Policy Packs

guardrails-samples

The Guardrails Event Poller are responsible polling Audit Logs (Azure Monitor) at intervals specified and retrieves the latest events (Succeeded) for processing.

Enable Event Pollers for Azure Subscriptions

main

azure_turbot_event_poller

Configure the Azure Event Poller. When set to `Enabled`, the poller will&#92;nrun at the interval specified to retrieve the latest events and forward&#92;nthem to the Guardrails Router.&#92;n&#92;nNote: The Event Poller and Guardrails Event Handler are different mechanisms for&#92;nsending information to Guardrails. You should enable one or the other, but not both.&#92;n

eventPoller

Azure > Turbot > Event Poller

azure_turbot_event_poller_interval

The polling interval. This policy determines how often&#92;nthe event poller will run.&#92;n

eventPollerInterval

Azure > Turbot > Event Poller > Interval

azure_turbot_event_poller_interval_window

The polling window, in minutes. This policies determines the oldest&#92;nevents the event poller will retrieve. For example, setting the window&#92;nto &#39;5 minutes&#39; will cause the poller to retrieve all events from&#92;nthe previous 5 minutes every time it runs.&#92;n&#92;nThe Window must be greater than the Interval, and it is recommended&#92;nto be at least twice the Interval. For example, if the Interval&#92;nis &#39;Every 5 Minutes&#39;, the Window should be at least &#39;10 Minutes&#39;.&#92;n

Policy	Setting	Note
Azure > Turbot > Event Poller	Enabled
Azure > Turbot > Event Poller > Interval	Every 1 minute
Azure > Turbot > Event Poller > Window	15 minutes

Policy Settings