[azure_blob_storage, azure_network_watcher_nsg, azure_network_watcher_vnet, symantec_enpoint_security] Add RBAC Based Auth for Azure Blob Storage Input #14396

mohitjha-elastic · 2025-07-02T07:40:37Z

Proposed commit message

azure_blob_storage,azure_network_watcher_nsg,azure_network_watcher_vnet,symantec_enpoint_security: add RBAC-based authentication for azure blob storage input

Implemented RBAC-based authentication support for the azure blob storage
input across the following packages: azure_blob_storage,
azure_network_watcher_nsg, azure_network_watcher_vnet, and
symantec_endpoint_security. This enhancement enables secure data
collection using azure active directory RBAC credentials instead of
access keys.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/<integration_name> directory.
Run the following command to run tests.

elastic-package test -v

NOTE: Replace the <integration_name> with the actual one.

Related Issue

Closes [integrations] - Update Azure Blob Storage Input template options with support RBAC based authentication. #14198

elasticmachine · 2025-07-02T07:40:42Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

elastic-vault-github-plugin-prod · 2025-07-02T08:09:20Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

packages/symantec_endpoint_security/changelog.yml

packages/symantec_endpoint_security/_dev/build/docs/README.md

mohitjha-elastic · 2025-07-02T10:55:18Z

Here are the recording:

Azure-NSG.Recording.2025-06-18.124349.mp4

Azure-vnet.Recording.2025-06-18.134731.mp4

SES.Recording.2025-06-18.140523.mp4

ABS.Recording.mp4

packages/symantec_endpoint_security/_dev/build/docs/README.md

kcreddy

nits.

kcreddy · 2025-07-03T12:00:27Z

packages/azure_network_watcher_nsg/_dev/build/docs/README.md


-**Note**:  Enable virtual network flow logs using the steps provided in [reference](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-portal).
+- How to setup the `auth.oauth2` credentials can be found in the Azure documentation https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app[here]


@mohitjha-elastic, the link doesn't render. Please check.
Could be due to presence of [here] in the suffix.

kcreddy · 2025-07-03T12:05:45Z

packages/azure_network_watcher_nsg/_dev/build/docs/README.md

@@ -21,8 +21,15 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
 3. Click on **Show** keys to show your **access keys** and **connection strings** and to enable buttons to copy the values.
 4. Under key1, find the Key value. Click on the Copy button to copy the **account key**. Same way you can copy the **storage account name** shown above keys.
 5. Go to **Containers** under **Data storage** in your storage account to copy the **container name**.
+6. Configure the integration using either Service Account Credentials or Microsoft Entra ID RBAC with OAuth2 options.For OAuth2 (Entra ID RBAC), you'll need the Client ID, Client Secret, and Tenant ID. For Service Account Credentials, you'll need either the Service Account Key or the URI to access the data.


Suggested change

6. Configure the integration using either Service Account Credentials or Microsoft Entra ID RBAC with OAuth2 options.For OAuth2 (Entra ID RBAC), you'll need the Client ID, Client Secret, and Tenant ID. For Service Account Credentials, you'll need either the Service Account Key or the URI to access the data.

6. Configure the integration using either Service Account Credentials or Microsoft Entra ID RBAC with OAuth2 options. For OAuth2 (Entra ID RBAC), you'll need the Client ID, Client Secret, and Tenant ID. For Service Account Credentials, you'll need either the Service Account Key or the URI to access the data.

kcreddy · 2025-07-03T12:06:47Z

packages/azure_network_watcher_nsg/_dev/build/docs/README.md


-**Note**:  Enable virtual network flow logs using the steps provided in [reference](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-portal).
+- How to setup the `auth.oauth2` credentials can be found in the Azure documentation https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app[here]
+- For more details about the Azure Blob Storage input settings, check the  [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html).


Suggested change

- For more details about the Azure Blob Storage input settings, check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html).

- For more details about the Azure Blob Storage input settings, check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html).

kcreddy · 2025-07-03T12:08:50Z

packages/azure_network_watcher_nsg/_dev/build/docs/README.md

+Note:
+- Enable virtual network flow logs using the steps provided in [reference](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-portal).
+- The service principal must be granted the appropriate permissions to read blobs. Ensure that the necessary role assignments are in place for the service principal to access the storage resources. For more information, please refer to the [Azure Role-Based Access Control (RBAC) documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage).
+- We recommend assigning either the Storage Blob Data Reader or BlobOwner role. The Storage Blob Data Reader role provides read-only access to blob data and is aligned with the principle of least privilege, making it suitable for most use cases. The Storage Blob Data Owner role grants full administrative access — including read, write, and delete permissions — and should be used only when such elevated access is explicitly required.


Suggested change

- We recommend assigning either the Storage Blob Data Reader or BlobOwner role. The Storage Blob Data Reader role provides read-only access to blob data and is aligned with the principle of least privilege, making it suitable for most use cases. The Storage Blob Data Owner role grants full administrative access — including read, write, and delete permissions — and should be used only when such elevated access is explicitly required.

