Skip to content

Commit deda2b0

Browse files
authored
inf about strategies if more than 40 tus
1 parent 93f280c commit deda2b0

1 file changed

Lines changed: 205 additions & 11 deletions

File tree

0_Azure/2_AzureAnalytics/2_EventHubs/demos/1_SizeDefenderAdvancedHuntingAdd-onforSplunk.md

Lines changed: 205 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ Last updated: 2025-03-25
2222
- [Microsoft Defender Advanced Hunting Add-on for Splunk](https://splunkbase.splunk.com/app/5518)
2323
- [Monitor Azure Event Hubs](https://learn.microsoft.com/en-us/azure/event-hubs/monitor-event-hubs?tabs=AzureDiagnostics%2CAzureDiagnosticsforRuntimeAudit%2CAzureDiagnosticsforAppMetrics)
2424
- [Pricing calculator](https://azure.microsoft.com/en-us/pricing/calculator/?msockid=38ec3806873362243e122ce086486339)
25-
25+
- [Quickstart: Create a Dedicated Azure Event Hubs cluster using Azure portal](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-dedicated-cluster-create-portal)
26+
2627
</details>
2728

2829
> [!TIP]
@@ -37,6 +38,7 @@ Last updated: 2025-03-25
3738
- [Step 3: Monitor and Adjust](#step-3-monitor-and-adjust)
3839
- [Installation Steps](#installation-steps)
3940
- [Example Calculation](#example-calculation)
41+
- [How to achieve more TUs](#how-to-achieve-more-tus)
4042

4143
## Overview
4244

@@ -285,26 +287,26 @@ index=* sourcetype="defender:advancedhunting:email"
285287

286288
## Example Calculation
287289

288-
> Assume we have 200 endpoints, each sending 0.25 MB of data per second and generating 2 events per second.
290+
> Assume we have 200 endpoints and 50 servers. Each endpoint sends 0.25 MB of data per second and generates 2 events per second. Each server sends 1 MB of data per second and generates 5 events per second.
289291
290292
1. **Total Ingress Data Rate**:
291293

292294
$$
293-
\text{Total Ingress MB/s} = \text{Number of Endpoints} * \text{Data Volume per Endpoint (MB/s)}
295+
\text{Total Ingress MB/s} = (\text{Number of Endpoints} \times \text{Data Volume per Endpoint (MB/s)}) + (\text{Number of Servers} \times \text{Data Volume per Server (MB/s)})
294296
$$
295-
297+
296298
$$
297-
\text{Total Ingress MB/s} = 200 \text{ endpoints} * 0.25 \text{ MB/s per endpoint} = 50 \text{ MB/s}
299+
\text{Total Ingress MB/s} = (200 \text{ endpoints} \times 0.25 \text{ MB/s per endpoint}) + (50 \text{ servers} \times 1 \text{ MB/s per server}) = 50 \text{ MB/s} + 50 \text{ MB/s} = 100 \text{ MB/s}
298300
$$
299301

300302
2. **Total Event Rate**:
301303

302304
$$
303-
\text{Total Events/second} = \text{Number of Endpoints} \times \text{Event Rate per Endpoint (events/second)}
305+
\text{Total Events/second} = (\text{Number of Endpoints} \times \text{Event Rate per Endpoint (events/second)}) + (\text{Number of Servers} \times \text{Event Rate per Server (events/second)})
304306
$$
305307

306308
$$
307-
\text{Total Events/second} = 200 \text{ endpoints} \times 2 \text{ events/second per endpoint} = 400 \text{ events/second}
309+
\text{Total Events/second} = (200 \text{ endpoints} \times 2 \text{ events/second per endpoint}) + (50 \text{ servers} \times 5 \text{ events/second per server}) = 400 \text{ events/second} + 250 \text{ events/second} = 650 \text{ events/second}
308310
$$
309311

310312
3. **Calculate Required TUs**:
@@ -316,7 +318,7 @@ $$
316318
$$
317319

318320
$$
319-
\text{Required TUs for MB/s} = \frac{50 \text{ MB/s}}{1 \text{ MB/s per TU}} = 50 \text{ TUs}
321+
\text{Required TUs for MB/s} = \frac{100 \text{ MB/s}}{1 \text{ MB/s per TU}} = 100 \text{ TUs}
320322
$$
321323

