The agent must be run on a server / component that allows HTTPS connections and node.js.
The agent will pull a selected Azure Event Hub for events coming from Azure AD (logins and audits), and it will also pull administrative and security events coming from Azure Monitor.
In Azure AD, go to "Diagnostic Settings", select "Add diagnostic setting" and select your Event Hub. Choose which events you want to be sent.
In Azure Monitor, go to "Activity log", select "Diagnostic settings" and choose which events you want to be sent.
- The agent uses ports 80 / 443 (HTTP / HTTPS)
- Install Node.js (https://nodejs.org/en/download/package-manager/)
- Install package for Event Hubs from Microsoft from command prompt
- "npm install @azure/event-hubs"
- "npm install @azure/storage-blob"
- "npm install @azure/eventhubs-checkpointstore-blob"
- Install package for Unirest HTTP libraries
- "npm install unirest"
- Download the agent from our agent download page
- If you have not already created an AIMS environment, please see this article before proceeding
Configure the Agent
- AIMS connection config
- Go to the directory where you have the agent files and open the config file "aims_config.json"
- Find your AIMS connection and environment information. This can be found by logging into AIMS, select the "gear" icon top right and select "Agents". Copy the GUID from "Environment API address"
- In the "aims_config.json" find the section "aimsConnection/environmentId". Replace the example GUID with the GUID found in your API address
- To aquire your auth token, use basic auth and do a GET to https://api.aimsinnovation.com/api/system by using a HTTP client or similar. Copy the token from the "Autorization: Basic" section to "aimsConnection/authToken" in "aims_config.json"
- Azure connection config
- You will need a storage account, a blob container in that storage account and an Event Hub
- Get the connection string to the Event Hub, and copy it into "aims_config.json" under "Azure/connectionString"
- Copy the Event Hub name to "aims_config.json" under "Azure/eventHubName"
- Copy the consumer group (default is "$Default") to "aims_config.json" under "Azure/consumerGroup"
- Get the connection string to the storage account, and copy it into "aims_config.json" under "Azure/storageConnectionString"
- Get the container name and copy to "aims_config.json" under "Azure/containerName"
- Register the agent in AIMS
- Once the "aims_config.json" is complete, run "node register_agent.js" to connect the agent to AIMS.
- The registration returns a system ID (xsystem) that you will insert to the "aims_config.json" under "aimsConnection/xSystem". This is needed to run the agent.
Final Setup and Start Agent
Based on your selected way of running the agent (Linux, Windows etc and VM / cloud) there are different ways of starting and running the agent. Below are a couple of examples:
- Run the script from cli by typing "node eventhub.js". This will run the agent until it is stopped manually or by a server restart / shutdown
- Windows - If your want to run it from a Windows Server, we recommend that you run the agent as a service. For more information see this example on GitHub
- Linux - use systemd explained on Stack Overflow