Active Directory Event Pollers
The Turbot Azure Directory Poller control will query Audit Logs (Monitor) for relevant events on a schedule, and forward them to Turbot.
Azure Active Directory Poller Turbot Policies
The following policies will need to be configured to enable Azure AD Polling
Policy Type | Description |
---|---|
Azure > Turbot > Directory Event Poller | Enable/ Disable polling |
Azure > Turbot > Directory Event Poller > Interval | The polling interval - how often to poll |
Azure > Turbot > Directory Event Poller > Window | The polling window - how far back to retrieve events when polling. This must exceed the interval, and is required in case events are received by Azure Monitor out of order |
Relevant policy schema
Azure > Turbot > Directory Event Poller
description: | Configure the Azure Directory Event Poller. When set to `Enabled`, the poller will run at the interval specified to retrieve the latest events and forward them to the Turbot Router.
Note: The Event Poller and Turbot Event Handler are different mechanisms for sending the same information to Turbot. You should enable one or the other, but typically not both. If you feel like you need to enable both, please contact Turbot support and we'll discuss your use case with you in depth.
targets: Azure Active Directory
schema: type: string enum: - Enabled - Disabled default: Disabled
Azure > Turbot > Directory Event Poller > Interval
description: | The polling interval. This policy determines how often the event poller will run.
targets: Azure Active Directory
schema: type: string enum: - Every 1 minute - Every 2 minutes - Every 3 minutes - Every 4 minutes - Every 5 minutes - Every 6 minutes - Every 7 minutes - Every 8 minutes - Every 9 minutes - Every 10 minutes default: Every 2 minute
Azure > Turbot > Directory Event Poller > Window
description: | The polling window, in minutes. This policies determines the oldest events the event poller will retrieve. For example, setting the window to '10 minutes' will cause the poller to retrieve all events from the previous 10 minutes every time it runs.
The Window must be greater than the Interval, and it is recommended to be at least twice the Interval. For example, if the Interval is 'Every 10 Minutes', the Window should be at least '20 Minutes'.
targets: Azure Active Directory
schema: type: string enum: - 5 minutes - 6 minutes - 7 minutes - 8 minutes - 9 minutes - 10 minutes - 11 minutes - 12 minutes - 13 minutes - 14 minutes - 15 minutes - 16 minutes - 17 minutes - 18 minutes - 19 minutes - 20 minutes - 30 minutes - 40 minutes default: 10 minutes