322324
> Required TUs for Events/second:
@@ -326,7 +328,7 @@ $$
326328
$$
327329

328330
$$
329-
\text{Required TUs for Events/second} = \frac{400 \text{ events/second}}{1000 \text{ events/second per TU}} = 0.4 \text{ TUs}
331+
\text{Required TUs for Events/second} = \frac{650 \text{ events/second}}{1000 \text{ events/second per TU}} = 0.65 \text{ TUs}
330332
$$
331333

332334
4. **Determine the Maximum Value**:
@@ -336,16 +338,208 @@ $$
336338
$$
337339

338340
$$
339-
\text{Required TUs} = \max(50, 0.4) = 50 \text{ TUs}
341+
\text{Required TUs} = \max(100, 0.65) = 100 \text{ TUs}
340342
$$
341343

342344
| **Step** | **Action** | **Example** | **Metric** | **Value** | **Formula** |
343345
|-------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|-------------------|-----------------------|-------------|
344346
| **Data Sources** | Identify all devices and systems that will provide telemetry data. | Endpoints, servers, network devices, applications. | **Number of Sources** | Endpoints: 200, Servers: 50 | N/A |
345347
| **Data Volume** | Calculate the average amount of data generated by each source per second. | Endpoint generates 0.25 MB/s, server generates 1 MB/s. | **Total Data Volume (MB/s)** | Endpoints: 50, Servers: 50 | Number of Sources * Data Volume per Source |
346348
| **Event Rate** | Determine the frequency of events generated by each source per second. | Endpoint generates 2 events/s, server generates 5 events/s. | **Total Event Rate (events/s)** | Endpoints: 400, Servers: 250 | Number of Sources * Event Rate per Source |
347-
| **Required TUs** | Calculate the required Throughput Units based on data volume and event rate. | Total Ingress MB/s = 50, Total Events/second = 400 | **Required TUs** | 50 | Max value between the two: 50/1 = (50) or 400/1000 = (0.4) |
349+
| **Required TUs** | Calculate the required Throughput Units based on data volume and event rate. | Total Ingress MB/s = 100, Total Events/second = 650 | **Required TUs** | 100 | Max value between the two: 100/1 = (100) or 650/1000 = (0.65) |
350+
351+
## How to achieve more TUs
352+
353+
> Azure Event Hubs has specific limits on the number of Throughput Units (TUs) that can be assigned to a single Event Hub. As of my last update, the maximum number of TUs for a single Event Hub in the Standard tier is 40. If you need more than 40 TUs, you would need to use multiple Event Hubs or consider other strategies.
354+
355+
| **Method**| **Description**| **Steps** |
356+
|-----------------------------------------|--------------------------------------------|-----------------------------------------------------------------------------------------------|
357+
| **Using Multiple Event Hubs with Load Balancer** | Distribute the data load across multiple Event Hubs using a load balancer.| Create four Event Hubs with 25 TUs each, set up load balancer, configure data sources.|
358+
| **Partitioning Data Streams** | Divide data streams into smaller chunks and send to different Event Hubs.| Create multiple Event Hubs, partition data streams, configure data sources.|
359+
| **Using Event Hub Namespaces** | Manage multiple Event Hubs under a single namespace.| Create an Event Hub namespace, create multiple Event Hubs, configure data sources. |
360+
| **Using Azure Stream Analytics** | Process and route data streams to multiple Event Hubs.| Create Stream Analytics job, configure inputs and outputs, define query. |
361+
| **Using Azure Data Factory** | Orchestrate and manage data flows between multiple Event Hubs.| Create Data Factory, create pipelines, configure data sources, configure Event Hubs. |
362+
| **Using Event Hubs Dedicated Clusters** | Provision a single-tenant cluster with high capacity and low latency.| Create a dedicated cluster, create namespaces and event hubs, distribute data. |
363+
364+
> Configuration Steps:
365+
366+
<details>
367+
<summary>1. Using Multiple Event Hubs with Load Balancer</summary>
368+
369+
> Distribute the data load across multiple Event Hubs using a load balancer.
370+
