Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • Azure Devops Audit Streaming
  • How it works
  • Prerequisites
  • Installation Step 1: Create an Azure Event Grid Topic and Subscription
  • Installation Step 2: Configure Azure DevOps Service Hooks
  • Installation Step 3: Test and Validate
  • Troubleshooting
  • Alerts Tracking
Export as PDF
  1. Xygeni Products
  2. Anomalous Activity Detection
  3. Xygeni Sensors

Xygeni Sensor for Azure

PreviousXygeni SensorsNextXygeni Sensor for BitBucket

Last updated 28 days ago

When sensors detect an unusual activity, it will raise an alert for tracking the origin and taking immediate action to mitigate the risk and prevent further damage.

Azure Devops Audit Streaming

This guide provides instructions on how to stream log events from Azure DevOps to Xygeni Server using Azure Event Grid. This integration allows Xygeni to detect unusual activity within Azure DevOps.

When Xygeni detects an unusual activity, it will raise an alert for tracking the origin and taking immediate action to mitigate the risk and prevent further damage.

How it works

This integration streams Azure DevOps log events to Xygeni Server via Azure Event Grid. It begins by setting up an Event Grid topic, configuring Azure DevOps to push specified events to this topic, and then subscribing to the Xygeni endpoint to receive these events.

Prerequisites

  • Azure Devops Organization should be using Microsoft Entra.

  • Log Audit Events should be active under Organization Settings.

Installation Step 1: Create an Azure Event Grid Topic and Subscription

  • On the Azure Portal Create a New Event Grid Topic.

  • Create a new Topic with name, region, and resource group.

  • Create Subscription and choose Web Hooks as the endpoint type and specify the Xygeni API endpoint URL.

  • Set Delivery Properties by entering a header Authorization and a header value Bearer <your_token_here>, replacing <your_token_here> with your Xygeni Api Key generated from the Xygeni portal.

  • Click on Save.

Installation Step 2: Configure Azure DevOps Service Hooks

  • On Organization Settings / General / Auditing, go to Streams and add the Azure Event Grid configured above.

Installation Step 3: Test and Validate

  • By creating the subscription, an installation event is sent to Xygeni

  • Check if a new installation should appear at the Xygeni Integration page.

Troubleshooting

  • Permissions: Ensure all permissions are correctly set for Azure DevOps and Azure Event Grid.

  • Endpoint URL: Confirm the Xygeni URL is correct and accessible from Azure.

  • Review Logs: Check the Azure Event Grid logs for any delivery issues or errors.

Alerts Tracking

You can navigate to the dashboard to keep track of all the Unusual Activity detected at the moment, ordered by time of exposure from most recent to less recent. Open .

https://api.xygeni.io/azure_streaming/aeg_event
Anomalous Activity Summary