Azure Datadog Log Forwarder Deleted
Set up the azure integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect when the Datadog Azure function is deleted which will prevent Azure logs from being sent to Datadog.
Strategy
Monitor Azure logs where @evt.name is "MICROSOFT.WEB/SITES/DELETE", @evt.outcome is Success, and the @resourceID contains DATADOG and LOG. This rule does not work if the the Azure resource group or Azure function does not contain DATADOG or LOG.
Triage and response
- Verify the Azure function (
@resourceId) is responsible for forwarding logs to Datadog. - Determine if there is a legitimate reason for deleting the Azure function.
- If activity is not expected, investigate activity from the service principal (
@identity.authorization.evidence) or user ({{@usr.id}}).
