185-
186-
retention_policy {
187-
enabled = false
188-
}
189-
}
190-
191-
enabled_log {
192-
category = "ProvisioningLogs"
193-
194-
retention_policy {
195-
enabled = false
196-
}
197-
}
198-
199-
enabled_log {
200-
category = "ADFSSignInLogs"
201-
202-
retention_policy {
203-
enabled = false
204-
}
205-
}
206-
207-
enabled_log {
208-
category = "RiskyUsers"
209-
210-
retention_policy {
211-
enabled = false
212-
}
213-
}
214-
215-
enabled_log {
216-
category = "UserRiskEvents"
217-
218-
219-
retention_policy {
220-
enabled = false
221-
}
222-
}
223-
224-
enabled_log {
225-
category = "NetworkAccessTrafficLogs"
226-
227-
retention_policy {
228-
enabled = false
229-
}
230-
}
231-
232-
enabled_log {
233-
category = "RiskyServicePrincipals"
234-
235-
retention_policy {
236-
enabled = false
237-
}
238-
}
239-
240-
enabled_log {
241-
category = "ServicePrincipalRiskEvents"
242-
243-
retention_policy {
244-
enabled = false
245-
}
246-
}
247-
248-
enabled_log {
249-
category = "EnrichedOffice365AuditLogs"
250-
251-
retention_policy {
252-
enabled = false
253-
}
254-
}
255-
256-
enabled_log {
257-
category = "MicrosoftGraphActivityLogs"
258-
259-
retention_policy {
260-
enabled = false
261-
}
262-
}
146+
dynamic "enabled_log" {
147+
for_each = var.enabled_entra_logs
148+
content {
149+
category = enabled_log.value
263150

264-
enabled_log {
265-
category = "RemoteNetworkHealthLogs"
266-
267-
retention_policy {
268-
enabled = false
151+
retention_policy {
152+
enabled = false
153+
}
269154
}
270155
}
271156
}

‎modules/integrations/event-hub/variables.tf

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,4 +113,16 @@ variable "enable_entra" {
113113
variable "sysdig_secure_account_id" {
114114
type = string
115115
description = "ID of the Sysdig Cloud Account to enable Event Hub integration for (incase of organization, ID of the Sysdig management account)"
116-
}
116+
}
117+
118+
variable "enabled_platform_logs" {
119+
description = "List of platform logs to enable. Options are: 'Administrative', 'Policy', 'Security'."
120+
type = list(string)
121+
default = ["Administrative", "Security", "Policy"]
122+
}
123+
124+
variable "enabled_entra_logs" {
125+
description = "List of Entra logs to enable"
126+
type = list(string)
127+
default = ["AuditLogs","SignInLogs","NonInteractiveUserSignInLogs","ServicePrincipalSignInLogs","ManagedIdentitySignInLogs","ProvisioningLogs","ADFSSignInLogs","RiskyUsers","UserRiskEvents","NetworkAccessTrafficLogs","RiskyServicePrincipals","ServicePrincipalRiskEvents","EnrichedOffice365AuditLogs","MicrosoftGraphActivityLogs","RemoteNetworkHealthLogs"]
128+
}

0 commit comments

Comments
 (0)