How do I create an Azure Cloud Canary?

How to create an Azure Cloud Canary by deploying it within your Azure environment, running the provided script, and connecting it to your Canary Console to monitor your cloud infrastructure and receive alerts for suspicious activity.

Canaries aren't limited to Hardware devices; you can also deploy them directly within your Azure Cloud environment. This allows you to monitor your infrastructure using the same Console that manages the rest of your Canary fleet.

Keep in mind:

• Like other Cloud Canaries, a registered but offline Azure Canary still consumes a licence. If you've terminated a Canary in Azure, remember also to decommission it from your Console.

• If you have multiple subscription IDs, you may need to manually select the correct subscription if it's not the default. Click here to jump to the steps.

• For detailed information on permissions required to launch an Azure Cloud Canary, jump to our permissions guide.

Follow the steps below to create your Azure Cloud Canary:

Step 1: Sign in to your Console

You can log in to your Console.

Step 2: Add a new Canary

Click the + Add button and select Add New Canary.

Step 3: Choose Azure Canary

Click Add Azure Canary.

Step 4: Launch the deployment process

Click Launch.

Step 5: Enable the Canary app in Azure

Click Follow this link to enable the Canary App in your Azure Portal.

Step 6: Accept required permissions

Click Accept to accept the permissions.

Step 7: Continue setup after authorisation

After accepting the permissions, click Next.

This step can be skipped if you would like to deploy to another tenant, where a new link can be generated in the next step here.

Step 8: Enter deployment details

Add the details below and click Next.

1. Add your Resource Group for the new VM.
2. Enter your Subscription ID.
3. Select Yes from the drop-down list.
4. Change your VM's name.
5. Select the region from the drop-down list.

If you want to launch your Bird into an existing VNET/subnet, please click on "Specify existing Vnet/Subnet" and specify the VNet Name, VNet Resource Group, and the Subnet Name, and click on Next.

Deploying to a new Azure Tenant?

If you are deploying to a new Azure tenant, an authorisation link can be created by entering the new Tenant ID, then clicking on the hyperlink.

Step 9: Generate and copy the deployment script

Select the script option you would like to use, Bash or PowerShell, copy the script and click Done.

1. Select Linux(Bash) if you opted to use Bash
2. Select Windows (PowerShell) if you opted to use PowerShell
3. Use the copy icon to copy the script to your clipboard
4. Click Done

Step 10: Run the script in Azure CLI

On Azure, open the command line option you opted to use.

• Linux — Bash
• Windows — PowerShell

We have opted to use Bash here.

• Paste the script you copied in Step 9 and hit enter.

• The script will run and let you know once it has finished.

Step 11: Confirm the new Canary in your Console

On your Console, you should see a pop-up to confirm your new Canary.

Click Add Canary to commission it to your Console.

Step 12: Manage your Canary

Your Azure Canary will boot and connect back to your Console. You can set up your new Canary from within your Console using the remote management Guide found here.

Costs per Azure Canary Virtual Machine:

The Azure birds run on a B1S instance size, and depending on the region you run the Canary in, it would cost around 7$ per month.

Simply head over to this link here, select Virtual Machine, select the region and change the instance size to B1S, and you will be given the monthly costs. (As seen below)

{YOUR_SUBSCRIPTION_ID}

Optional Permissions for the end user:

Permissions required by the service principal (Enterprise App):

You'll need to replace the subscription and resource group scope with your intended deployment location.

{
    "properties": {
        "roleName": "CanaryDeployServicePrinciple",
        "description": "",
        "assignableScopes": [
            "/subscriptions/{YOUR_SUBSCRIPTION_ID}/resourceGroups/{YOUR_RESOURCE_GROUP}"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/write",
                    "Microsoft.Resources/deployments/read",
                    "Microsoft.Resources/deployments/write",
                    "Microsoft.Network/networkInterfaces/read",
                    "Microsoft.Network/networkInterfaces/write",
                    "Microsoft.Compute/virtualMachines/read",
                    "Microsoft.Compute/virtualMachines/write",
                    "Microsoft.Resources/deployments/operationStatuses/read",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.Network/networkInterfaces/join/action"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}