Microsoft Azure CSPM — Script Configuration

Updated Apr 4, 2024

Configure Microsoft Azure for Arctic Wolf CSPM using a Terraform script

You can configure Azure® for Arctic Wolf® Cloud Security Posture Management (CSPM) using a Terraform® script.

Note: Multi-subscription and multi-tenant configurations are not supported.

A valid Arctic Wolf® Managed Risk license
These tools:
- Terraform binary version 1.3.7 or newer
  
  Tip: Run terraform version to verify your existing Terraform version.
- CSPM Azure Terraform script
A user principal role with the Global Administrator role

For each subscription or tenant you want to scan, complete these steps:

Sign in to the Azure Portal.
In the navigation menu, click Cloud Shell.
If this is your first time using Azure Cloud Shell, complete these steps:

Note: This might result in subscription fees.
1. Select the subscription used to create the storage account and file share.
2. Click Create storage.
Choose either Bash or PowerShell as your command line environment.
Run this command to verify that you are using the Azure subscription you want to run Terraform with:

Note: If the Azure subscription is incorrect, see the Microsoft documentation for Terraform configuration in Azure Cloud Shell for steps to authenticate with a different subscription.
```
az account show
```
Run this command to initialize Terraform:
```
terraform init
```
Run these commands to confirm that the module is configured correctly:
```
terraform validate
terraform plan
terraform apply
```

Sign in to the Arctic Wolf Unified Portal.
Click Telemetry Management > Connected Accounts.
Click Add Account +.
On the Add Account page, in the Account Type list, select Cloud Security Posture Management.
In the cloud services list, click Azure CSPM.
On the Add Account page, configure these settings:

Tip: To retrieve these values at any time, see Retrieve environment values for more information.
- Account Name — Enter a unique and descriptive name for the account.
- Directory ID — Enter the directory ID from the command output in Configure the CSPM Terraform script.
- Application ID — Enter the application ID from the command output in Configure the CSPM Terraform script.
- Subscription ID — Enter the subscription ID from the command output in Configure the CSPM Terraform script.
- Secret Key — Enter the secret key from the command output in Configure the CSPM Terraform script.
- Credential Expiry — (Optional) Enter the credential expiration date, if applicable.
Click Test and submit credentials.