Azure metrics integration

This feature isn’t available to all Palo Alto Networks Cortex XCOR users and might not be visible in your app. For information about enabling this feature in your environment, contact Cortex XCOR Support.

Azure metrics integration connects Palo Alto Networks Cortex XCOR with Azure Monitor to ingest metrics.

Create the Azure principal

Configure Azure to allow Cortex XCOR to access metrics in Azure. To do so:

Ensure the Azure Managed Identity principal is assigned the built-in Reader role for every subscription within scope. The Reader role is more restrictive than the MonitoringReader role. It’s important to create a dedicated Managed Identity to isolate the Azure API quota used by Cortex XCOR.
Contact Cortex XCOR Support to obtain the specific credential_issuer and credential_subject for your tenant.
Copy both the credential_issuer and credential_subject variables exactly as specified to allow authentication between your Cortex XCOR tenant and Azure.
When creating the Azure principal, grant it access to subscriptions using one of the following options:
- Management group-based: Access can be granted at the Azure Management Group level. This is the preferred approach, as it means that the subscriptions that Cortex XCOR has access to are kept in sync with the management group. As subscriptions are added and removed from the management group, these changes will be automatically reflected in Cortex XCOR. The same principal can also be granted access to multiple management groups.
- Subscription-based: Access can be granted at the subscription level. In this case, the principal is granted access to individual subscriptions. This approach provides the most control, but has the downside that the list of subscriptions granted to the principal must be kept up to date by the customer. Cortex XCOR won’t be able to ingest Azure metric data for subscriptions that haven’t been assigned to the principal.
After provisioning the Azure Managed Identity, provide Palo Alto Networks with the two Terraform outputs defined in the following examples: azure_tenant_id and identity_client_id. These outputs specify the ID of your Azure tenant and the client ID of the Azure Managed Identity, respectively. Cortex XCOR requires both values to complete the integration.

Terraform examples

The following examples show how you can integrate Azure using one of the previously mentioned methods:

Management group
Individual subscription

The following Terraform code provides an example of how to create an Azure principal and grant it access to the subscriptions within a management group.

Terraform example

################################################################################
## Azure Provider

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  subscription_id = var.subscription_id
  features {}
}

################################################################################
## Terraform Variables

variable "subscription_id" {
  type        = string
  description = "Azure subscription ID in which to create resources"
}

variable "location" {
  type        = string
  description = "Location in which to create resources"
  default     = "eastus"
}

variable "resource_group_name" {
  type        = string
  description = "Name of the existing resource group to create resources in"
}

variable "management_group_id" {
  type        = string
  description = "Management group to be integrated with Cortex XCOR"
  default     = "production-group"
}

variable "principal_name" {
  type        = string
  description = "Name of the Azure principal managed identity"
  default     = "chronosphere-integration"
}

variable "credential_issuer" {
  type        = string
  description = "Federated identity credential issuer"
  default     = "https://accounts.google.com"
}

variable "credential_subject" {
  type        = string
  description = "Unique ID of your tenant-specific GCP service account"
  default     = "123456789123456789"
}

################################################################################
## Azure Resources

data "azurerm_management_group" "this" {
  name = var.management_group_id
}

resource "azurerm_user_assigned_identity" "chronosphere" {
  name                = var.principal_name
  location            = var.location
  resource_group_name = var.resource_group_name
}

# Assign the principal the Reader role on all subscriptions in the management group.
resource "azurerm_role_assignment" "chronosphere" {
  principal_id         = azurerm_user_assigned_identity.chronosphere.principal_id
  scope                = data.azurerm_management_group.this.id
  role_definition_name = "Reader"
}

resource "azurerm_federated_identity_credential" "chronosphere" {
  name                = var.principal_name
  issuer              = var.credential_issuer
  subject             = var.credential_subject
  resource_group_name = var.resource_group_name
  parent_id           = azurerm_user_assigned_identity.chronosphere.id
  audience            = ["api://AzureADTokenExchange"]
}

################################################################################
## Terraform Outputs

output "azure_tenant_id" {
  value = azurerm_user_assigned_identity.chronosphere.tenant_id
}

output "identity_client_id" {
  value = azurerm_user_assigned_identity.chronosphere.client_id
}

The following Terraform code provides an example of how to create an Azure principal and grant it access to individual subscriptions. In this example, read access is granted to all accessible subscriptions.

