Connecting Azure Activity Log or Google Cloud Audit Logs

Two log sources, both new: the Azure Resource Manager activity log, and Google Cloud's audit logs. Both authenticate, page through results, normalise each record and store it as a searchable SIEM event — the same path every other log source in the catalogue follows.

Azure Activity Log

This reads subscription-level control-plane operations from Azure Resource Manager: who created, changed or deleted which Azure resource, and when. It is not where your Entra ID sign-ins and directory changes come from — those already arrive through the Microsoft 365 connector's unified audit log, if you have that connected. Connect this source specifically for resource-level activity: a storage account's access keys regenerated, a network security group rule opened, a virtual machine deleted.

1. 1

   Register an app and grant it Reader

   In the Entra admin center, register an application and grant it the Reader role on the Azure subscription you want to read activity from.

2. 2

   Create a client secret

   Under Certificates & secrets, create a new secret and copy its value immediately.

3. 3

   Connect it in Qorionix

   Under SIEM → Log sources → Azure Activity Log, enter the tenant ID, client ID and secret, and press Test and save.

Google Cloud Audit Logs

This reads Cloud Logging's Admin Activity and System Event log streams, filtered to the audit log names Google Cloud writes automatically. Both are on by default and free — nothing to enable on the Google Cloud side for this baseline coverage.

1. 1

   Create a service account

   In the Google Cloud console, create a service account and grant it the Logs Viewer role on the project.

2. 2

   Download a JSON key

   Create and download a JSON key for that service account.

3. 3

   Connect it in Qorionix

   Under SIEM → Log sources → Google Cloud Audit Log, paste the JSON key, and press Test and save.

What lands in search

Both sources poll on schedule and store what they fetch as OCSF-normalised events. Each record maps to an API Activity event — the general "an operation happened against a resource" shape, since every Activity Log entry and every Cloud Audit Log entry is exactly that — with the actor, the action and the affected resource extracted from each vendor's own operation-name format. To confirm events are arriving, search source_module = "azure_activity" or source_module = "gcp_audit".