Ingesting .CSV log files from Azure Blob Storage into Microsoft Sentinel

Overview:

Organizations generate vast amounts of log data from various applications, services, and systems. These logs are often stored in .CSV (Comma-Separated Values) format in Azure Blob Storage, a scalable cloud-based storage solution. To enhance security monitoring, compliance, and threat detection, it is important to bring this log data into a centralized security tool like Microsoft Sentinel.
The main goal is to automatically collect and analyze .CSV log files stored in Azure Blob Storage using Sentinel’s advanced analytics and automation capabilities. This enables better visibility into security events and helps in proactive threat management.

 

Benefits: 

1. Flexible Log Ingestion via logic app: Allows ingestion of logs from systems without built-in Sentinel connectors, including custom, third-party, or legacy systems.
2. Uses Existing Storage Workflows: Reuses Azure Blob Storage where logs are already being saved, with no need to change current export methods.
3. Structured and Clean Data Format: .CSV files offer a structured format that makes mapping and parsing data into Sentinel efficient and reliable.
4. Enables Custom Analysis: Once in Sentinel, the data can be queried using Kusto Query Language (KQL) for in-depth analysis and reporting.
5. Operational Efficiency: Reduces manual efforts in collecting, uploading, or processing logs. Saves time for IT and security teams by automating the data pipeline.
6. Improves Threat Visibility: Ingested data is available in real-time. Dashboards and visualizations make it easy to understand what's happening.

 

Pre-requisites: 

1. Log Analytics Workspace

• • A configured workspace to receive and analyze the ingested data.

2. Blob Storage Path

• • The exact location in Azure Blob Storage where the CSV log files are stored.

3. Required Roles and Permissions

• • Microsoft Sentinel Contributor– to manage Sentinel resources.
  • Logic App Contributor– to create and manage automation workflows.
  • Access to the Storage Account– to read and retrieve log files from Blob Storage.

 

Implementation Steps: 

1. Configure the Logic App trigger to run whenever a new blob is added or an existing one is modified.

 

 

2. Select the storage account and container details, then configure the recurrence based on how frequently data is uploaded to the storage account.

         

 

3. Choose the authentication type to connect with storage account.

     

 

4. CSV Retrieval: Use the Logic App action to retrieve the CSV blob content by specifying the exact file path of the container.

 

 

 

5. CSV Parsing: Use built-in Logic App actions along with regex to parse the CSV content. Apply the Composeaction to split the file contents by new lines, converting them into an array for structured processing.
   • Here is the expression used in SplitLines compose action: split(body('Get_blob_content_(V2)'),decodeUriComponent('%0D%0A'))
   • Follow the below MS Doc to write expressions:

 

 

6. Removing last(empty) line from previous output using another compose action as shown below,  take(outputs('SplitLines'),add(length(outputs('SplitLines')),-1))

 

 

7. Separating field names using compose action: split(first(outputs('SplitLines')), ',')

 

 

8. Column Mapping: Repeat the required expression using the Select action to map each column from the CSV file to its corresponding field in the structured output. **From**: **`skip(outputs('RemoveLastLine'), 1)`**

          **Map:**

          **`outputs('SplitFieldName')[0]`** **`split(item(), ',')?[0]`**

          **`outputs('SplitFieldName')[1]`** **`split(item(), ',')?[1]`**

 

 

 

9. Data Ingestion to Sentinel: Leveraging the Microsoft Sentinel connector to ingest the parsed data into the appropriate table. The connection to be configured using the workspace ID, shared key, and target table name.

 

 

 

 

Key Highlights:

• The Logic App is triggered whenever a file is added or modified in the Blob container.
• The CSV content is parsed within the Logic App before being ingested into Sentinel.
• Leveraged the Microsoft Sentinel connector to ingest the parsed data into Sentinel.
• To support dynamic updates, we recommended overwriting the existing CSV file in the storage account.

 

Outcome:

Log Visibility in Sentinel Workspace: Once the Logic App is triggered, the custom table will be created automatically in Microsoft Sentinel, and logs can be viewed by running a KQL query in the Sentinel workspace.

 

 

Conclusion:

Ingesting .CSV log files from Azure Blob Storage into Microsoft Sentinel is a powerful way to centralize and automate the organization’s security monitoring. It enhances visibility, supports compliance, and empowers security teams with timely insights and alerts.