question

Zied-6472 avatar image
0 Votes"
Zied-6472 asked Zied-6472 commented

Workloads tags value masked into log events

Hello
We are using Azure logs into our QRadar SIEM solution.
Some security use cases are using tags value.
For some weeks, some workloads get their tags value masked into the logs (for example, now, the Network Security Groups tags have the following value:
,\"tags\":\"**\"
Some weeks ago, we were able to retrieve those values.

Questions:
1. Is this behaviour will be extended to all Azure workloads ?
2. Could you list the workloads that have today the same behaviour?
3. Is it possible to deactivate this behaviour from my environment?
4. How can I retrieve tags values from logs in order to get it used by my QRadar SIEM solution?

Thanks for your help



azure-monitor
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Are you able to share a screenshot of the behavior you are seeing?

0 Votes 0 ·
Zied-6472 avatar image Zied-6472 MarileeTurscak-MSFT ·

Hello,
Here is a sample:

129701-image.jpeg


0 Votes 0 ·
image.jpeg (121.9 KiB)

0 Answers