You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/purview/tutorial-purview-audit-logs-diagnostics.md
+54-49Lines changed: 54 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,100 +11,105 @@ ms.date: 02/10/2022
11
11
12
12
# Azure Purview: Audit Logs, Diagnostics & Activity History
13
13
14
-
This guide lists step-by-step configuration on how to enable and capture Azure Purview Audit & Diagnostics Logs via Azure Event Hubs.
14
+
This guide lists step-by-step configuration on how to enable and capture Azure Purview Audit & Diagnostics Logs via Azure Event Hubs.
15
15
16
-
## Customer Intent
16
+
An Azure Purview administrator or Azure Purview data-source admin needs the ability to monitor audit and diagnostics logs captured from an [Azure Purview](https://azure.microsoft.com/services/purview/#get-started) service. Audit and diagnostics information consists of timestamped history of actions taken and changes made on the Azure Purview account by every user. Captured activity history includes actions in the [Azure Purview portal](https://ms.web.purview.azure.com) and outside the portal (such as calling [Azure Purview REST APIs](/rest/api/purview/) to perform write operations).
17
17
18
-
As an Azure Purview administrator or Azure Purview data-source admin, I want the ability to capture, view and monitor audit and diagnostics logs captured from [Azure Purview](https://azure.microsoft.com/services/purview/#get-started) service. Audit and diagnostics information consists of timestamped activity history of actions taken and changes made on the Purview account by every user. Captured activity history includes actions on [Azure Purview portal](https://ms.web.purview.azure.com) as well as outside the portal (such as calling [Purview REST APIs](/rest/api/purview/) that perform write operations). To enable audit logging on Purview, let's go through a step-by-step guide on how to configure and capture streaming audit events from Azure Purview via Azure Diagnostics Event Hubs service.
18
+
This guide will take you through the steps to enable audit logging on Azure Purview, amd how to configure and capture streaming audit events from Azure Purview via Azure Diagnostics Event Hubs service.
19
19
20
+
## Azure Purview Audit History - Categorization of Events
20
21
21
-
### Purview Audit History - Categorization of Events
22
+
Some of the important categories of Azure Purview audit events that are currently available for capture and analysis are listed in the table.
22
23
23
-
- Some of the important categories of Azure Purview audit events that are currently available for capture and analysis are listed in the table.
24
-
- More types and categories of activity audit events are being added to Purview in the coming months.
24
+
More types and categories of activity audit events are being added to Azure Purview in the coming months.
-Create an [Azure Event Hubs Namespace and an Azure event hub using Azure ARM Template (GitHub)](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.eventhub/eventhubs-create-namespace-and-enable-capture). While this automated Azure ARM Template will deploy and finish creating your Event Hubs with the required configuration at t; follow these guides for more detailed step by step explanations and manual setup: [Azure Event Hubs: Use Azure Resource Manager Template to enable event hub capture](../event-hubs/event-hubs-resource-manager-namespace-event-hub-enable-capture.md) and [Azure Event Hubs: Enable capturing of events streaming manually using Azure portal](../event-hubs/event-hubs-capture-enable-through-portal.md)
49
+
Create an [Azure Event Hubs Namespace using Azure ARM Template (GitHub)](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.eventhub/eventhubs-create-namespace-and-enable-capture). While this automated Azure ARM Template will deploy and finish creating your Event Hubs with the required configuration; follow these guides for more detailed step by step explanations and manual setup: [Azure Event Hubs: Use Azure Resource Manager Template to enable Event Hubs capture](../event-hubs/event-hubs-resource-manager-namespace-event-hub-enable-capture.md) and [Azure Event Hubs: Enable capturing of events streaming manually using Azure portal](../event-hubs/event-hubs-capture-enable-through-portal.md)
50
50
51
-
### Connect Purview Account to Diagnostics Event Hubs
51
+
### Connect Azure Purview Account to Diagnostics Event Hubs
52
52
53
-
-Now that Event Hubs is deployed and created, connect Azure Purview diagnostics audit logging to this event hub.
53
+
Now that Event Hubs is deployed and created, connect Azure Purview diagnostics audit logging to this Event Hubs:
54
54
55
-
-Go To your Purview Account home page (where the overview information is displayed, not the Purview Studio home page.) and follow instructions as detailed below.
55
+
1.Go To your Azure Purview Account home page (where the overview information is displayed, not the Azure Purview Studio home page.) and follow instructions as detailed below.
56
56
57
-
- Click "Monitoring" -> "Diagnostic Settings" in the left navigation menu.
57
+
1. Select "Monitoring" -> "Diagnostic Settings" in the left navigation menu.
- Click "Add Diagnostic Settings" or "Edit Setting". Adding more than one row of diagnostic setting in the context of Purview isn't recommended. In other words, if you already have a diagnostic setting row added, don't click "Add Diagnostic"; click "Edit" instead.
61
+
1. Select "Add Diagnostic Settings" or "Edit Setting". Adding more than one row of diagnostic setting in the context of Azure Purview isn't recommended. In other words, if you already have a diagnostic setting row added, don't select "Add Diagnostic"; select "Edit" instead.
62
62
63
63
:::image type="content" source="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-f.png" alt-text="Add or Edit Diagnostic Settings screen." lightbox="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-f.png":::
64
64
65
-
-Ensure to select checkbox "audit" and "allLogs" to enable collection of Purview audit logs. Optionally, select "allMetrics" if you wish to capture DataMap Capacity Units and Data Map size metrics of the Purview account as well.
65
+
1.Ensure to select checkbox "audit" and "allLogs" to enable collection of Azure Purview audit logs. Optionally, select "allMetrics" if you wish to capture DataMap Capacity Units and Data Map size metrics of the Azure Purview account as well.
