Azure Activity Logs OpenTelemetry Assets
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Preview
Preview
Serverless Security
Preview
Preview
Stack
Preview
9.3+
Preview since 9.3
| Version | 0.2.0 Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Elastic |
| Minimum Kibana version(s) | 9.3.0 |
To use pre-release integrations, go to the Integrations page in Kibana, scroll down, and toggle on the Display beta integrations option.
Azure Activity Logs provide a platform-level audit trail for Azure Resource Manager control plane operations, including resource creation, modification, deletion, and service health events.
This content pack provides dashboards, alert rules, and SLO templates for Azure Activity Logs collected via OpenTelemetry. It covers administrative operations, platform health signals, and security-sensitive actions.
The Azure Activity Logs OpenTelemetry assets work with Azure Activity Log data forwarded through the EDOT Cloud Forwarder (ECF) for Azure using the azureactivitylogs encoding extension.
You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
No service-side configuration is required. Azure Activity Logs are available by default for all Azure subscriptions.
Refer to the ECF for Azure documentation for full setup instructions.
Refer to the azureactivitylogs encoding extension documentation for details on the data produced by this encoding extension.
| Dashboard | Description |
|---|---|
| [Azure Activity Logs OTel] Overview | Platform-level audit logs for Azure Resource Manager control plane operations. Monitor operation volume, verb-level breakdown, failure rates, resource provider activity, top callers by identity, and sensitive operations. |
| [Azure Activity Logs OTel] Administrative Operations | Administrative Activity Log events: control plane CRUD operations, failures, operation duration, and mutation rates. Identify failed deployments and permission issues. |
| [Azure Activity Logs OTel] Platform Health | Azure platform health signals: ServiceHealth incidents, ResourceHealth status, and Advisor recommendations. Monitor external reliability factors. |
| Alert | Trigger | Severity |
|---|---|---|
| [Azure Activity OTel] Change storm (high mutation rate) | Spike in WRITE/DELETE/ACTION operations indicating a deployment storm or runaway automation | Warning |
| [Azure Activity OTel] Failed administrative operations | Administrative operations failing above normal threshold | Warning |
| [Azure Activity OTel] Resource health degradation | Resources transitioning to Unavailable or Degraded state | Warning |
| [Azure Activity OTel] Role assignment write (privilege escalation) | Role assignment changes detected, indicating potential privilege escalation | Warning |
| [Azure Activity OTel] Security events | Security-category events detected in the activity log | Warning |
| [Azure Activity OTel] Sensitive key access | Storage account listKeys or similar key-retrieval operations detected | Warning |
| [Azure Activity OTel] Service health incident | Azure ServiceHealth incident or outage affecting your subscription | Warning |
| SLO | Target | Window | Description |
|---|---|---|---|
| [Azure Activity Logs OTel] Administrative operation success rate | 99.5% | 30-day rolling | Tracks the success rate of Azure Resource Manager administrative operations, excluding in-progress Start/Started events. |
| [Azure Activity Logs OTel] Administrative operation latency | 99.5% | 30-day rolling | Tracks the average duration of Azure Resource Manager administrative operations, ensuring operation duration stays below 3 seconds. |
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 0.2.0 | Enhancement (View pull request) Add tags to Kibana assets |
9.3.0 |
| 0.1.1 | Bug fix (View pull request) Replace PNG logo with SVG |
9.3.0 |
| 0.1.0 | Enhancement (View pull request) First release of the Azure Activity Logs OpenTelemetry Assets. |
9.3.0 |