HCP Vault Dedicated now offers a Terraform‑driven pipeline that captures its generic HTTP audit sink, reshapes the JSON payload, and writes the events into a custom Log Analytics table (HCPVaultAudit_CL). The table can be onboarded to Microsoft Sentinel, giving engineers a repeatable path to correlate Vault activity with the rest of their Azure telemetry.
Why Stream Vault Audit Logs to Sentinel
Vault audit records contain request paths, operations, results, source IPs and, when available, the authenticated principal. Correlating these events with sign‑in logs, network alerts, or other telemetry in Sentinel enables faster detection of suspicious secret accesses. A dedicated Log Analytics table with named columns (e.g., operation, path, authDisplayName, clientIp) removes the need to parse raw JSON in every query, simplifying KQL and alert rule authoring.
Architecture and Data Flow
The end‑to‑end flow is:
- Vault Dedicated’s generic HTTP sink posts a JSON array of audit events to an Azure Function endpoint.
- The Function iterates the array, flattens each event into a fixed set of fields, and forwards the batch to the Azure Monitor Logs Ingestion API.
- The Ingestion API authenticates using a managed identity that holds the Monitoring Metrics Publisher role on a Data Collection Rule (DCR).
- A Data Collection Endpoint (DCE) backs the DCR, providing the ingestion URL.
- The DCR writes the transformed rows into the custom Log Analytics table
HCPVaultAudit_CL. - If the workspace is attached to Microsoft Sentinel, the table becomes available for hunting queries, analytics rules, and workbooks.
Direct‑kind DCRs can expose a public ingestion endpoint, eliminating the need for a separate DCE, but the provided Terraform module uses the DCE‑backed pattern.
Deploying the Terraform Pipeline
The companion Terraform repository provisions the following Azure resources:
- An Azure Function App that hosts the HTTP adapter.
- A managed identity for the Function, granted the Monitoring Metrics Publisher role on the DCR.
- A Data Collection Endpoint and a Data Collection Rule bound to it.
- A Log Analytics workspace and the custom table
HCPVaultAudit_CL.
Running terraform apply creates the entire ingestion path without manual resource creation. After deployment, the only remaining step is to configure the HCP Vault portal to point the generic HTTP sink at the Function’s URL and select JSON encoding.
Operational and Security Considerations
Because the HTTP sink cannot authenticate to Azure Monitor directly, the Function acts as a trusted bridge using a managed identity. Practitioners should verify that the identity’s role assignment is limited to the specific DCR to avoid over‑privilege. The DCE does not automatically provide Private Link isolation; additional Private Link Scope, private endpoints, DNS configuration, and routing must be added if network isolation is required.
Audit events may contain HMAC‑masked values or missing identity fields for unauthenticated requests. Consumers of the custom table must handle optional or redacted fields in their queries and alert logic.
Related CloudNinjas coverage: DevOps.
What This Means For Practitioners
Deploying the Terraform module gives a repeatable, managed way to feed Vault audit logs into Azure’s SIEM stack, eliminating ad‑hoc scripts and reducing operational overhead. Teams should assess role scope, consider Private Link requirements, and validate that their Sentinel analytics rules reference the new HCPVaultAudit_CL fields. Ongoing monitoring of the Function’s health and the DCR ingestion status will ensure continuous visibility into secret‑access activity.