-Diagnostics Configuration on the Azure Purview account is complete.
69
+
1.Diagnostics Configuration on the Azure Purview account is complete.
70
70
71
-
- Next, go to [Azure portal](https://portal.azure.com) home page and search the name of the Event Hubs Namespace you created in *Step-1*.
71
+
Now that Azure Purview diagnostics audit logging configuration is complete, configure the data capture and data retention settings for the Event Hubs:
72
72
73
-
- Navigate to the Event Hubs Namespace. Select the event hub and click "Capture Data".
73
+
1. Go to [Azure portal](https://portal.azure.com) home page and search the name of the Event Hubs Namespace you created earlier.
74
74
75
-
- Supply the name of the Event Hubs Namespace and the event hub where you would like the audit and diagnostics to be captured and streamed. Modify the "Time Window" and "Size Window" values for retention period of streaming events. Click Save.
75
+
1. Navigate to the Event Hubs Namespace. Select the Event Hubs and select "Capture Data".
76
76
77
-
:::image type="content" source="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-h.png" alt-text="Capture Settings on Event Hubs Namespace and event hub." lightbox="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-h.png":::
77
+
1. Supply the name of the Event Hubs Namespace and the Event Hubs where you would like the audit and diagnostics to be captured and streamed. Modify the "Time Window" and "Size Window" values for retention period of streaming events. Select Save.
78
78
79
-
- Optionally, go to "Properties" on the left navigation menu and change the "Message Retention" to any value between 1-7 days. Retention period value depends on the frequency of scheduled jobs/scripts you've created to continuously listen and capture the streaming events. If you schedule a capture once every week, take the slider to 7 days.
79
+
:::image type="content" source="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-h.png" alt-text="Capture Settings on Event Hubs Namespace and Event Hubs." lightbox="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-h.png":::
80
+
81
+
1. Optionally, go to "Properties" on the left navigation menu and change the "Message Retention" to any value between 1-7 days. Retention period value depends on the frequency of scheduled jobs/scripts you've created to continuously listen and capture the streaming events. If you schedule a capture once every week, take the slider to seven days.
-At this stage, the Event Hubs configuration will be complete. Purview will start streaming all its audit history and diagnostics data to this event hub. You can now proceed to read, extract and perform further analytics and operations on the captured diagnostics and audit events.
85
+
1.At this stage, the Event Hubs configuration will be complete. Azure Purview will start streaming all its audit history and diagnostics data to this Event Hubs. You can now proceed to read, extract and perform further analytics and operations on the captured diagnostics and audit events.
84
86
85
87
### Reading captured "audit" events
86
88
87
-
- Analyzing and making sense of the captured Audit and Diagnostics log data from Purview.
88
-
89
-
- Navigate to "Process Data" on the Event Hubs page to see a preview of the captured Purview audit logs and diagnostics.
89
+
Analyzing and making sense of the captured Audit and Diagnostics log data from Azure Purview:
90
90
91
+
1. Navigate to "Process Data" on the Event Hubs page to see a preview of the captured Azure Purview audit logs and diagnostics.
92
+
91
93
:::image type="content" source="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-d.png" alt-text="Configure Event Hubs - Process Data." lightbox="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-d.png":::
1. Select "Download Sample Data" to download and analyze the results carefully.
98
102
99
-
- Click "Download Sample Data" to download and analyze the results carefully.
103
+
:::image type="content" source="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-b.png" alt-text="Query and Process Azure Purview Audit data on Event Hubs." lightbox="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-b.png":::
100
104
101
-
:::image type="content" source="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-b.png" alt-text="Query and Process Purview Audit data on Event Hubs." lightbox="./media/tutorial-purview-audit-logs-diagnostics/azure-purview-diagnostics-audit-eventhub-b.png":::
105
+
Now that you know how to gather this information, you can use automatic, scheduled scripts to extract, read, and perform further analytics on the Event Hubsaudit and diagnostics data. You can even build your own utilities and custom code to extract business value from captured audit events.
102
106
103
-
- Lastly, you can use automatic, periodically scheduled scripts to extract, read and perform further analytics and operations on the Event Hubs audit and diagnostics data. You can even build your own utilities and custom code to extract business value out of the captured audit events. What's more, you can even use these audit logs and transform them to Excel, any database, Dataverse or Synapse, for analytics and reporting using Power BI. While you are free to use any programming or scripting language of your choice to read the event hub, here's one ready-made [Python-based script](https://github.com/Azure/Azure-Purview-API-PowerShell/blob/main/purview_atlas_eventhub_sample.py). Python tutorial on how to [Capture Event Hubs data in Azure Storage and read it by using Python (azure-eventhub)](../event-hubs/event-hubs-capture-python.md)
107
+
These audit logs can also be transformed to Excel, any database, Dataverse, or Synapse Analytics database, for analytics and reporting using Power BI.
104
108
109
+
While you're free to use any programming or scripting language of your choice to read the Event Hubs, here's one ready-made [Python-based script](https://github.com/Azure/Azure-Purview-API-PowerShell/blob/main/purview_atlas_eventhub_sample.py). Python tutorial on how to [capture Event Hubs data in Azure Storage and read it by using Python (azure-eventhub)](../event-hubs/event-hubs-capture-python.md).
105
110
106
111
## Next steps
107
112
108
113
Kickstart your Azure Purview journey in less than 5 minutes. Enable Diagnostic Audit Logging from the beginning of your journey!
109
-
> [!div class="nextstepaction"]
110
-
> [Azure Purview: automated New Account Setup](https://aka.ms/PurviewKickstart)
114
+
> [!div class="nextstepaction"]
115
+
> [Azure Purview: automated New Account Setup](https://aka.ms/PurviewKickstart)
0 commit comments