How-To: Export your EZCMS Logs to Azure Log Analytics and Azure Sentinel

Learn how to export your EZCMS Audit Logs to Azure Log Analytics and Azure Sentinel for advanced analysis and monitoring.

Do I Need Azure Sentinel?

This guide applies to both Azure Log Analytics and Azure Sentinel since Sentinel is built on top of Log Analytics. Azure Sentinel is not required if you only want to collect and analyze logs, but it provides additional security features if you choose to use it.

Prerequisites

The Keytos Entra ID application is registered in your tenant
You have an active EZCMS plan
You are an Owner or User Access Administrator on the Resource Group containing your Log Analytics workspace.

How to Grant Log Contributor Permissions to the EZCMS Application in Azure

To allow EZCMS to send logs to your Log Analytics and Azure Sentinel workspace, you need to grant the Keytos application the following roles on the Resource Group containing your Log Analytics workspace:

This can be done manually in the Azure Portal or using the Azure CLI.

How to Grant Permissions using the Azure Portal

It’s easy to enable the required permissions using the Azure Portal:

Navigate to the Azure Portal.
Open the Log Analytics Workspace you want to connect to EZCMS. If you are using Azure Sentinel, open the Log Analytics workspace connected to your Sentinel instance.
Click on Resource group to open the Resource Group containing your Log Analytics workspace.
Click Access control (IAM) in the left menu.
Click + Add and Add role assignment.
Search for Monitoring Contributor in the list of Azure roles. Select the role and click Next.
Click + Select members and search for Keytos. Select the Keytos application.
Click Review + assign twice to grant the role to the Keytos application.
Repeat steps 1-8 for the Monitoring Metrics Publisher and Log Analytics Contributor roles.

How to Grant Permissions using the Azure CLI

The Azure CLI can also be used to enable the required permissions. Follow these steps:

Open a terminal window on your device or navigate to the Azure Portal and open Azure Cloud Shell.

Begin by getting the object ID of the service principal for the Keytos application in your tenant:

$objectId = az ad sp list --filter "appId eq '68554b48-233f-42b4-9aa7-2eadca4d7727'" --query "[].{id:id}" --output tsv

Copy the Resource ID of the Resource Group containing your Log Analytics workspace. This can be found by going to the Resource Group in Azure, selecting Properties, and copying the Resource ID.

Save the Resource ID as a variable for easier use:

$resourceGroupId = "/subscriptions/<YOUR-SUBSCRIPTION-ID>/resourceGroups/<YOUR-RESOURCE-GROUP-NAME>"

Grant the Monitoring Contributor role to the Keytos application:

az role assignment create --scope "$resourceGroupId" --role "Monitoring Contributor" --assignee $objectId

Grant the Monitoring Metrics Publisher role to the Keytos application:

az role assignment create --scope "$resourceGroupId" --role "Monitoring Metrics Publisher" --assignee $objectId

Grant the Log Analytics Contributor role to the Keytos application:

az role assignment create --scope "$resourceGroupId" --role "Log Analytics Contributor" --assignee $objectId

How to Export your Passwordless Onboarding Audit Logs to Log Analytics and Azure Sentinel

Now that you have granted the necessary permissions to the Keytos application, you can configure EZCMS to send your passwordless onboarding logs to your Log Analytics and Azure Sentinel workspace:

How To Enable Log Export in EZCMS Portal

Go to your EZCMS portal.
Click on Settings.
Scroll down to SIEM Connection Settings and enable the Send Alerts to SIEM option.

How to Configure the Azure Sentinel Exporter in EZCMS Portal

Under SIEM Provider, select Sentinel.
In another tab, navigate to the Azure Portal.
Select the Log Analytics workspace connected to your Sentinel instance (or any Log Analytics workspace you want to use if you are not using Sentinel).
Click on Properties.
Copy the Resource ID.
Go back to the EZCMS tab and paste the Resource ID into the Workspace Resource ID field.
Back in the Azure tab note the Location of the Log Analytics workspace.
In EZCMS select the same location in the Location dropdown.
Click the Create Connection button. This will create the necessary connection in your Resource Group to communicate with Log Analytics, and send a test message to ensure proper connection.
Once the test succeeds, make sure to click Save changes to save your SIEM settings.
Done! EZCMS will now send your security logs to your SIEM.