I’m trying to enable security logs for auditing in Azure. I’ve looked at security in the data sources from windows machines, but that says the intelligence pack isn’t installed.
I think they may be in the security Center. I was wondering how to save these logs to a storage account for long term retention.
I hope this makes sense.
If you just need to get teh security logs then you will need to configure Log Analytics to pull in that log under the data sources section. Then you will need to onboard the required VMs into log analytics to get the agent installed. At this point you will then see this data flow into log analytics.
There is however not an easy way to export this data from Log Analytics to storage. You would have to run a script in something like Azure Functions or Automation to do this. Example here.