Sending Skytap Platform logs to Azure Monitor

To do this we need a three-step Logic App, as we need to receive the Skytap audit webhooks, grab the payload and then send it to an Azure Log Analytics Workspace.

Add a discrete Custom Log to receive the logs from Skytap.

Create a Logic App and use the HTTP Request trigger to receive data, you can seed it with appropriate variables and expected payload by using the JSON example here.

Once done you need to create an Action on Azure Log Analytics Data Collector using the Send Data action. As part of that, you’ll need to link this App to the Workspace, to do that head over to Log Analytics Workspace and select Advanced from the Sidebar.

You need to note the Workspace ID and Primary or Secondary Key. Enter those in the connection information below, along with an arbitrary Connection Name.

Now for each Payload that you receive into the Logic App, you need to send it to the Custom Log, which you can find in your Log Analytics Workspace. Do that by sending the Current Item as the JSON Request Body and find your Custom Log from the Workspace and enter it in the Custom Log field.

Once that’s configured you’ll need to end your Logic App with a Terminate action set to Succeeded to close out the program.

Once you’ve created the webhook and have the Endpoint URL you need to capture the certificate so that Skytap can authenticate it and send the data. Run the following command from a terminal

openssl s_client -showcerts -connect {webhookserver}:{port} </dev/null 2>/dev/null|openssl x509 -outform PEM

Now copy that certificate output to your Skytap settings here, along with the Endpoint URL.

You should now start seeing logs appear in the Workspace.

After setting up all of this up your Skytap audit events should start to appear in the Azure Log Analytics workspace in a couple of minutes. With this data consolidated you can start to investigate trends, identify anomalies or stream it on to a separate SIEM tool.

You can see examples of logs generated in our field sandbox account (I’ve redacted the more sensitive elements).

You can also visualise this, and in this example, I’ve separated out the types of events (Run Environment, Power Options, Login, etc…) and stacked it based on Users.