Azure Activity Logs: mapping entities for Davis Events

[michiel_otten]

I’m currently ingesting Azure Activity Logs through the native Azure integration into the platform. The logs are arriving correctly, but I’m trying to trigger events based on entities such as azure.subscription.

The challenge I’m running into is within OpenPipeline: I can’t seem to find or map a valid dt.source_entity value from the incoming Azure Activity logs. Currently my Davis Events all trigger against the environment.

What I’m trying to achieve is something along the lines of:

• Azure Activity Log arrives
• Extract/map the Azure Subscription entity
• Trigger events/workflows against that entity

Has anyone successfully implemented this mapping before?
If so:

• Which field did you map to dt.source_entity? (if possible)
• Are there any best practices for Azure Activity Log entity enrichment?

Any examples or guidance would be appreciated. Thanks!

[kayjayeff1]

When you say "Native Azure integration", are you talking about the Azure Log Forwarder?

[michiel_otten]

Hi,

Thanks for replying! 
This customer is using the Dynatrace Azure Native service:
https://docs.dynatrace.com/docs/ingest-from/microsoft-azure-services/azure-platform/azure-native-int...

So we are forwarding for example the activity logs:
https://docs.dynatrace.com/docs/ingest-from/microsoft-azure-services/azure-platform/azure-native-int...