1. Azure services send monitoring data to Azure Monitor.

2. Azure Monitor streams the logs to a logs event hub and metrics to a metrics event hub.

3. On receipt of data from Azure Monitor, an event hub triggers its Azure function to send the data to an HTTP source on a hosted collector in Sumo Logic.

4. Upon being triggered by its event hub, an Azure function sends the monitoring data it received (either logs or metrics) to an appropriately configured HTTP source on a hosted collector in the Sumo Logic cloud platform.

The Azure-Sumo pipelines for Azure log and metric collection use event hubs and Sumo-provided Azure functions to get monitoring data from Azure Monitor to Sumo Logic.

Sumo Logic can bring together application and infrastructure data — Azure logs and metrics — to let you monitor:

• Activity logs— subscription-level logs that provide insight into the operations performed on resources in your subscription, for example, creating a virtual machine or deleting a logic app.

• Diagnostics logs— resource-level logs that provide insight into operations that were performed within a resource itself, for example, getting a secret from a Key Vault.

• Metrics— performance statistics for different resources and the operating system in a virtual machine.

Sumo Logic integrates with Azure Monitor, enabling users to monitor a comprehensive set of Azure services.

Active Directory is a specialized software tool for administrators and security management teams of Windows domain networks to manage and deploy network changes and system or security policy changes to all machines connected to the domain or defined groups of users or endpoints. Active Directory employs a unique methodology for structuring network objects that lets network admins deploy changes in an organized and streamlined way without changing each object individually.

In addition to simplifying the management of groups of network objects, Active Directory also provides crucial security services in the form of AD DS. These services include:

• Domain services – performs user login authentication and provides search functionality, managing interactions between users and domains and storing data in a central location.

• Rights management – prevents unauthorized access or theft of digital content and protects intellectual property.

• Certificate services – handles the creation, assignment, and oversight of security certificates.

• Lightweight directory services – uses LDAP protocol to support directory-enabled apps.

• Directory federation services – provides single sign-on services to streamline user access to web applications.

Platform logs provide detailed diagnostic and auditing information for Azure app service resources and the Azure cloud services platform they depend on.

Microsoft Azure services generate three categories of platform logs that record different actions:

• Azure Active Directory reports changes made in Azure AD and login activity.

• Activity logs record Azure Service Health events and operations performed on an Azure resource, such as creating a virtual machine.

• Resource logs capture operations performed within an Azure resource, such as querying a database or writing to a storage bucket.