Appendix 2 - Adding additional locations or resources

Guidance for re-running deployment when you add regions, locations, or Vectra adds new supported resource types.

Vectra CDR for Azure supports the following Azure platform logs:

• Global Azure subscription activity Logs
• Resource logs for the following resource types:

  • Automation Account
  • Key Vault
  • Storage Accounts

    • These were added by Vectra after the initial availability of CDR for Azure. As per the below guidance, run the main deployment and remediation steps again to add ingestion for these if your original deployment did not include Storage Account ingestion.

As Vectra continually does security research, additional log types may be supported in the future. Running the ARM template deployment process is an idempotent process. The same steps can be run again in the future, and nothing will change with resources that Vectra has already deployed. Below you will find guidance for specific situations you may encounter.

Remediation of newly deployed supported resources

Situation:

• You are adding new resources to azure locations/regions that were covered during a previous deployment of Vectra CDR for Azure. These new resources also are of a type that was already supported by Vectra during a previous deployment of Vectra CDR for Azure.

Outcome:

• If you used the automated deployment:

  • The new resources are automatically made compliant by Azure because the policies that Vectra put in place apply to the supported resources in these locations/regions. No action needs to be taken by administrators.
• If you used the manual deployment:

  • You must ensure that logs for the new resources are being written to the storage accounts that were setup during deployment. You may be using Azure Policy to do this and if so, it might be automatic but do to the nature of manual deployment, Vectra cannot guarantee that the new resources are logging properly and CDR for Azure is ingesting their logs.

Adding newly supported resource types for log collection

Situation:

• Vectra has added new supported resource types to Vectra CDR for Azure, and you want to make sure that these new resource types are covered by Vectra CDR for Azure.

Required Action:

• If you used the automated deployment:

  • Execute the main deployment and remediation steps again as outlined in the automated deployment.
• If you used the manual deployment:

  • Repeat the steps you did for manual deployment, ensuring that you are logging the new resource logs to the correct storage accounts for ingestion into CDR for Azure.

Adding new locations/regions to your Azure deployment

Situation:

• Your organization has added new locations/regions to your overall Azure deployment, and you want to make sure that they are covered by Vectra CDR for Azure.

Required Action:

• If you used the automated deployment:

  • Execute the main deployment and remediation steps again as outlined in the automated deployment.
• If you used the manual deployment:

  • Repeat the steps you did for manual deployment, ensuring that you are logging correctly for the new locations/regions and supported resources to the correct storage accounts for ingestion into CDR for Azure.