Skip to main content

​
Bronto Log Forwarder for Azure

​
How it works

The Bronto log forwarder for Azure is built around a Function App that collects log data from Azure Event Hub and sends it to Bronto.

​
Steps

1
Set Up Event Hub Infrastructure Using Our Terraform Module: This will automatically create and configure relevant resources (e.g. Event Hub, Function App, etc), using the details from the configurations below. The creation of an Event Hub is optional with the module, to accommodate for cases where such an Event Hub would already be in place.
2
Stream Events from Azure services or resources to Event Hub: Using the Diagnostic setting, you can configure each Azure resource to stream certain events to an event hub: Azure steps to stream logs to an event hub.
3
Verifying Log Data in Bronto: Once the relevant data is generated in Azure and streamed to Event Hub, shortly log events will appear in the Bronto UI. These logs will be displayed in the appropriate datasets which will be automatically created at ingestion time.

​
Resources

For Terraform users, Bronto offers a module that simplifies the setup of the forwarding Function App and its associated Event Hub resources. You can access the module source at this URL. Below is an example of how to use the Terraform module for Bronto log forwarding. This example assumes that a Resource Group, Event Hub, and all necessary resources for deploying the Bronto Function App will be created. Ensure that you replace <REGION> with your Bronto account region (EU, US). 
module "forwarder" {
  source = "https://releases.bronto.io/integrations/azure/terraform/latest/brontoForwarder.zip"
  location  = "canadacentral"
  resource_group = {
    create = true
    name   = "brontoforwarder"
  }
  eventhub  = {
    create = true
    name = "brontoforwarder"
    namespace = {
      name = "brontoforwarder"
      sku  = "Basic"
    }
    retention_days = 1
  }
  forwarder = {
    name = "brontoforwarder"
    service_plan_type = "Y1"
    storage_account = {
      name             = "brontoforwarder"
      replication_type = "LRS"
      tier             = "Standard"
    }
    bronto_config = {
      ingestion_endpoint = "https://ingestion.<REGION>.bronto.io"
      ingestion_key      = data.aws_kms_secrets.secrets.plaintext["bronto_ingestion_key"]
      default_collection = "azure"
    }
  }
}
If an Event Hub for receiving log data is already configured in your environment, you can create only the resources related to the forwarding Bronto Function App using a configuration like the one below (not create = false): 
module "forwarder" {
  source    = "https://releases.bronto.io/integrations/azure/terraform/latest/brontoForwarder.zip"
  location  = "canadacentral"
  resource_group = {
    create = false
    name   = "brontoforwarder"
  }
  eventhub  = {
    create    = false
    name      = var.eventhub.name
    namespace = var.eventhub.namespace
  }
  forwarder = {
    name              = "brontoforwarder"
    service_plan_type = "Y1"
    storage_account = {
      name             = "brontoforwarder"
      replication_type = "LRS"
      tier             = "Standard"
    }
    bronto_config = {
      ingestion_endpoint = "https://ingestion.<REGION>.bronto.io"
      ingestion_key      = data.aws_kms_secrets.secrets.plaintext["bronto_ingestion_key"]
      default_collection = "azure"
    }
  }
}
For those not using Terraform, the Function App forwarder artifact is available for download at this URL.

​
Streaming from a Log Analytics workspace

If your logs are already collected in an Azure Monitor Log Analytics workspace, you don’t need to reconfigure each source’s diagnostic settings. Use the workspace’s Data Export feature to continuously stream selected tables to the same Event Hub the forwarder consumes:
  1. Create a Data Export rule on the Log Analytics workspace.
  2. Select the tables to export (for example, AzureActivity or SigninLogs).
  3. Set the destination to the Event Hub namespace used by the Bronto forwarder.
From there, the forwarder picks up the events exactly as it does for logs streamed directly via diagnostic settings. This is useful when a source can only write to Log Analytics, or when you already centralize there and want Bronto to receive a copy.

​
Troubleshooting

​
Ensure and verify log events are being sent to the event hub.

  • Navigate to Event Hubs on Azure.
  • Search for the event hub created earlier. Here you will see an overview table for this event hub and metrics on messages being received broken down by incoming and and outgoing messages.
  • If this is empty please ensure that events are being streamed to the correct event hub.
  • If metrics show that data goes in and out of event hub and yet you do not see data in Bronto, please check your ingestion endpoint and region is correct (US, EU) and that your Bronto API key set as environment variables on the Function App are correct.

​
Notes on event categorisation

When ingesting log data, Bronto automatically assigns it to a collection and dataset based on the information received with the payload. Azure logs forwarded through the Bronto integration are, by default, assigned to the unknown_service dataset within the azure collection. However, the following log types are automatically assigned to more specific collections and datasets:
  • Activity Logs
  • Function App Logs
  • Entra ID Logs
  • Network Security Perimeter Logs
If you are forwarding a log type that is not listed above and would like it assigned to a specific collection and dataset, please contact us at support@bronto.io.