Collect Azure Key Vault logs

Overview

Onum supports ingesting Azure Key Vault audit logs and metrics using the Azure Event Hubs Listener.

Prerequisites

In order to use this Listener, you must activate the Environment Variable in your distributor using docker compose (AZURE_EVENTHUB_LISTENER_EXECUTION_ENABLED)

Azure Event Hubs Setup

There are various management credentials that Onum needs to communicate with the event hub.

• Event Hubs namespace

• Event hub

See the Azure Event Hubs documentation for how to create these.

Azure Key Vault Diagnostic Settings

1

Access the Diagnostic settings of your Azure Key Vault

Navigate to your Key Vault in the Azure Portal and select Diagnostic settings under Monitoring.

2

Create a new diagnostic setting

• Click Add diagnostic setting

• Enter a name (e.g., "KeyVaultToEventHub")

3

Select log categories

Enable AuditEvent logs (captures all key, secret, and certificate operations)

Optionally, enable AllMetrics for performance monitoring.

4

Stream to an event hub

• Check Stream to an event hub

• Select your subscription.

• Choose existing Event Hubs namespace or create a new one

• Specify an Event Hub name (create a new one or use existing)

• Optionally provide a policy name

5

Save the diagnostic setting

Your event hub will now stream Azure Event Key Vault audit logs and metrics.

See the docs on Key Vault for more information.

Onum Setup

Log in to your Onum tenant and click Listeners > New listener. Double-click the Azure Event Hubs Listener. See the configuration steps in this article.