Can I use the same Azure storage account for both Azure Monitor Logs and Azure Blob Storage sources in Panther?

Last updated: January 20, 2025

QUESTION

Can I use the same Azure storage account for both Azure Monitor Logs and Azure Blob Storage sources in Panther?

ANSWER

These two data sources require separate storage accounts.

To set up Azure Monitor Logs as a source in Panther:

  1. Create a new Azure Blob Storage account specifically for the Azure Monitor Logs source.

  2. Follow the steps in Panther's Azure Monitor Logs setup guide to configure the new storage account.

If you attempt to use the same storage account for both sources, you will encounter an error message similar to: "Integration Azure Monitor already uses the same Storage Account (accountname)".

Remember, your existing Azure Blob Storage source can continue to use its current storage account, while the new Azure Monitor Logs source will require its own separate storage account.