# Discovery Azure Health Events # Introduction The **Azure Service Health Events** plugin discovers service health events affecting the Azure subscriptions available to a registered application. Events are grouped by impacted region and converted into Pandora FMS agents and modules. The plugin can: - Query every subscription visible to the Service Principal. - Retrieve Azure Service Health events through the Azure Resource Health API. - Group events by impacted region. - Create one agent per region or send every module to a single agent. - Apply both Azure-side filters and local regular-expression filters. - Identify new or updated events between executions. - Keep a JSONL event log for subsequent searches. - Detect regions that no longer appear in the query results. # Requirements - Pandora FMS with Discovery and support for uploading the `.disco` package. - HTTPS connectivity from the Pandora FMS server to: - `https://login.microsoftonline.com` - `https://management.azure.com` - A registered Microsoft Entra ID application with a Service Principal. - A valid client secret. - Read access to every subscription that should be monitored. - A valid agent group in the Discovery task definition. The `All` group is not valid. # Azure configuration A registered application must be created in Microsoft Entra ID, together with a client secret. The following values are required to configure the task: - **Tenant ID**: Microsoft Entra ID tenant identifier. - **Client ID**: identifier of the registered application. - **Client secret**: value of the secret created for the application. The plugin uses the OAuth 2.0 Client Credentials flow and requests a token for the following scope: ```text https://management.azure.com/.default ``` # Permissions The recommended approach is to assign the **Reader** role to the Service Principal on every subscription that should be monitored. At a minimum, a custom role must allow the application to list accessible subscriptions and read Service Health events, including `Microsoft.ResourceHealth/events/read`. Sensitive details from some security advisories may be hidden from identities without elevated permissions. The plugin queries the event list but does not call the additional `fetchEventDetails` operation required to retrieve sensitive content. # Discovery task configuration The wizard contains four visible steps. ### 1. Task definition This step configures the general Discovery task settings: - Task name. - Agent group. - Execution interval. A real Pandora FMS group must be selected. Do not use `All`, as the plugin rejects empty or non-positive group identifiers. ### 2. Azure credentials

Field	Required	Description
Tenant ID	Yes	Microsoft Entra ID tenant.
Client ID	Yes	Identifier of the registered application.
Client secret	Yes	Application secret.
API endpoint	No	When empty, `https://management.azure.com` is used. Change it only for sovereign clouds or custom environments.
Login endpoint	No	When empty, `https://login.microsoftonline.com` is used. Change it only for sovereign clouds or custom environments.

### 3. Azure event query and filters

Field	Default value	Description
Event history in days	`15`	Query period, from 1 to 365 days.
Azure API filter	Empty	Expression sent to Azure through `$filter`.
Subscription allow regexp	Empty	Expressions matched against the subscription ID and name.
Region allow regexp	Empty	Regions accepted by the plugin.
Service allow regexp	Empty	Impacted services accepted by the plugin.
Event type allow regexp	Empty	Allowed event types.
Status allow regexp	Empty	Allowed regional or general statuses.
Level allow regexp	Empty	Allowed event levels.
Event search allow regexp	Empty	At least one expression must match the complete event text.
Event search deny regexp	Empty	Discards matching events.
First run events are new	Disabled	When enabled, every event found during the first execution is treated as new.

### 4. Agents modules and execution

Field	Default value	Description
Create agent per impacted region	Enabled	Creates one agent per region. When disabled, Target agent is used.
Target agent	`Azure Service Health Events`	Single agent used when agents are not created per region.
Agent prefix	`Azure Service Health `	Prefix for regional agents.
Module prefix	Empty	Prefix added to final module names.
State modules	Enabled	Creates the `Connection` module.
Event count modules	Enabled	Creates the five event counter modules.
Event detail modules	Enabled	Creates `Events` and `New events`.
Maximum event detail length	`16000`	Maximum size of detail modules. The effective minimum is 1000 characters.
Modules allow regexp	Empty	Only creates modules whose final name matches.
Modules deny regexp	Empty	Discards modules whose final name matches.
Write event log	Enabled	Enables the JSONL event log.
Maximum event log size	`20`	Rotates the log when it reaches this size.
HTTP timeout	`30`	Maximum time per request. Zero or negative values are replaced with 30 seconds.
Maximum retries	`2`	Retries for HTTP 429 and transient Azure errors.
Verify SSL certificates	Enabled	Keep enabled in production.
Proxy URL	Empty	Optional HTTP or HTTPS proxy.
Mock Azure API URL	Empty	Reserved for testing and must remain empty in production.

# Filters ### Azure-side filter **Azure API filter** is sent directly to the API and reduces the number of events returned by Azure. The official documentation shows expressions based on service and region, for example: ```text service eq 'Virtual Machines' or region eq 'West US' ``` The plugin does not validate or modify this expression. Syntax that Azure does not accept causes the corresponding subscription request to return an error. ### Local event filters All remaining filters are evaluated locally after the events have been downloaded. Each textarea accepts one regular expression per line: ```text ^West Europe$ ^Spain Central$ ``` Matching is case-insensitive. Empty lines and lines beginning with `#` are ignored. Allow filters behave as follows: - When empty, every value is accepted. - When expressions are configured, at least one must match. **Event search allow regexp** searches the subscription, tracking ID, title, summary, status, level, type, subtype, service and region fields. **Event search deny regexp** searches the same fields and takes precedence when excluding an event. ### Module filters **Modules allow regexp** and **Modules deny regexp** are applied to the final module name after prefixes and, in single-agent mode, the region name have been added. If a module matches both allow and deny filters, deny takes precedence. Example that keeps connection and counter modules only: ```text Connection$|events count$ ``` # Generated Agents and Modules ### One agent per region When **Create agent per impacted region** is enabled, the name follows this format: ```text ``` Example: ```text Azure Service Health West Europe ``` ### Single agent When the option is disabled, every module is assigned to **Target agent**. The region is included in each module name to prevent collisions: ```text West Europe Events count Spain Central Events count ``` When **Module prefix** is also configured, it appears before the region. ## Generated modules Every module is assigned to the `Azure Service Health Events` module group.

Module	Pandora module type	Data
`Connection`	`generic_proc`	`1` when the region appears in the current query and `0` after it disappears.
`Events count`	`generic_data`	Number of unique events affecting the region.
`New events count`	`generic_data`	Number of new or updated events since the previous execution.
`Active events count`	`generic_data`	Events whose regional or general status is `Active`.
`Critical events count`	`generic_data`	Events with the `Critical` level.
`Warning events count`	`generic_data`	Events with the `Warning` level.
`Events`	`generic_data_string`	Details of every matching event.
`New events`	`generic_data_string`	Details of new or updated events; returns the integer `0` when no updates are available.

Detail modules include the title, tracking ID, subscription, status, level, type, subtype, timestamps, service, region and summary whenever available. If the text exceeds the configured limit, it is truncated and the module indicates that the complete content is available in the JSONL log.