tPjT@UdZddlZddlZddlZddlZddlmZddlmZddl m Z ddl m Z ddl mZddlmZdd lmZdd lmZmZdd lmZmZd Ze ed <dZe ed<eeddZe eeefed<GddeZy)aU Azure Sentinel Integration - sends logs to Azure Log Analytics using Logs Ingestion API Azure Sentinel uses Log Analytics workspaces for data storage. This integration sends LiteLLM logs to the Log Analytics workspace using the Azure Monitor Logs Ingestion API. Reference API: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview `async_log_success_event` - used by litellm proxy to send logs to Azure Sentinel `async_log_failure_event` - used by litellm proxy to send failure logs to Azure Sentinel For batching specific details see CustomBatchLogger class N)Mapping)MappingProxyType)Final)urlparse)verbose_logger)CustomBatchLogger) safe_dumps)get_async_httpx_clienthttpxSpecialProvider)StandardAuditLogPayloadStandardLoggingPayloadz!https://login.microsoftonline.comDEFAULT_AZURE_AUTHORITY_HOSTz"https://monitor.azure.com/.defaultDEFAULT_AZURE_MONITOR_SCOPEz!https://monitor.azure.us/.default)zlogin.microsoftonline.comzlogin.microsoftonline.usMONITOR_SCOPE_BY_AUTHORITY_HOSTc:eZdZdZ ddedzdedzdedzdedzdedzdedzd edzd edzffd Zed ed efd Zed ed efdZedededed efdZ d efdZ dZ dZ de d dfdZdZdZdeee zdeded dfdZdZxZS)AzureSentinelLoggerz_ Logger that sends LiteLLM logs to Azure Sentinel via Azure Monitor Logs Ingestion API Ndcr_immutable_id stream_nameendpoint tenant_id client_id client_secretaudit_stream_nameauthority_hostc  8ttj|_|xst j d} |xst j dxsd} |xst j dxs| } |xst j d} |xs,t j dxst j d}|xs,t j d xst j d }|xs,t j d xst j d }|j |xs4t j d xst j dxst}| s td| s td|s td|s td|s td| |_ | |_ | |_ | |_ ||_ ||_||_|j!| | | |_|j!| | | |_||_|j)||_d|_d|_t1j2|_t7|pdi| d|j4it1j:|j=g|_g|_ y)a Initialize Azure Sentinel logger using Logs Ingestion API Args: dcr_immutable_id (str, optional): Data Collection Rule (DCR) Immutable ID. If not provided, will use AZURE_SENTINEL_DCR_IMMUTABLE_ID env var. stream_name (str, optional): Stream name from DCR (e.g., "Custom-LiteLLM"). If not provided, will use AZURE_SENTINEL_STREAM_NAME env var or default to "Custom-LiteLLM". endpoint (str, optional): Data Collection Endpoint (DCE) or DCR ingestion endpoint. If not provided, will use AZURE_SENTINEL_ENDPOINT env var. tenant_id (str, optional): Azure Tenant ID for OAuth2 authentication. If not provided, will use AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID env var. client_id (str, optional): Azure Client ID (Application ID) for OAuth2 authentication. If not provided, will use AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID env var. client_secret (str, optional): Azure Client Secret for OAuth2 authentication. If not provided, will use AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET env var. audit_stream_name (str, optional): Stream name from DCR for audit logs. If not provided, will use AZURE_SENTINEL_AUDIT_STREAM_NAME env var or the standard stream name. authority_host (str, optional): Microsoft Entra authority host that issues the OAuth2 token, e.g. "https://login.microsoftonline.us" for Azure Government. If not provided, will use AZURE_SENTINEL_AUTHORITY_HOST or AZURE_AUTHORITY_HOST env vars, or default to the Azure Public Cloud authority. The Azure Monitor audience is derived from it. ) llm_providerAZURE_SENTINEL_DCR_IMMUTABLE_IDAZURE_SENTINEL_STREAM_NAMEzCustom-LiteLLM