371+
- **Load Balancer Configuration**:
372+
- Use the Azure portal or Azure CLI to create and configure the load balancer.
373+
- Define backend pools consisting of the four Event Hubs.
374+
- Set up rules to distribute traffic based on round-robin or other algorithms.
375+
- **Health Probes**:
376+
- Configure HTTP or TCP health probes to periodically check the status of each Event Hub.
377+
- Define thresholds for probe responses to determine when an Event Hub is considered unhealthy.
378+
379+
**Steps**:
380+
1. **Create Four Event Hubs**:
381+
- Navigate to the Azure portal.
382+
- Create four Event Hubs, each configured with 25 TUs.
383+
- Ensure each Event Hub is set up within the same region for optimal performance.
384+
385+
2. **Set Up Load Balancer**:
386+
- Create an Azure Load Balancer.
387+
- Configure the load balancer to distribute incoming data evenly across the four Event Hubs.
388+
- Set up health probes to monitor the status of each Event Hub and ensure data is routed to healthy instances.
389+
390+
3. **Configure Data Sources**:
391+
- Update your data sources to send data to the load balancer's IP address or DNS name.
392+
- Ensure data sources are configured to handle failover scenarios, redirecting data to other Event Hubs if one becomes unavailable.
393+
394+
</details>
395+
396+
<details>
397+
<summary>2. Partitioning Data Streams</summary>
398+
399+
> Divide the data streams into smaller, manageable chunks and send them to different Event Hubs.
400+
401+
- **Partitioning Strategy**:
402+
- Use hashing algorithms to partition data based on device ID or other criteria.
403+
- Implement partitioning logic within Azure Functions or custom applications.
404+
- **Data Source Configuration**:
405+
- Use SDKs or APIs to configure data sources to send data to specific Event Hubs.
406+
- Implement retry logic to handle failover scenarios.
407+
408+
**Steps**:
409+
1. **Create Multiple Event Hubs**:
410+
- Navigate to the Azure portal.
411+
- Create multiple Event Hubs, each with a portion of the required TUs.
412+
- Ensure each Event Hub is set up within the same region for optimal performance.
413+
414+
2. **Partition Data Streams**:
415+
- Implement a partitioning strategy based on specific criteria such as device ID, region, or data type.
416+
- Use Azure Functions or custom code to partition data streams dynamically.
417+
418+
3. **Configure Data Sources**:
419+
- Update your data sources to send data to the appropriate Event Hub based on the partitioning strategy.
420+
- Ensure data sources are configured to handle failover scenarios, redirecting data to other Event Hubs if one becomes unavailable.
421+
422+
</details>
423+
424+
<details>
425+
<summary>3. Using Event Hub Namespaces</summary>
426+
427+
> Manage multiple Event Hubs under a single namespace, providing a unified management experience.
428+
429+
- **Namespace Configuration**:
430+
- Use the Azure portal or Azure CLI to create and configure the namespace.
431+
- Define Event Hubs within the namespace with specific throughput and retention settings.
432+
- **Data Source Configuration**:
433+
- Use SDKs or APIs to configure data sources to send data to specific Event Hubs within the namespace.
434+
- Implement retry logic to handle failover scenarios.
435+
436+
**Steps**:
437+
1. **Create an Event Hub Namespace**:
438+
- Navigate to the Azure portal.
439+
- Create an Event Hub namespace in Azure.
440+
- Ensure the namespace is set up within the same region for optimal performance.
441+
442+
2. **Create Multiple Event Hubs**:
443+
- Within the namespace, create multiple Event Hubs, each with a portion of the required TUs.
444+
- Configure each Event Hub with appropriate settings for throughput and retention.
445+
446+
3. **Configure Data Sources**:
447+
- Update your data sources to send data to the appropriate Event Hub within the namespace.
448+
- Ensure data sources are configured to handle failover scenarios, redirecting data to other Event Hubs if one becomes unavailable.
348449