- We recommend assigning either the **Storage Blob Data Reader** or **Storage Blob Data Owner** role. The **Storage Blob Data Reader** role provides read-only access to blob data and is aligned with the principle of least privilege, making it suitable for most use cases. The **Storage Blob Data Owner** role grants full administrative access — including read, write, and delete permissions — and should be used only when such elevated access is explicitly required.

kcreddy

LGTM for my comments.

elasticmachine · 2025-07-03T13:02:07Z

💚 Build Succeeded

Buildkite Build
Commit: a5e7a27

History

💚 Build #28041 succeeded 3e3564b
💚 Build #27975 succeeded 0fa50ed
💚 Build #27974 succeeded 7dccd89
💚 Build #27961 succeeded 7f00a1a

cc @mohitjha-elastic

elastic-sonarqube · 2025-07-03T13:02:11Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

ShourieG

LGTM

elastic-vault-github-plugin-prod · 2025-07-04T09:43:47Z

Package azure_blob_storage - 2.3.0 containing this change is available at https://epr.elastic.co/package/azure_blob_storage/2.3.0/

elastic-vault-github-plugin-prod · 2025-07-04T09:43:48Z

Package azure_network_watcher_nsg - 1.5.0 containing this change is available at https://epr.elastic.co/package/azure_network_watcher_nsg/1.5.0/

elastic-vault-github-plugin-prod · 2025-07-04T09:43:49Z

Package azure_network_watcher_vnet - 1.6.0 containing this change is available at https://epr.elastic.co/package/azure_network_watcher_vnet/1.6.0/

elastic-vault-github-plugin-prod · 2025-07-04T09:43:50Z

Package symantec_endpoint_security - 1.13.0 containing this change is available at https://epr.elastic.co/package/symantec_endpoint_security/1.13.0/

Add RBAC based auth for azure blob storage input.

237a634

mohitjha-elastic self-assigned this Jul 2, 2025

mohitjha-elastic requested a review from a team as a code owner July 2, 2025 07:40

Update changelog entry

7f00a1a

ShourieG reviewed Jul 2, 2025

View reviewed changes

packages/symantec_endpoint_security/changelog.yml Outdated Show resolved Hide resolved

ShourieG reviewed Jul 2, 2025

View reviewed changes

packages/symantec_endpoint_security/_dev/build/docs/README.md Outdated Show resolved Hide resolved

Reverted the sync issue changes.

7dccd89

mohitjha-elastic requested a review from ShourieG July 2, 2025 10:51

ShourieG added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 2, 2025

ShourieG reviewed Jul 2, 2025

View reviewed changes

packages/symantec_endpoint_security/_dev/build/docs/README.md Outdated Show resolved Hide resolved

Correct spacing in readme

0fa50ed

mohitjha-elastic requested a review from ShourieG July 2, 2025 11:24

kcreddy reviewed Jul 2, 2025

View reviewed changes

packages/symantec_endpoint_security/_dev/build/docs/README.md Outdated Show resolved Hide resolved

Update readme of azure packages.

3e3564b

mohitjha-elastic requested a review from kcreddy July 3, 2025 10:43

kcreddy reviewed Jul 3, 2025

View reviewed changes

Formatted readme of the integrations.

a5e7a27

mohitjha-elastic requested a review from kcreddy July 3, 2025 12:34

kcreddy approved these changes Jul 3, 2025

View reviewed changes

ShourieG approved these changes Jul 4, 2025

View reviewed changes

mohitjha-elastic merged commit ea221ca into elastic:main Jul 4, 2025
7 checks passed

mohitjha-elastic deleted the add-rbac-oauth2-in-azure-blob-storage branch July 4, 2025 09:10


		Note: Enable virtual network flow logs using the steps provided in [reference](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-portal).
		- How to setup the `auth.oauth2` credentials can be found in the Azure documentation https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app[here]

	6. Configure the integration using either Service Account Credentials or Microsoft Entra ID RBAC with OAuth2 options.For OAuth2 (Entra ID RBAC), you'll need the Client ID, Client Secret, and Tenant ID. For Service Account Credentials, you'll need either the Service Account Key or the URI to access the data.
	6. Configure the integration using either Service Account Credentials or Microsoft Entra ID RBAC with OAuth2 options. For OAuth2 (Entra ID RBAC), you'll need the Client ID, Client Secret, and Tenant ID. For Service Account Credentials, you'll need either the Service Account Key or the URI to access the data.

	- For more details about the Azure Blob Storage input settings, check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html).
	- For more details about the Azure Blob Storage input settings, check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html).

[azure_blob_storage, azure_network_watcher_nsg, azure_network_watcher_vnet, symantec_enpoint_security] Add RBAC Based Auth for Azure Blob Storage Input #14396

[azure_blob_storage, azure_network_watcher_nsg, azure_network_watcher_vnet, symantec_enpoint_security] Add RBAC Based Auth for Azure Blob Storage Input #14396

Uh oh!

Conversation

mohitjha-elastic commented Jul 2, 2025 • edited by efd6 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related Issue

Uh oh!

elasticmachine commented Jul 2, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 2, 2025

🚀 Benchmarks report

Uh oh!

Uh oh!

Uh oh!

mohitjha-elastic commented Jul 2, 2025

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

kcreddy Jul 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kcreddy Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

kcreddy Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

kcreddy Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jul 3, 2025

💚 Build Succeeded

History

Uh oh!

elastic-sonarqube bot commented Jul 3, 2025

Quality Gate passed

Uh oh!

ShourieG left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 4, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 4, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 4, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 4, 2025

Uh oh!

Uh oh!

mohitjha-elastic commented Jul 2, 2025 •

edited by efd6

Loading

kcreddy Jul 3, 2025 •

edited

Loading