cudeso / misp2sentinel

MISP to Sentinel integration
MIT License
52 stars 17 forks source link

Rather than file logging, should we log to custom LAW table for Azure Function? #82

Open jusso-dev opened 4 months ago

jusso-dev commented 4 months ago

Hey @cudeso I note that this solution logs request and response payload messages into a text file currently, my question is, should the Azure Function implement a logging class that logs messages to either application insights (deployed alongside the solution) or should it log to a custom Log Analytics Table, as this solution already fits into that eco-system of Azure and Log Analytics Workspaces?

lnfernux commented 4 months ago

If you add Application Insights when deploying the function you will have the run logs in Azure Monitor / Log Analytics. The function is written in a way that will show the runtime writes in the app traces if you need the details. So I think this is ok?

jusso-dev commented 4 months ago

Thanks @lnfernux so in saying that, should the code in the Function app that currently writes to a log file instead be changed to use the native "logging" library which yes indeed will log to Application Insights?

I know there is other discussions around how to have a single RequestManager and RequestObject that both the standalone script and the function use, so I do understand that this may be covered in that work as well.

lnfernux commented 4 months ago

I'm not sure you need to write to the file in the Azure Function, any errors will be covered by application insights and any specific runtime faults will be in the app traces.

jusso-dev commented 4 months ago

Yes agreed, that's what I'm saying. This code supports both main script invocation and function hence my question, can we remove the file writing in the function 😊