Error - Wazuh integration Azure Log Analytics

[Facu Basgall]

I am trying to integrate Wazuh with Azure - Logs Analytics, I followed the documentation but I am getting this error.

The same application works for Office365 and MS Graph

Can you help me?

[Carlos Ezequiel Bordon]

Hi, in the logs you shared, we can see the error: Log Analytics: 403 Client Error: Forbidden for url ..... This may indicate some permission issues in your application. I'm sharing the Log Analytics guide so you can review it and correct the necessary permissions for the integration to work.

https://documentation.wazuh.com/current/cloud-security/azure/log-analytics.html#granting-permissions-to-the-application

[Facu Basgall]

The permissions are correct, in fact I am using the same application to send data from office365 and ms graph.

[Carlos Ezequiel Bordon]

Can you share the configuration blocks corresponding to the queries that appear in the logs you shared?

```
RiskyServicePrincipals
ServicePrincipalRiskEvents
ProvisioningLogs
```

[Facu Basgall]

Hi

All modules are configured the same way and none of them work: AuditLogs, SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, RiskyUsers, UserRiskEvents, RiskyServicePrincipals, ServicePrincipalRiskEvents, ProvisioningLogs

In the first comment I sent you a snippet of the logs and configuration.