AZURE_SENTINEL_AUDIT_STREAM_NAMEAZURE_SENTINEL_ENDPOINTAZURE_SENTINEL_TENANT_IDAZURE_TENANT_IDAZURE_SENTINEL_CLIENT_IDAZURE_CLIENT_IDAZURE_SENTINEL_CLIENT_SECRETAZURE_CLIENT_SECRETAZURE_SENTINEL_AUTHORITY_HOSTAZURE_AUTHORITY_HOSTzrAZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.zbAZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.zwAZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.zwAZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.zAZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.rrr)rN flush_lock)!r r LoggingCallbackasync_httpx_clientosgetenv_normalize_authority_hostr ValueErrorrrrrrrr_build_api_endpoint api_endpointaudit_api_endpointr_resolve_oauth_scope oauth_scope oauth_tokenoauth_token_expires_atasyncioLockr*super__init__ create_taskperiodic_flush log_queueaudit_log_queue)selfrrrrrrrrkwargsresolved_dcr_immutable_idresolved_stream_nameresolved_audit_stream_nameresolved_endpointresolved_tenant_idresolved_client_idresolved_client_secretresolved_authority_host __class__s w/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/integrations/azure_sentinel/azure_sentinel.pyr<zAzureSentinelLogger.__init__1sF#9FZFjFj"k+;+kryyIj?k!&1&pRYY?[5\&p`p  f+M!N fRf #$,#Sryy9R/S$-$v;U1V$vZ\ZcZcduZv$-$v;U1V$vZ\ZcZcduZv  jRYY'EF j"))TiJj *.)G)G  ,yy89 ,yy/0 ,, * )E !t "J "J &V !:/!;) ++3!44&6,5  #'":":&62#;# 644D[4\'+48#!,,. >6>doo>D//1279>@returncV|jjd}d|vr|Sd|S)a Normalize an authority host into an absolute URL with no trailing slash. Accepts the scheme-qualified form litellm documents ("https://login.microsoftonline.us") and the bare-host form the azure-identity AzureAuthorityHosts constants use. /z://zhttps://)striprstrip)rstrippeds rLr0z-AzureSentinelLogger._normalize_authority_hosts6)..077< H,xGHXJ2GGrMcht|jxsd}tj|tS)z Map an authority host to the Azure Monitor Logs Ingestion audience for the same cloud, falling back to the Azure Public Cloud audience for an unrecognized host. )rhostnamergetr)rhosts rLr5z(AzureSentinelLogger._resolve_oauth_scopes- ~.77=2.2249TUUrMc6|jdd|d|dS)NrPz/dataCollectionRules/z /streams/z?api-version=2023-01-01)rRr)s rLr2z'AzureSentinelLogger._build_api_endpoints+//#&''<=M#% sC&F(F)B0FcK tjd||jdd}|tjdy|jj |t |j|jk\r|jd{yy7#t$r3}tjd|tjYd}~yd}~wwxYww)a" Async Log success events to Azure Sentinel - Gets StandardLoggingPayload from kwargs - Adds to batch queue - Flushes based on CustomBatchLogger settings Raises: Raises a NON Blocking verbose_logger.exception if an error occurs z>Azure Sentinel: Logging - Enters logging function for model %sstandard_logging_objectN;Azure Sentinel: standard_logging_object not found in kwargs"Azure Sentinel Layer Error - %s %s rdebugrWwarningr?appendlen batch_sizeasync_send_batchrk exception traceback format_excrArB response_obj start_timeend_timestandard_logging_payloades rLasync_log_success_eventz+AzureSentinelLogger.async_log_success_events g  !aci j.4jj9RTX.Y $'/&&'de NN ! !": ;4>>"doo5++---6- g  $ $%JAyOcOcOe f f gMC?BCABBBCB C&)CCCCcK tjd||jdd}|tjdy|jj |t |j|jk\r|jd{yy7#t$r3}tjd|tjYd}~yd}~wwxYww)a" Async Log failure events to Azure Sentinel - Gets StandardLoggingPayload from kwargs - Adds to batch queue - Flushes based on CustomBatchLogger settings Raises: Raises a NON Blocking verbose_logger.exception if an error occurs zFAzure Sentinel: Logging - Enters failure logging function for model %srtNrurvrwrs rLasync_log_failure_eventz+AzureSentinelLogger.async_log_failure_events g  X /5jj9RTX.Y $'/&&'de NN ! !": ;4>>"doo5++---6- g  $ $%JAyOcOcOe f f gr audit_logcK tjd|jd|jd|jd|jj |t |j|j k\r|jd{yy7#t$r3}tjd|tjYd}~yd}~wwxYww)z Async log LiteLLM audit log events to Azure Sentinel. Audit logs are queued separately from standard LLM logs so mixed callback usage never sends schema-mismatched records in the same ingestion batch. zrs  #"!+FAP&IeI%IUI