Terraform example

################################################################################
## Azure Provider

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  subscription_id = var.subscription_id
  features {}
}

################################################################################
## Terraform Variables

variable "subscription_id" {
  type        = string
  description = "Azure subscription ID in which to create resources"
}

variable "location" {
  type        = string
  description = "Location in which to create resources"
  default     = "eastus"
}

variable "resource_group_name" {
  type        = string
  description = "Name of the existing resource group to create resources in"
}

variable "principal_name" {
  type        = string
  description = "Name of the Azure principal managed identity"
  default     = "chronosphere-integration"
}

variable "credential_issuer" {
  type        = string
  description = "Federated identity credential issuer"
  default     = "https://accounts.google.com"
}

variable "credential_subject" {
  type        = string
  description = "Unique ID of your tenant-specific GCP service account"
  default     = "123456789123456789"
}

################################################################################
## Azure Resources

data "azurerm_subscriptions" "all" {}

resource "azurerm_user_assigned_identity" "chronosphere" {
  name                = var.principal_name
  location            = var.location
  resource_group_name = var.resource_group_name
}

# Assign the principal the Reader role on each subscription.
resource "azurerm_role_assignment" "chronosphere" {
  for_each             = toset(data.azurerm_subscriptions.all.subscriptions[*].id)
  principal_id         = azurerm_user_assigned_identity.chronosphere.principal_id
  scope                = each.key
  role_definition_name = "Reader"
}

resource "azurerm_federated_identity_credential" "chronosphere" {
  name                = var.principal_name
  issuer              = var.credential_issuer
  subject             = var.credential_subject
  resource_group_name = var.resource_group_name
  parent_id           = azurerm_user_assigned_identity.chronosphere.id
  audience            = ["api://AzureADTokenExchange"]
}

################################################################################
## Terraform Outputs

output "azure_tenant_id" {
  value = azurerm_user_assigned_identity.chronosphere.tenant_id
}

output "identity_client_id" {
  value = azurerm_user_assigned_identity.chronosphere.client_id
}

Set up Cortex XCOR to receive Azure data

After configuring Azure to enable access to metrics, you must configure Cortex XCOR to receive and process those metrics. To access the Cortex XCOR API directly, see the Cortex XCOR API for Azure metrics.

View Azure metrics integrations

To list or view Azure metrics integrations, use one of the following options:

Chronoctl
API

To list your Azure metrics integrations using Chronoctl, use this command:

chronoctl azure-metrics-integrations list

To view a Azure metrics integration, use this command:

chronoctl azure-metrics-integrations read SLUG

Replace SLUG with the unique identifier of the Azure metrics integration.

To list Azure metrics integrations with the Cortex XCOR API, use the ListAzureMetricsIntegrations endpoint.To view a single Azure metrics integration with the Cortex XCOR API, use the ReadAzureMetricsIntegration endpoint.Because the Cortex XCOR API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Cortex XCOR instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Create or update an Azure metrics integration

You can create or update your Azure metrics integration with Cortex XCOR by applying a configuration file with Chronoctl or Terraform. You must add your account principal to a Cortex XCOR team with SysAdmin permissions.

Chronoctl
Terraform
API

To create a Azure metrics integration using Chronoctl, use this command:

chronoctl azure-metrics-integrations create --filename FILENAME

Replace FILENAME with the name of your Chronoctl configuration file.To update a Azure metrics integration, use this command:

chronoctl azure-metrics-integrations update --filename FILENAME

Replace FILENAME with the name of your Chronoctl configuration file.The input file uses the following structure:

Chronoctl example

api_version: v1/config
kind: AzureMetricsIntegration
spec:
  name: NAME
  slug: SLUG
  principal:
    tenant_id: TENANT_ID
    client_id: CLIENT_ID
  scrape_config:
    resource_types:
      - name: RESOURCE_TYPE_NAME
        metric_names:
          - METRIC_NAME
    locations:
      - LOCATION
    subscription_ids:
      - SUBSCRIPTION_ID
  usage_metrics_enabled: USAGE_METRICS_ENABLED
  count_metrics_enabled: COUNT_METRICS_ENABLED
  propagate_tags: PROPAGATE_TAGS

To create a Azure integration with Terraform, use the chronosphere_azure_metrics_integration resource:

