Azure Function App code for real-time alerting

Azure Function App code for real-time alerting

0
Created On 09/26/18 13:45 PM - Last Modified 07/19/22 23:08 PM


Resolution


When configuring an Azure external account for real-time alerting, the user is required to copy and paste a set of code into the Azure Function App.  However, once the configuration "completes", it is not possible to view the code from Evident Monitoring web UI again.

 

Below is the code (taken on 9/21/17) that you need to copy into your Azure function app.  Note that the code may have changed since.

 

Make sure to replace $REPLACE_FUNC_URL with the URL of your Azure external account or channel group.

 

var request = require('request');

module.exports.eventHubConsumer = function (context, eventHubData) {
    var event = {};
    event.func = 'EvidentEsp';
    if (Array.isArray(eventHubData)) eventHubData = eventHubData[0];
    context.log(event.func + ' called.');
    var logs = eventHubData.records;
    if (!logs) {
        return context.done();
    }

    event.invokationId = context.invokationId;
    event.logs = [];
    event.subscriptionId = getSubscriptionId(logs);
    event.url = process.env.EVIDENT_URL || '$REPLACE_FUNC_URL';
    logs.forEach(function (log) {
        event.logs.push(buildEvent(log));
    });
    sendEvent(context, event);
};

function buildEvent(log) {
    return {"eventId": log.id, "log": JSON.stringify(log)};
}

function sendEvent(context, event) {
    context.log('Sending to url: ' + event.url + ' for subscription: ' + event.subscriptionId);
    request.post(event.url, {
        json: {
            "function" : event.func,
            "invokationId" : event.invokationId,
            "subscriptionId": event.subscriptionId,
            "logs": event.logs
        }
    }, function (error, response) {
        if (error) {
            context.log('Error posting the message');
            context.done(error);
        }
        else {
            context.log('Successfully posted the message');
            context.log("response: ", JSON.stringify(response));
            context.done();
        }
    });
}

function getSubscriptionId(logs) {
    var ret = '';
    if (logs[0] && logs[0].resourceId) {
        var r = logs[0].resourceId.toLowerCase().match(/\/subscriptions\/([^\/]+)\//);
        if (r) {
            ret = r[1];
        }
    }
    return ret;
}

 



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClnLCAS&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail