Recommended configuration for Azure Log analytics agent introduces significant security risk

Nigmenog 0 Reputation points
2024-07-03T21:58:57.1533333+00:00

I'm reviewing the documentation for the Azure Log Analytics Agent and I noticed something interesting. It states that one should disable HTTPS inspection for *.blob.core.windows.net . Disabling HTTPS inspection for all of Azure Blob storage introduces a significant security risk since anyone on the internet can host their own blob and put whatever files they want in Azure. Many adversaries leverage legitimate cloud services like Azure to host malicious content due to their established reputations which makes them inherently risky, but disabling HTTPS inspection increases that risk significantly because then network based preventative measures like next-gen firewalls are no longer able to inspect the traffic for threats.

Is Microsoft going to update this guidance, or is the Log Analytics Agent just going to be phased out in favor of the Azure Monitor Agent?

Reference: https://video2.skills-academy.com/en-us/azure/azure-monitor/agents/log-analytics-agent#firewall-requirements

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,971 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stanislav Zhelyazkov 21,936 Reputation points MVP
    2024-07-04T06:27:38.8666667+00:00

    Hi,

    Log Analytics agent is already phased out in favor of Azure Monitor Agent. You have until 31st of August to migrate. I would suggest start using Azure Monitor agent.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments
  2. Pinaki Ghatak 2,795 Reputation points Microsoft Employee
    2024-07-04T14:01:01.27+00:00

    Hello @Nigmenog

    Your concerns about the security implications of disabling HTTPS inspection for *.blob.core.windows.net are valid. Microsoft is aware of the importance of data security and has implemented measures to ensure the security of data in transit to Azure Monitor.

    We strongly encourage configuring the agent to use at least Transport Layer Security (TLS) 1.3.

    Older versions of TLS/Secure Sockets Layer (SSL) have been found to be vulnerable and while they still currently work to allow backwards compatibility, they are not recommended.

    As for the future of the Log Analytics Agent, we (Microsoft) have announced that it will be retired on August 31, 2024.

    The Azure Monitor Agent (AMA) will replace it. The AMA collects monitoring data from the guest operating system of Azure and hybrid virtual machines and delivers it to Azure Monitor for use by features, insights, and other services.

    It provides new features and capabilities, including centralized configuration for multiple VMs, data limits and filters at the source, and multiple destinations for data from a single agent.

    Therefore, it’s recommended to start migrating to the Azure Monitor Agent before the retirement date of the Log Analytics Agent. This should help address your concerns about the security risk associated with the current configuration of the Log Analytics Agent.

    I hope that this response has addressed your query and helped you overcome your challenges. If so, please mark this response as Answered. This will not only acknowledge our efforts, but also assist other community members who may be looking for similar solutions.

    0 comments