#User activity audit in real time how to#
#User activity audit in real time manual#
#User activity audit in real time download#

Select Download sample data and analyze the results carefully. Switch between the Table and Raw views of the JSON output. Go to Process data on the Event Hubs page to see a preview of the captured audit logs and diagnostics. To analyze the captured audit and diagnostics log data: You can now proceed to read, extract, and perform further analytics and operations on the captured diagnostics and audit events. The Microsoft Purview governance portal will start streaming all its audit history and diagnostics data to this event hub. If you schedule a capture once every week, move the slider to seven days.Īt this stage, the Event Hubs configuration is complete. The retention period value depends on the frequency of scheduled jobs or the scripts you've created to continuously listen and capture the streaming events. Optionally, on the left menu, go to Properties and change Message Retention to any value between one and seven days. Modify the Time Window and Size Window values for the retention period of the streaming events. Supply the name of the Event Hubs namespace and the event hub where you want the audit and diagnostics to be captured and streamed. Go to the Azure portal home page, and search for the name of the Event Hubs namespace you created earlier.

Now that diagnostics audit logging configuration is complete, configure the data capture and data retention settings for Event Hubs. Optionally, select AllMetrics if you also want to capture Data Map capacity units and Data Map size metrics of the account.ĭiagnostics configuration on the Microsoft Purview account is complete. Select the audit and allLogs checkboxes to enable collection of audit logs. In other words, if you already have a diagnostic setting row, don't select Add diagnostic. Adding more than one diagnostic setting row in the context of Microsoft Purview isn't recommended. Select Add diagnostic setting or Edit setting. On the left menu, select Monitoring > Diagnostic settings. It's not the Microsoft Purview governance portal home page. This page is where the overview information is displayed in the Azure portal. Go to your Microsoft Purview account home page. Now that Event Hubs is deployed and created, connect your Microsoft Purview account diagnostics audit logging to Event Hubs.

Event Hubs: Enable capturing of events streaming manually by using the Azure portalĬonnect a Microsoft Purview account to Diagnostics event hubs.

Event Hubs: Use an ARM template to enable Event Hubs capture.

#User activity audit in real time manual#

This automated Azure ARM template will deploy and finish creating your Event Hubs instance with the required configuration.įor step-by-step explanations and manual setup:

Configure Event HubsĬreate an Azure Event Hubs namespace by using an Azure Resource Manager (ARM) template (GitHub). The following sections walk you through the process of enabling audit and diagnostics. More types and categories of activity audit events will be added. Some of the important categories of Microsoft Purview governance portal audit events that are currently available for capture and analysis are listed in the table.

#User activity audit in real time how to#

It also shows you how to configure and capture streaming audit events from the Microsoft Purview governance portal via Azure Diagnostics event hubs. This tutorial takes you through the steps to enable audit logging. Actions outside the portal include calling Microsoft Purview REST APIs to perform write operations.

Captured activity history includes actions in the Microsoft Purview governance portal and outside the portal. Audit and diagnostics information consists of the timestamped history of actions taken and changes made to a Microsoft Purview account by every user. This tutorial lists the step-by-step configuration required to enable and capture audit and diagnostics logs for applications in the Microsoft Purview governance portal via Azure Event Hubs.Ī Microsoft Purview administrator or Microsoft Purview data-source admin needs the ability to monitor audit and diagnostics logs captured from applications in the Microsoft Purview governance portal.