450+
</details>
451+
452+
<details>
453+
<summary>4. Using Azure Stream Analytics</summary>
454+
455+
> Process and route data streams to multiple Event Hubs using Azure Stream Analytics.
456+
457+
- **Stream Analytics Job Configuration**:
458+
- Use the Azure portal or Azure CLI to create and configure the Stream Analytics job.
459+
- Define inputs and outputs with specific settings for data ingestion and routing.
460+
- **Query Definition**:
461+
- Use SQL-like syntax to write queries for data routing.
462+
- Implement logic to route data based on device ID, region, or other criteria.
463+
464+
**Steps**:
465+
1. **Create Stream Analytics Job**:
466+
- Navigate to the Azure portal.
467+
- Create a Stream Analytics job in Azure.
468+
- Configure the job with appropriate settings for input and output.
469+
470+
2. **Configure Inputs**:
471+
- Define inputs to receive data from your data sources.
472+
- Configure input settings to handle data ingestion and processing.
473+
474+
3. **Configure Outputs**:
475+
- Define outputs to send data to multiple Event Hubs.
476+
- Configure output settings to handle data routing and distribution.
477+
478+
4. **Define Query**:
479+
- Write a query to route data to the appropriate Event Hub based on specific criteria.
480+
- Test and validate the query to ensure accurate data routing.
481+
482+
</details>
483+
484+
<details>
485+
<summary>5. Using Azure Data Factory</summary>
486+
487+
> Orchestrate and manage data flows between multiple Event Hubs using Azure Data Factory.
488+
489+
- **Data Factory Configuration**:
490+
- Use the Azure portal or Azure CLI to create and configure the Data Factory instance.
491+
- Define pipelines with specific settings for data orchestration.
492+
- **Pipeline Definition**:
493+
- Use visual tools or code to define pipelines for data ingestion, transformation, and routing.
494+
- Implement logic to route data to specific Event Hubs based on criteria.
495+
496+
**Steps**:
497+
1. **Create Data Factory**:
498+
- Navigate to the Azure portal.
499+
- Create an Azure Data Factory instance.
500+
- Configure the instance with appropriate settings for data orchestration.
501+
502+
2. **Create Pipelines**:
503+
- Define pipelines to manage data flows between data sources and Event Hubs.
504+
- Configure pipeline settings to handle data ingestion, transformation, and routing.
505+
506+
3. **Configure Data Sources**:
507+
- Update your data sources to send data to the Data Factory.
508+
- Configure data source settings to handle data ingestion and processing.
509+
510+
4. **Configure Event Hubs**:
511+
- Define Event Hubs as destinations within the Data Factory pipelines.
512+
- Configure Event Hub settings to handle data routing and distribution.
513+
514+
</details>
515+
516+
<details>
517+
<summary>6. Using Event Hubs Dedicated Clusters</summary>
518+
519+
> Provision a single-tenant cluster with high capacity and low latency.
520+
521+
- **Dedicated Cluster Configuration**:
522+
- Use the Azure portal or Azure CLI to create and configure the dedicated cluster.
523+
- Define namespaces and Event Hubs within the cluster with specific settings for throughput and retention.
524+
- **Data Distribution**:
525+
- Use partitioning or load balancing algorithms to distribute data evenly across Event Hubs.
526+
- Implement retry logic to handle failover scenarios and ensure data availability.
527+
528+
**Steps**:
529+
1. **Create an Event Hubs Dedicated Cluster**:
530+
- Navigate to the Azure portal.
531+
- Create a dedicated cluster with the required capacity units (CUs).
532+
- Configure the cluster with appropriate settings for throughput and latency.
533+
534+
2. **Create Namespaces and Event Hubs**:
535+
- Within the dedicated cluster, create namespaces and Event Hubs.
536+
- Configure each Event Hub with appropriate settings for throughput and retention.
537+
538+
3. **Distribute Data**:
539+
- Use partitioning or load balancing to distribute the data evenly across the Event Hubs within the cluster.
540+
- Implement logic to handle failover scenarios and ensure data availability.
541+
542+
</details>
349543

350544
<div align="center">
351545
<h3 style="color: #4CAF50;">Total Visitors</h3>

0 commit comments

Comments
 (0)