Documentation on Filebeat Module setup for Azure

[thegreekman]

Hello, I was wondering if their was any documentation on how to set up the filebeat configuration on Security Onion to ingest Azure Cloud Logs(Activity Sign-ins, etc.). Im looking for something like the AWS cloudtrail implementation documentation that Security Onion has.

[robbiemarshall]

Yes, you would follow the AWS Cloudtrail module steps in Security Onion Documentation, but instead of the Cloudtrail module, you would use the Azure module and instructions found here: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-azure.html