The azure-logs wodle calls the Azure Monitor and Microsoft Graph APIs to pull Activity logs, Entra ID Sign-in logs and Audit logs into Wazuh. You need an Azure AD App Registration with the right Graph permissions.
1. Register an Azure AD app
In Entra ID -> App registrations -> New registration. Create a client secret. Grant Microsoft Graph API permissions: AuditLog.Read.All, Directory.Read.All. Grant admin consent.
2. Configure the wodle
<wodle name="azure-logs">
<disabled>no</disabled>
<run_on_start>yes</run_on_start>
<graph>
<auth_path>/var/ossec/wodles/azure/azure_graph_auth</auth_path>
<tenantdomain>contoso.onmicrosoft.com</tenantdomain>
<request>
<tag>azure-ad-signins</tag>
<query>auditLogs/signIns</query>
<time_offset>1d</time_offset>
</request>
</graph>
</wodle>3. Store credentials
cat > /var/ossec/wodles/azure/azure_graph_auth <<EOF
application_id = <APP_ID>
application_key = <CLIENT_SECRET>
EOF
chmod 600 /var/ossec/wodles/azure/azure_graph_auth4. Restart the manager
systemctl restart wazuh-managerNote: Built-in rules in the azure group decode sign-in events and surface risky sign-ins, impossible travel and disabled-account logins.
We onboard Microsoft 365 + Entra ID + Defender into Wazuh, contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhAzureEntra IDCloud