Onboarding Azure logs to intelligence

[Ken1]

Hi,

I'm trying to onboarding Azure audit logs and flow logs to intelligence. I found documentation of `Onboarding Azure Subscriptions to Intelligence`, but there is no configuration of the Azure side.
How to prepare storage account of Azure for audit logs and flow logs?

[Nir_Shamir]

Hi,

When you start the process in the CSPM portal it gives you instructions on what to configure on your Azure Portal for this onboarding to work.

it's pretty straight forward and easy.

[Ken1]

Isn't it necessary to create a storage account on the Azure side beforehand? Even if I follow the instructions, the storage account does not appear.

[Nir_Shamir · Accepted solution]

Yes , you need to create Storage account for User activity and for Flow Logs you just choose the NSGs :

User Activity logs

• Need to create a storage account and archive audit and sign-ins to it:

Tutorial: Archive Azure AD logs to an Azure storage account

https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-azure-monitor-...