Microsoft Azure Storage Account Integration Guide

The following instructions are for configuring an integration of Azure Storage Account to facilitate ingestion into Secureworks® Taegis™ XDR.

Configuration Prerequisites

Note

XDR supports integration of Azure Storage Account from Azure commercial cloud, Azure Government, Department of Defense (DoD) in Azure Government, US Government (GCC), and US Government High (GCC-High).

Note

The following prerequisites are required before beginning the Storage Account integration process:

• An active Azure subscription with at least one Storage Account; see Quickstart: Create a Storage Account using Azure portal
• A Blob Container in the Storage Account that will be the destination for the data source logs
• One or more data sources configured to send log data to the Storage Account Blob Container

Gather Required Information

The following information is required to integrate a Storage Account with XDR:

1. Storage Account — The Storage Account name to use for integration with XDR.

2. Blob Container — The Blob Container name that exists in the Storage Account. This is the destination for the data source logs.

   

   Storage Account Blob Container

3. Azure Function Service Plan Type — Please refer to the vendor's documentation for more information.

Important

The "Isolated" Service Plan Type is not supported.

Note

If you plan to later restrict this integration to a private network (see Restrict the Storage Account to a Private Network below), select Basic or Premium here. The Dynamic (Consumption) plan doesn't support regional VNet integration, and the plan type can't be changed after the Function App is deployed. It's a one-time decision made at this step, not something you can revisit afterward.

4. Azure Function Service Plan Code — Please refer to the vendor's documentation for more information.

Service Plan Type	Valid Service Plan Code(s)
Basic	B1, B2, B3
Dynamic	Y1
Premium	P0V3,P1MV3,P1V2,P1V3,P2MV3,P2V2,P2V3,P3MV3,P3V2,P3V3,P4MV3,P5MV3

Enter the Required Information in XDR

In XDR, follow these steps:

1. From the Taegis Menu, select Integrations → Cloud APIs.

2. Select Add an Integration from the top of the page.

   

   Add an Integration

3. Select the Custom tab and choose Set Up from the Azure Storage Account card.

4. Fill in the required fields as described in Gather Required Information.

   • Taegis Integration Name — Any unique string.
   • Storage Account Name — The name of an existing Storage Account to which log data will be sent.
   • Function App Name — A descriptive string that denotes what the Azure Function intends to do.
     • Example: NSGFlowLogsForwarder if NSG Flow logs are to be sent to the Storage Account.
   • Data Source Key — This is the container folder in which the logs are being created.
     • Example: If the data source is being written in a pattern such as MicrosoftInsights/2024-02-03/02hr/part=01/00004.json, then MicrosoftInsights would be an appropriate value for Data Source Key.
   • Azure Function Service Plan Type — (Optional) Basic, Dynamic, Premium. The default is Dynamic.
   • Azure Function Service Plan Code — (Optional) See the table in Gather Required Information.
   • Azure Function Service Plan Num Workers — (Optional) The default is 1.

   

   Add Azure Storage Account Integration

5. Select Done. The ARM template (AzureFunction.json) will automatically download. Note the location of the file.

6. Follow the steps in the vendor's documentation to deploy the ARM template.

   • Choose the Build your own template in editor: option.

7. Load the AzureFunction.json file in the editor.

8. Select Save.
9. Select an existing Resource group or create a new one.

Note

XDR supports Storage Accounts under Subscription IDs and/or Resource Groups different from the Subscription ID and Resource Group where the Azure Function is to be deployed.

• Storage Account Subscription ID — Modify this only if it differs from the current Subscription ID.
• Storage Account Resource Group — Modify this only if it differs from the current Resource Group.

Modify Resource Group

10. Select Review + Create.
11. Select Create. The Azure Function deployment will begin.
12. When the deployment is complete, return to XDR. The Azure Storage Account integration appears in the Cloud API Integrations table.

Restrict the Storage Account to a Private Network (Optional)

Note

This section is optional and must be done after completing the steps in the Enter the Required Information in XDR section above. The ARM template always deploys the Function App with public network access enabled — there's no way to deploy it directly into a private, VNet-only state. If you don't need Storage Account traffic to stay off the public internet, you can stop after Step 12 above; this section is not required.

The Function App uses the Storage Account for two things: as the data source it monitors and as its own required backing storage (host keys, trigger tracking, content). Both uses currently rely on the Storage Account's public endpoint, which is why the integration must be deployed and confirmed working over the public network first, before any private-networking changes are made.

Only the Basic or Premium Azure Function Service Plan Type supports the changes below. If you deployed with the Dynamic plan, this section doesn't apply.

Prerequisites

• An Azure virtual network (VNet) with a subnet, used to connect the Function App to the Storage Account over the internal network instead of the public internet. Use an existing VNet/subnet or create a new one. See the vendor's Azure Functions networking options documentation, or this walkthrough on using a Blob trigger with a private endpoint for guidance.
• The Function App deployed in the Enter the Required Information in XDR section above, confirmed working over the public network.

Steps

1. Create a virtual network if an existing one isn't available. Create a subnet, or use the default subnet, as needed.

   

   Create Virtual Network

2. On the Function App, go to Networking and make both the inbound and outbound connection use the virtual network. Storage account access continues to use the storage account key.

   

   Storage Account Networking Settings

3. Route the Function App's content-share traffic via the virtual network by setting WEBSITE_CONTENTOVERVNET to 1 as an environment variable. When you save the variable, the Function App restarts automatically. This must be done before the next step, or the Function App will lose access to its own required storage once public access is disabled.

   

   Storage Account Environmental Variable

4. Disable public network access on the Storage Account so it's reachable only via the virtual network. There isn't a dedicated vendor walkthrough for this specific configuration change; the closest available reference is Microsoft's Configure anonymous read access for containers and blobs article.

   

   Access via Private Network

5. Test that everything is still working as expected over the private network. Trigger the Function App by invoking a file present in a container using Test/Run. Observe the logs and make sure that the file upload works as expected.

   

   Test the Function

Known Issues

• With the "Basic" Azure Function Service Plan Type and B2 or B3 Azure Function Service Plan code, the maximum number of Azure Function Service Plan Num Workers is 3.