Terraform example

resource "chronosphere_azure_metrics_integration" "chronosphere_azure_metrics" {
  name = "Azure Metrics"
  slug = "azure-metrics"
  principal {
    tenant_id = TENANT_ID
    client_id = CLIENT_ID
  }
  scrape_config {
    resource_type {
      name = RESOURCE_TYPE_NAME
      metric_names = [METRIC_NAME]
    }

    locations = [LOCATION]
    subscription_ids = [SUBSCRIPTION_ID]
  }

  usage_metrics_enabled = USAGE_METRICS_ENABLED
  count_metrics_enabled = COUNT_METRICS_ENABLED
  propagate_tags = PROPAGATE_TAGS
}

To create Azure integrations with the Cortex XCOR API, use the CreateAzureMetricsIntegration endpoint.To update a single Azure integration with the Cortex XCOR API, use the UpdateAzureMetricsIntegration endpoint.Because the Cortex XCOR API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Cortex XCOR instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Replace the following:

NAME: (string) The name of the Azure integration.
SLUG: (string) The unique identifier of the Azure integration.
TENANT_ID: (UUID) The ID of the Azure tenant that hosts the managed identity principal.
CLIENT_ID: (UUID) The OAuth 2.0 client ID of the managed identity principal.
RESOURCE_TYPE_NAME: (string) Name of the resource type.
METRIC_NAME: (list(string)) List of metric names to be targeted. These apply to this resource type. Leave unset to retrieve all metrics.
LOCATION: (list(string)) Locations to be ingested for this integration. Applies to all subscriptions. Leave unset to retrieve all locations.
SUBSCRIPTION_ID: (list(string)) Subscriptions to be targeted for this integration. Leave unset to retrieve all subscriptions.
USAGE_METRICS_ENABLED: (Boolean) Enables collection of azure usage metrics under this principal (Microsoft.Compute, Microsoft.Network, Microsoft.Storage).
COUNT_METRICS_ENABLED: (Boolean) Enables Azure count metrics for the configured resources.
PROPAGATE_TAGS: (Boolean) Specifies whether Azure resource, group, and subscription tags should be propagated as metric labels.

Delete an Azure integration

Delete an Azure integration using one of the following methods:

Chronoctl
API

Your account must have SysAdmin permissions to complete this action.To delete an Azure integration using Chronoctl, use this command:Use the command:

chronoctl azure-metrics-integrations delete SLUG

Replace SLUG with the unique identifier of the Azure metrics integration.

To complete this action with the Cortex XCOR API, use the DeleteAzureMetricsIntegration endpoint.Because the Cortex XCOR API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Cortex XCOR instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Metric information

Cortex XCOR ingests a wide range of Azure metrics. See the list of available Azure metrics.

Metrics availability

Azure metrics are displayed in Cortex XCOR with a several minute delay from their timestamps in Azure. On average, delays range anywhere from five minutes for most metrics to 10 minutes for very high cardinality metrics. These delays are caused by a number of factors external to Cortex XCOR, including each metric’s scrape interval and latency within Azure. To accommodate these delays, use the PromQL offset modifier to add offsets to your monitors. Additionally, delays can impact aggregation rules, and it might not be possible to aggregate metrics with particularly long delays.

Metric labels

You can request custom labels for your Azure metrics as defaultLabels. To add custom labels, contact Cortex XCOR Support. When importing metrics, some defaultLabels might conflict with prefixes which already exist in Cortex XCOR (for example, job). When this occurs, Cortex XCOR adds the prefix exported_ to the source labels to prevent conflicts.

Find Azure metrics in Metrics Explorer

Use Metrics Explorer to find and review the status of your ingested metrics.

All Azure metrics start with the prefix azure_. Search for this prefix to display all Azure metrics in the platform.
Search supports substrings. For example, if the original Azure metric name contains a substring like storageAccounts, searching for the substring returns the Azure metric, along with other metrics containing the substring.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Create the Azure principal

Terraform examples

Set up Cortex XCOR to receive Azure data

View Azure metrics integrations

Create or update an Azure metrics integration

Delete an Azure integration

Metric information

Metrics availability

Metric labels

Find Azure metrics in Metrics Explorer

​Create the Azure principal

​Terraform examples

​Set up Cortex XCOR to receive Azure data

​View Azure metrics integrations

​Create or update an Azure metrics integration

​Delete an Azure integration

​Metric information

​Metrics availability

​Metric labels

​Find Azure metrics in Metrics Explorer

Create the Azure principal

Terraform examples

Set up Cortex XCOR to receive Azure data

View Azure metrics integrations

Create or update an Azure metrics integration

Delete an Azure integration

Metric information

Metrics availability

Metric labels

Find Azure metrics in Metrics Explorer